GHSA-F794-5JV7-7672 vulnerabilities

Vulnerabilities for packages: open-webui, nemo...

ShadowSteal

ShadowSteal | CVE-2021-36934 تنفيذ نقي بلغة Nim لاستغلال CVE-2021-36934، وهو تصعيد الصلاحيات المحلية SeriousSAM LPE. ليس آمنًا من حيث OPSEC... بعد ;. لا أدّعي الفضل في اكتشاف هذا الاستغلال. بدء سريع البناء باستخدام Docker بدأ استخدام ShadowSteal أصبح أسهل من أي وقت مضى بفضل Docker! لا تريد العبث...

-CVE-2014-6271-Shellshock-Remote-Command-Injection-

CVE-2014-6271 Shellshock-Remote-Command-Injection CVE-2014-6271 Outil Apache Shellshock Remote Command Injection pour un reverse shell rapide et la navigation dans les fichiers root@kitploit: Shellshock Apache remote exploit Usage: ./Shellshock.py payload=reverse rhost=1.2.3.4 page=3 lhost=5.6.7....

cve-2024-38819

CVE-2024-38819 01. Обзор File-Traversal и Webflux 1 Обзор File-Traversal и WebFlux Уязвимость File-Traversal обход пути, Path Traversal позволяет злоумышленнику обходить разрешения файловой системы веб-приложения и получать доступ к произвольным файлам; она классифицируется как CWE-22 и является...

cve-reproduction-lab

Laboratoire de reproduction CVE Présentation Ce projet est un laboratoire de recherche en cybersécurité conçu pour démontrer l'impact réel des vulnérabilités logicielles grâce à une exploitation contrôlée et à la simulation de correctifs défensifs. Le laboratoire se concentre sur la CVE-2021-4177...

CVE-2026-85688

TEN Framework 0.11.71 is vulnerable to unauthenticated arbitrary file read and write via the TMAN Designer file-content API endpoints (/api/designer/v1/file-content). Attackers can send POST and PUT requests to read arbitrary files or write malicious content to system paths, enabling code executi...

CVE-2026-85661

excel-mcp-server 0.1.8 (by haris-musa) contains a path confinement bypass in stdio mode : when the EXCEL_FILES_PATH environment variable is unset, unchecked file paths supplied to the read and write tools allow an attacker to read and write arbitrary files accessible to the process. The vulnerabi...

CVE-2021-43008-AdminerRead

CVE-2021-43008 - AdminerRead Outil d'exploitation pour la vulnérabilité de lecture arbitraire de fichiers d'Adminer 1.0 à 4.6.2 Installation root@kitploit: git clone https://github.com/p0dalirius/AdminerRead cd AdminerRead sudo python3 setup.py install Utilisation...

CVE-2024-40445_CVE-2024-40446

Référence des vulnérabilités MimeTeX CVE-2024-40445 et CVE-2024-40446 Ce dépôt sert de référence publique pour les problèmes de sécurité CVE-2024-40445 et CVE-2024-40446 affectant MimeTeX, un rendu LaTeX open-source léger écrit en C. ⚠️ MimeTeX semble ne plus être activement maintenu. Les...

whatfiles

whatfiles Whatfiles is a Linux utility that logs what files another program reads/writes/creates/deletes on your system. It traces any new processes and threads that are created by the targeted process as well. Rationale: I've long been frustrated at the lack of a simple utility to see which file...

EUVD-2026-71003

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

path-auditor

PathAuditor PathAuditor هي أداة مصممة للعثور على ثغرات متعلقة بالوصول إلى الملفات عن طريق تدقيق وظائف libc. الفكرة تقريبًا كالتالي: تدقيق كل استدعاء لوظائف libc المتعلقة بنظام الملفات التي ينفذها البرنامج الثنائي. التحقق مما إذا كان المسار المستخدم في استدعاء النظام قابلاً للكتابة من قبل المستخدم...

PT-2026-85574

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...

PT-2026-85554

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL FILES PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-85176

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

WebKitGTK-DND-Fix

WebKitGTK-DND-Fix Carnet de recherche et d'intégration continue pour restaurer le glisser-déposer fiable de fichiers sur WebKitGTK et WPE après CVE-2025-13947. Le problème CVE-2025-13947 WSA-2025-0009, GHSA-j77f-3hf7-7rvg permettait au contenu web de lire le contenu de fichiers locaux via le...

EUVD-2026-70480

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

CVE-2026-85176

DbGate through 7.2.6 is vulnerable to arbitrary file read and write via the file:// scheme. The root cause lies in the jsldata controller , which fails to properly validate jslid parameters. An attacker can exploit the getJslFileName() function to bypass directory containment, allowing authentica...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

mTheme Unus < 2.3 - Directory Traversal

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...