CVE-2023-49979

CVE-2023-49979 Best Student Management System v1.0 - Incorrect Access Control - Directory Listing Description : A directory listing vulnerability in Best Student Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring...

EUVD-2026-92261

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Elevazione dei privilegi in Active Directory Certificate Services AD CS 👋 Panoramica CVE-2026-54121 "Certighost" è una vulnerabilità di elevazione dei privilegi ad alta severità che colpisce Microsoft Active Directory Certificate Services AD CS. La vulnerabilità...

CVE-2026-75604

A flaw was found in Next.js. When running on Windows systems, the application fails to properly sanitize backslashes in request paths before building file cache locations. An unauthenticated remote attacker can exploit this directory traversal weakness by submitting crafted requests to access...

CVE-2019-16784-POC

CVE-2019-16784 POC This is my POC for the Windows PyInstaller version 3.6 vulnerability that exists for the --onefile option. An attacker could achieve command execution and possible LPE by hijacking a DLL imported by the python interpreter DLL used by the pyinstaller binary. A short explanation ...

CVE-2025-25163

CVE-2025-25163 Plugin A/B Image Optimizer = 3.3 - Authenticated Subscriber+ Arbitrary File Download Description The Plugin A/B Image Optimizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3. This makes it possible for authenticated attackers,...

CVE-2025-46078

BUGAuthor: yggcwhat Affected version: Huocms Vendor: https://huocms.com/ Source Code Address: https://gitee.com/digital-flag/huocms Vulnerability File: Upload.php Affected Version： HuoCMS - controller - backend, the resourcetype parameter is validated against a whitelist of allowed file extension...

CVE-2026-4020

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual environment python -m venv...

EUVD-2026-92441

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

CVE-2026-88396

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and moveuploadedfile drops the file into the web-accessible directory...

CVE-2026-95264: Undefined Security Weakness

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-88392: Undefined Security Weakness

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

CVE-2026-88396: Undefined Security Weakness

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and moveuploadedfile drops the file into the web-accessible directory...

CVE-2026-88394: Undefined Security Weakness

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

PT-2026-106228

Name of the Vulnerable Software and Affected Versions Newell Brands DYMO ID versions prior to 1.6.0 Description The software resolves its plugin Modules directory relative to the process working directory. This allows an attacker to store a job file alongside malicious modules or DLLs. When a...

CVE-2026-88392

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

PT-2026-105997

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

CVE-2026-88392

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

PT-2026-106225

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-95264

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...