CVE-2026-53564

Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...

CVE-2026-53564 Arbitrary file read and write

Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...

CVE-2026-53564

A vulnerability in Citrix UniconOS (formerly eLux) allows for arbitrary file read and write actions. The issue is caused by CWE-668: Exposure of Resource to Wrong Sphere . The attack requires the target system to be within range of an attacker-controlled wireless access point and for a user to in...

CVE-2026-63162

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by...

CVE-2026-63162 Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by...

CVE-2026-63162 Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by...

CVE-2026-63162 Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by...

npm-tar-path-traversal-scanner

CVE-2026-31802 — npm tar Path Traversal Scanner Detects npm packages vulnerable to CVE-2026-31802 , a path traversal vulnerability in the tar npm package that allows arbitrary file writes during archive extraction. Features Scans package-lock.json for vulnerable tar versions Checks nodemodules fo...

CVE-2021-33564

CVE-2021-33564 PoC Exploit script for CVE-2021-33564 Argument Injection in Dragonfly Ruby Gem. Usage Arbitrary File Read python3 poc.py -u https:///system/refinery/images -r /etc/passwd Arbitrary File Write python3 poc.py -u https:///system/refinery/images -w public/test.txt -c test.txt -lu http:...

CVE-2026-109956

A flaw was found in NLTK. A path traversal vulnerability in the WekaClassifier module allows an attacker to bypass directory containment restrictions by supplying unvalidated model paths. By controlling these path arguments, an attacker can write arbitrary files or probe existing files outside of...

CVE-2019-14751_PoC

CVE-2019-14751PoC A Proof of Concept for CVE-2019-14751 Vulnerability Description NLTK Downloader before version 3.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in an NLTK package ZIP archive that is mishandled during extraction. For...

CVE-2026-110116

Risesoft-y9 Digital-Infrastructure versions 9.6.5 through 9.6.11 are vulnerable to a path traversal vulnerability within the fileManager storeFile endpoint. Unauthenticated attackers can exploit this by sending crafted fullPath and fileName parameters to the POST /rest/storeFile request. This all...

CVE-2026-103928

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...

CVE-2026-55168

CVE-2026-55168 This repository contains a simple PoC for CVE-2026-55168 in Runtipi. The issue is an authenticated arbitrary file write that can be reached through the backup restore flow. A crafted backup archive can plant a symlink into restored application data, and a later normal config update...

CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...

CVE-2026-43637-cornac

CVE-2026-43637: Path Traversal Tar Slip in Cornac via extractarchive Severity: High, CVSS 4.0 8.8 , Critical, CVSS 3.1 9.1assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Vector v4.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Affected:...

CVE-2026-85114

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API All versions V3.3.61. Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write...

CVE-2025-4138_tarfile_filter_bypass

CVE-2025-4138 — Python tarfile filter="data" Bypass Arbitrary file write outside the extraction directory via PATHMAX symlink chain. Affected Versions Python 3.12.0 – 3.12.10 Python 3.13.0 – 3.13.3 Fixed in 3.12.11 / 3.13.4 Credit: Reporter: Caleb Brown Google How It Works Python's tarfile data...

ogmios-queryledgerstate-dump-poc

Ogmios queryLedgerState/dump — Unauthenticated Arbitrary Fil...

CVE-2026-85114

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API All versions V3.3.61. Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write...