CVE-2023-23169

CVE-2023-23169 POC for CVE-2023-23169 Local File inclusion & Server side request Forgery Steps to reproduce : Local File Incusion : 1. echo "" poc.docx 2. Upload the file in PDFocus services 3. View/Download file after to triggered POC SSRF : 1. echo "" poc.docx 2. Upload the file in PDFocus...

CVE-2022-29597

CVE-2022-29597: Local File Inclusion in RSS v500 The RRS v500 application by Solutions Atlantic is vulnerable to a Local File Inclusion LFI vulnerability. Any authenticated user has the ability to reference internal system files within requests made to the...

svg-cheatsheet

SVG SSRF Cheatsheet Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols...

Vulnerable-Web-Application

Vulnerable Web Application What is Vulnerable-Web-Application Vulnerable-Web-Application is a website that is prepared for people who are interested in web penetration and who want to have information about this subject or to be working. In fact, the website is quite simple to install and use...

CVE-2020-10977.py

CVE-2020-10977.py authenticated arbitrary file read for Gitlab CVE-2020-10977 usage: CVE-2020-10977.py -h --verifySSL -f FILELIST host token Exploit for the gitlab local file inclusion arbitrary authenticated file read - CVE-2020-10977. modify the variable pullfiles to include all the files you...

CVE-2023-34598

CVE-2023-34598 - Gibbon v25.0.0 LFI Exploit This repository contains a Python script that helps identify and exploit a local file inclusion LFI vulnerability CVE-2023-34598 in Gibbon v25.0.0. The script can scan a target website for potential vulnerability and, if successful, download the SQL dum...

learnjavabug

This project is for security research only. It is forbidden to use this project to launch illegal attacks. The user is responsible for any consequences. This is a personal project for reproducing and publishing vulnerabilities that I find interesting or that have a significant impact. There isn't...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...

CVE-2024-34470

CVE-2024-34470 HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion...

CVE-2024-10571

CVE-2024-10571 Chartify – WordPress Chart Plugin = 2.9.5 - Unauthenticated Local File Inclusion via source Description The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This make...

CVE-2025-54236

Adobe Magento SessionReaper LFI PoC A simple Python proof-of-concept demonstrating the CVE-2025-54236 SessionReaper vulnerability affecting vulnerable Adobe Magento versions. Educational and authorized security testing only. Features Automatic target URL normalization Random formkey generation Fi...

POC-CVE-2025-54988

CVE-2025-54988 - POC Disclaimer: I am not the original discoverer of this vulnerability. This post documents my process of reproducing the issue in a controlled environment for educational purposes and to help others validate their own systems. The tests were conducted in an isolated lab with no...

CVE-2017-16651

CVE-2017-16651 Python implementation of Roundcube LFI CVE-2017-16651...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

cve-2025-63888-exploit

CVE-2025-63888 ThinkPHP 5.0.24 File Inclusion RCE Exploit A security research tool for detecting and testing the CVE-2025-63888 vulnerability in ThinkPHP 5.0.24, which allows Remote Code Execution through file inclusion attacks. ⚠️ Disclaimer This tool is for authorized security testing and...

CVE-2023-22047---Oracle-PeopleSoft-LFI

CVE-2023-22047---Oracle-PeopleSoft-LFI CVE-2023-22047 is a critical unauthenticated Local File Inclusion LFI vulnerability in Oracle PeopleSoft Enterprise PeopleTools. This exploit allows an attacker to read arbitrary files from the target server without any authentication...

CVE-2019-5418

CVE-2019-5418: Ruby on Rails Path Traversal & Arbitrary File Read This project is an environment for practicing and reproducing the local file inclusion vulnerability CVE-2019-5418 in Ruby on Rails. This vulnerability allows reading arbitrary files on the server through path traversal via the...

CVE-2024-33113

CVE-2024-33113 The D-LINK DIR-845L router is vulnerable to information disclosure via the bscsmsinbox.php file. CVE-2024-33113 is a vulnerability in the D-LINK DIR-845L router that allows information disclosure through the bscsmsinbox.php file. The vulnerability stems from inadequate handling of...

CVE-2023-6553-PoC

CVE-2023-6553 PoC LFI to RCE Unauthenticated Remote Code Execution in Backup Migration WordPress Plugin. Run $ python exploit.py The following PHP script is executed. out.txt; ? References Critical Unauthenticated Remote Code Execution Found in Backup Migration Plugin...

CVE-2025-2294

Kubio Page Builder LFI Exploit CVE-2025-2294 Local File Inclusion LFI exploit for Kubio Page Builder WordPress plugin versions ≤ 2.5.1. 📌 Description This tool exploits an unauthenticated LFI vulnerability in Kubio Page Builder plugin CVE-2025-2294, allowing attackers to read sensitive files on...