GL.iNet <= 4.3.7 - Arbitrary File Write

GL.iNet = 4.3.7 is vulnerable to an arbitrary file write exploit, allowing an attacker to overwrite arbitrary system files. id: CVE-2023-46455 info: name: GL.iNet = 4.3.7 - Arbitrary File Write author: Zierax severity: high description: | GL.iNet = 4.3.7 is vulnerable to an arbitrary file write...

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

CVE-2026-106103

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2024-34313

CVE-2024-34313 Описание VPL Jail System до версии v4.0.2 содержит уязвимость Path Traversal , позволяющую произвольно перезаписывать файлы и тем самым повышать привилегии до root. Эта уязвимость может быть объединена с CVE-2024-34312 для удалённого захвата экземпляра Moodle без какой-либо...

CVE-2026-105840

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-105789

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the executecommand tool in ufo/client/mcp/httpservers/linuxmcpserver.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: CSRF to Arbitrary File Overwrite in Optimole WordPress Plugin Summary A Cross-Site Request Forgery CSRF vulnerability in the Optimole plugin for WordPress versions = 4.2.5 allows unauthenticated attackers to silently overwrite existing media library assets via the...

EUVD-2026-93406

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the executecommand tool in ufo/client/mcp/httpservers/linuxmcpserver.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output...

CVE-2026-54337-PoC

CVE-2026-54337 PoC CVE-2026-54337 - Unauthenticated File Write/Overwrite in fireshare test.mp4 Step 2 : Run the following curl command make sure to change the placeholder $ curl -s -w "HTTP %httpcode\n" \ -F "file=@;filename= -selectstreams v.mp4" \ -F "folder=testfolder -o " ...

CVE-2020-11108-PoC

CVE-2020-11108-PoC В этом репозитории находятся два PoC. cve-2020-11108-rce.py даст вам шелл от имени пользователя www-data. root-cve-2020-11108-rce.py даст вам шелл и повысит привилегии до root. Примечание: это деструктивно, так как мы должны перезаписать teleporter.php. Полное объяснение/отчёт...

CVE-2026-105744

A flaw was found in docling. When configured to process LaTeX documents using the Tectonic engine, the application does not restrict TeX file operations during compilation. An attacker could exploit this vulnerability by submitting crafted document input to read sensitive files or overwrite...

PT-2026-106739

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute command tool in ufo/client/mcp/http servers/linux mcp server.py treats sort and uniq as read-only commands while the free-form command parameter can select their...

UBUNTU-CVE-2026-105712

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory aka -C into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected...

Linux Distros Unpatched Vulnerability : CVE-2026-105712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory aka -C into an...

MikroTik RouterOS Improper Enforcement of Behavioral Workflow (CVE-2026-67279)

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

CVE-2026-105712

A flaw was found in the gpgtar utility in GnuPG. When extracting an archive into a directory containing pre-existing symbolic links symlinks, the tool can follow those links instead of staying within the target directory. An attacker can provide a crafted archive that, when extracted by an...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – Побег из контейнера через симлинк /proc/self/fd Обзор Общий том, смонтированный с распространением rshared, позволяет вредоносному контейнеру создать символическую ссылку, указывающую на файл хоста, через /proc/self/fd. Процесс хоста, записывающий данные в том, следует по симлинку...

DEBIAN-CVE-2026-105712

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory aka -C into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected...

AZL-105962 CVE-2026-105712 affecting package gnupg2 2.4.9-3

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory aka -C into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected...

CVE-2026-105712

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory aka -C into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected...