WPSniper

WPSniper CVE-2026-87902 detector for WordPress Core. getpagetemplate can be steered so page-template resolution includes a readable local .php file outside the active theme. WPSniper fingerprints the site, picks a published pageid, probes the include class, and only prints VULN when a strong PEAR...

CVE-2026-118655

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...

Linux Distros Unpatched Vulnerability : CVE-2026-118655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators...

EUVD-2026-112461

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...

CVE-2026-108357 PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

CVE-2026-108357 PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

CVE-2026-108357

The PhpSpreadsheet library (versions 3.3.0 through 3.10.8 and 5.10.0) is vulnerable to an XmlScanner Bypass due to a Time-of-Check to Time-of-Use (TOCTOU) flaw in the Xml::unentity function. The root cause is that numeric entities are decoded after each DOCTYPE pattern check; a double-encoded les...

CVE-2026-79650: URL Redirection to Untrusted Site

Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...

Exploit for CVE-2020-14882

Oracle WebLogic Console Pre-Auth RCE CVE-2020-14882, CVE-2020...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: path traversal non autenticato nella risoluzione dei template di pagina Inclusione locale non autenticata di file PHP in WordPress Core tramite un valore pagename con doppia codifica — e, in specifiche condizioni di deployment, esecuzione di codice PHP con i...

CVE_2026_87902

CVE-2026-87902 — WordPress Scanner & PoC A Python scanner for...

Exploit for CVE-2026-87902

CVE-2026-87902 — WordPress Core Path Traversal / LFI Unauthen...

Exploit for CVE-2026-87902

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-34151

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

EUVD-2026-77676

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

CVE-2026-34151

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

CVE-2026-34151: Path Traversal: '../filedir'

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

PT-2026-86520

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...

Authorization Bypass Through User-Controlled Key

Overview github.com/valyala/fasthttp is a fast HTTP server and client API. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ServeFile and ServeFS functions. An attacker can bypass access controls by submitting double-encoded path variant...