EUVD-2026-67565

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

CVE-2026-12513 Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

CVE-2024-27460

CVE-2024-27460 - Plantronics Desktop Hub LPE Eliminazione arbitraria di file fino a SYSTEM. La maggior parte del codice si basa sul PoC di riferimento di @filipdragovic. Grazie a @filipdragovic e @k0zmer : Articolo del blog: https://mantodeasecurity.de/en/2024/05/cve-2024-27460-plantronics-hub-lp...

Anti-Forensics

Anti-Forensics Un Repository per Tracciare le Tecniche Anti-Forensic Questa lista è stata costruita sulla base delle risposte della community DFIR e delle tecniche che attualmente copriamo nel nostro corso di Anti-Forensics. Hai qualche bella idea Anti-Forensic da condividere? DFIR DigitalForensi...

delete-self-poc

🗑️ delete-self-poc O delete-self-poc é uma demonstração de um método para excluir um executável bloqueado ou um arquivo atualmente em execução do disco. Este conceito foi inicialmente descoberto por Jonas Lykkegaard, e eu criei a prova de conceito POC para ele. Além disso, pode ser usado para...

CVE-2019-10945----Python3

CVE-2019-10945----Python3 Joomla! Core 1.5.0 - 3.9.4 - Directory Traversal / Eliminazione arbitraria di file autenticata...

EUVD-2026-67324

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-54083

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2020-3187

CVE-2020-3187 curl -H "Cookie: token=. ./+CSOU+/cscologo.gif" https://target.com/+CSCOE+/sessionpassword.html o logo.gif será excluído...

PT-2026-82871

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

PT-2026-83350

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 6.3.12 Graylog versions prior to 7.0.7 Graylog versions prior to 7.1.2 Description An insecure direct object reference IDOR exists in the token revocation process. An authenticated user can delete access tokens...

CVE-2023-20198

CVE-2023-20198 - Script PoC /!\ Disclaimer: Questo script è fornito 'così com'è' e esclusivamente per scopi educativi. Si consiglia vivamente agli utenti di prestare attenzione e di utilizzarlo nei limiti delle considerazioni legali ed etiche. Descrizione Esegue varie azioni su un server web...

CVE-2026-54083 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-54083

Wazuh is an open-source security platform (XDR/SIEM). The ip-customblock active response script contains a path traversal vulnerability: it concatenates the srcip field from alert JSON directly onto the /ipblock/ base directory without validating that the value is a well-formed IP address. Unlike...

CVE-2026-54083 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2022-31814

Download CVE-2022-31814 Dieses Skript nutzt eine Schwachstelle in pfSense aus, um eine Shell hochzuladen, einen Befehl auszuführen und die Shell anschließend zu löschen. Anforderungen Python 3.x requests-Bibliothek Installation 1. Klonen Sie das Repository oder laden Sie das Skript herunter. 2...

CVE-2023-37597

CVE-2023-37597 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Eliminazione di un gruppo utenti Disclaimer: Questo repository è destinato esclusivamente a scopi educativi e di ricerca sulla sicurezza autorizzata. Non utilizzare questo exploit contro sistemi di cui non sei proprietario o...

CVE-2023-37596

CVE-2023-37596 — issabel-pbx 4.0.0-6: Cross-Site-Request-Forgery CSRF — Beliebigen Benutzer löschen Schweregrad: Hoch | CVSS v3.1: 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | CWE: CWE-352 Inhaltsverzeichnis Übersicht Schwachstellendetails Auswirkungen Betroffene Version Angriffsszenario Proof of...

CVE-2023-34835

CVE-2023-34835 — Console di Gestione eScan: Cross-Site Scripting Riflesso XSS Indice Panoramica Dettagli della Vulnerabilità Prodotto Affetto Analisi Tecnica Prova di Concetto Passi per Riprodurre Impatto Mitigazione e Rimedio Riferimenti Disclaimer Panoramica Una vulnerabilità di Cross-Site...

CVE-2026-81729

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...