CVE-2024-25092

CVE-2024-25092 Exploit Overview CVE-2024-25092 is a high-severity vulnerability affecting the WordPress NextMove Lite plugin versions = 2.17.0. This vulnerability allows a subscriber+ user to install and activate arbitrary plugins on a WordPress site due to missing authorization checks. Details...

EUVD-2026-96395

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597

The Cohere Python SDK versions 5.11.0 through 7.2.0 are vulnerable to a path traversal (tar slip) vulnerability within the _s3_models_dir_to_tarfile function. The root cause is the use of unvalidated tarfile.extractall() calls, which allows an attacker who can write model archives to the victim's...

CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2020-5248

CVE-2020-5248 POC Environment Setup and Test Test Method Environment Setup vim docker/nginx/default.conf servername docker host ip ; -change mysqlserver: mysql id: root pw: root Run cd docker/app/ tar -xvf /docker/app/glpi-9.4.5.tgz chmod -R 777 glpi docker-compose up -d Access glpi at...

CVE-2024-33210

CVE-2024-33210 A cross-site scripting XSS vulnerability has been identified in Flatpress 1.3. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. Vulnerability Type: Cross Site Scripting XSS Vendor of Product: flatpress CMS Affected Product Code...

CVE-2023-36844

CVE-2023-36844 The "Remote Code Execution in Juniper JunOS within SRX and EX Series products" vulnerability is a security issue that allows an attacker to execute arbitrary code on a targeted Juniper device running JunOS software. This vulnerability could potentially lead to a compromise of the...

Ashwesker-CVE-2025-52691

🚨 CVE-2025-52691 — Critical SmarterMail Vulnerability Status: 🔥 Critical — Immediate action required CVSS v3.1 Score: 10.0 / 10 Disclosure Date: December 29–30, 2025 🧩 Vulnerability Summary CVE-2025-52691 is a critical, unauthenticated arbitrary file upload vulnerability affecting SmarterTools...

CVE-2026-104286-POC

FortiMail CVE-2026-104286 Path Traversal Exploit Overview Advanced unauthenticated remote arbitrary file write exploit for CVE-2026-104286 in FortiMail. Crafted HTTP/HTTPS requests bypass path sanitization in the web client, enabling arbitrary file creation on the underlying OS. Used for red team...

CVE-2026-103978

CVE-2026-103978 - Unauthenticated path traversal in OPNMGR Arbitrary .json file read, no login needed. Found this while reading through the source of agit8or1/OPNMGR, an OPNsense fleet manager written in PHP. | ---|--- CVE| CVE-2026-103978 Advisory| GHSA-8x7v-vwpx-3wr7 Class| CWE-22 Path Traversa...

CVE-2026-103648

CVE-2026-103648 — Path Traversal in image-downloader Discovered by:Amirhossein Roustaei @EterNullSec — Eternull Security 📖 Full technical writeup:eternull.net/posts/cve-2026-103648-image-downloader-path-traversal ⚠️ Educational Purposes Only. This repository documents a responsibly disclosed...

disclosure-thinkware-u3000

Thinkware U3000 Dashcam: Vulnerabilità di Sicurezza Tre vulnerabilità nel protocollo di controllo WiFi locale della dashcam Thinkware U3000, scoperte tramite reverse engineering dell'app Android ufficiale e confermate su hardware reale. Tutte e tre richiedono solo l'accesso alla rete locale: ness...

CVE-2024-50476

CVE-2024-50476 GRÜN spendino Spendenformular = 1.0.1 - Unauthenticated Arbitrary Options Update Description: The GRÜN spendino Spendenformular – Mehr Spenden! Weniger Arbeit! plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a...

CVE-2026-100520-laranode-path-traversal

CVE-2026-100520 — Path Traversal → RCE in Laranode File Manager Authorized security research. PoC for defensive and educational use only. Authenticated path traversal in the file-manager upload endpoint of Laranode lets a low-privileged tenant write arbitrary files outside their own home director...

CVE-2025-32140

🚨 CVE-2025-32140 – WP Remote Thumbnail Exploit Arbitrary File Upload 📝 Description CVE-2025-32140 is a critical vulnerability in the WP Remote Thumbnail plugin for WordPress. It enables authenticated attackers with contributor or higher permissions to upload arbitrary files , such as web shells ,...

CVE-2024-50972

CVE-2024-50972 Description A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrowid parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

GhostCat-LFI-exp

GhostCat-LFI-exp CVE-2020-1938 Original EXP: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi Only modified one place, can include execute arbitrary files under any project...

CVE-2024-29272

CVE-2024-29272 This is a Proof-of-Concept for CVE-2024-29272, an unauthenticated arbritrary file upload vulnerability that leads to remote code execution on versions of VvvebJS -l -p in another terminal: nc -lvnp...

CVE-2025-66680

CVE-2025-66680 In Wise Force Deleter 1.5.7.59 and earlier, an attacker with local administrator access can delete arbitrary file in the file system by weaponizing the app. Usage 1. Place WiseDelfile64.sys in C:\Windows 2. Compile the project 3. Create file.txt which contain the a list of files yo...