Majordomo2 - SMTP/HTTP Directory Traversal

A directory traversal vulnerability in the listfileget function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. dot dot sequences in the help command, as demonstrated using 1 a crafted email and 2 cgi-bin/mjwwwusr in the web interface. id:...

WordPress Plugin DukaPress 2.5.2 - Directory Traversal

A directory traversal vulnerability in the dpimgresize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the src parameter to lib/dpimage.php. id: CVE-2014-8799 info: name: WordPress Plugin...

Eclipse Jetty ConcatServlet - Information Disclosure

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

ECOA Building Automation System - Directory Traversal Content Disclosure

The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager fmangersub, attackers can disclose directory content on the affected device id: CVE-2021-41291 info: name: ECOA Building Automation System - Directory Travers...

Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion

A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP...

Oracle Fusion - Directory Traversal/Local File Inclusion

Oracle Business Intelligence Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 are vulnerable to local file inclusion vulnerabilities via "getPreviewImage." id: CVE-2020-14864 info: name: Oracle Fusion - Directory Traversal/Local File Inclusion author: Ivo Palazzolo @palaziv severity: high...

Ivanti Avalanche 6.3.2 - Local File Inclusion

Ivanti Avalanche 6.3.2 is vulnerable to local file inclusion because it allows remote unauthenticated user to access files that reside outside the 'image' folder. id: CVE-2021-30497 info: name: Ivanti Avalanche 6.3.2 - Local File Inclusion author: gy741 severity: high description: Ivanti Avalanch...

cgit < 1.2.1 - Directory Traversal

cGit 1.2.1 via cgitcloneobjects has a directory traversal vulnerability when enable-http-clone=1 is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. id: CVE-2018-14912 info: name: cgit 1.2.1 - Directory Traversal author: 0xAkoko severity: high description: cGit...

nostromo 1.9.6 - Remote Code Execution

nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via directory traversal in the function httpverify. id: CVE-2019-16278 info: name: nostromo 1.9.6 - Remote Code Execution author: pikpikcu severity: critical description: nostromo nhttpd through 1.9.6 allows an...

WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

Cisco Adaptive Security Appliance Software/Cisco Firepower Threat Defense - Directory Traversal

Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software are susceptible to directory traversal vulnerabilities that could allow an unauthenticated, remote attacker to obtain read and delete access to sensitive files on a targeted system. id: CVE-2020-3187...

CVE-2021-21234

CVE-2021-21234 Vulnerabilità di directory traversal nella libreria spring-boot-actuator-logview https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234...

LFI-aiohttp-CVE-2024-23334-PoC

LFI-aiohttp-CVE-2024-23334-PoC Ein Bash-Skript zur Automatisierung von Local File Inclusion LFI-Angriffen auf anfällige aiohttp-Server, speziell abzielend auf CVE-2024-23334. Dieser Exploit ermöglicht unbefugten Zugriff auf beliebige Dateien auf Systemen, die betroffene Versionen von aiohttp mit...

CVE-2025-43919-POC

🚨 CVE-2025-43919: Traversal de Diretório no GNU Mailman 2.1.39 cPanel/WHM Uma nova vulnerabilidade foi descoberta no GNU Mailman 2.1.39, que acompanha o cPanel/WHM, permitindo que atacantes remotos não autenticados leiam arquivos arbitrários no servidor por meio de uma falha de traversal de...

cve-2021-45043

cve-2021-45043 HD-Network Real-time Monitoring System 2.0 consente il directory traversal tramite ../ per leggere /etc/shadow attraverso il parametro sLanguage di /language/lang. post originale https://cyberguy0xd1.medium.com/my-cve-2021-45043-lfi-write-up-441dad30dd7f sfruttamento tramite Burp G...

CVE-2025-54769

CVE-2025-54769 – LPAR2RRD RCE Beschreibung : Dieses Repository enthält einen Proof-of-Concept PoC-Exploit für CVE-2025-54769, eine Schwachstelle in lpar2rrd. Die Schwachstelle ermöglicht Remote-Code-Ausführung RCE und Directory Traversal durch Missbrauch des Endpunkts /lpar2rrd-cgi/upgrade.sh. De...

CVE-2025-70559

cambia la directory di upload nello script python python3 exploit.py LHOST LPORT...

macos_app_structure

Introduzione a macOS - Struttura delle app macOS Passare a macOS da Linux o Windows può sembrare come camminare in una terra nuova e sconosciuta. Dato che Linux è open-source e Windows è ben documentato e molto popolare e macOS non è né l'uno né l'altro, per l'esattezza, macOS può essere...

ffufw

ffufw ffuf com aquele molho especial Instalação root@kitploit: go install github.com/puzzlepeaches/ffufw@latest Por quê? O ffufw é um wrapper em torno do ffuf para tornar o bruteforce de diretórios mais fácil e inteligente. A ferramenta possui os seguintes recursos: Execução multithread de comand...