Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write

File read and write vulnerability in Apache DolphinScheduler, authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler from 3.1.0 before 3.2.2. id: CVE-2024-30188 info: name: Apache DolphinScheduler = 3.1.0, 3.2.2 Resource File Read And Write...

CVE-2025-53964

CVE-2025-53964 Evaluación de riesgo CVSS v3: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - 9.6/10 Descripción GoldenDict 1.5.0 y 1.5.1 tiene un método peligroso expuesto que permite leer y modificar archivos cuando un usuario agrega un diccionario manipulado y luego busca cualquier término incluido en es...

CVE-2020-11651

CVE-2020-11651 CVE-2020-11651 的 PoC 需要 Python3，已在 3.8 上测试 python3.8 -m pip install pyzmq msgpack root@kitploit: ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target Server IP or Host...

CVE-2026-88937 knowns through 0.33.0 Path Traversal via Template Engine

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...

CVE-2026-85788

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

EUVD-2026-75104

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

westone-CVE-2020-17519-scanner

westone-CVE-2020-17519-scanner Apache Flink 1.11.0、1.11.1、1.11.2 Hackers can read/write remote files via REST API Installation & Usage git clone https://github.com/Osyanina/westone-CVE-2020-17519-scanner.git cd westone-CVE-2020-17519-scanner cmd CVE-2020-17519.exe...

ZDI-CAN-16318

CVE-2023-32162（ZDI-CAN-16318）0-day 漏洞利用程序 此处可查看我的本地权限提升漏洞 报告。 此处可查看我的任意文件读取漏洞 报告。 此处可查看我的任意文件读取/写入漏洞 报告。 此处可以请我喝杯独角兽 🦄 分享知识！...

CVE-2026-28624

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-25257

CVE-2025-25257 FortiWeb CVE-2025-25257 漏洞利用 https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce exp.py: 完整/可用的漏洞利用程序。 signed.py: 仅文件读/写的概念验证。漏洞利用的初始版本。...

CVE-2026-27971_POC

CVE-2026-27971 — Qwik server$ 未认证 RCE PoC !WARNING 本仓库包含一个活跃的远程代码执行概念验证。请仅对您拥有或明确获授权测试的系统使用。作者对未经授权的使用或造成的损害不承担任何责任。 CVE-2026-27971 / GHSA-p9x5-jp3h-96mm 的独立 Python 概念验证，该漏洞是 Qwik server$ RPC 反序列化机制中的一个未认证远程代码执行漏洞。 该 PoC 可执行主动标记探测、执行命令、读取或写入文本文件，并在 Linux 或 Windows 目标上请求反向 Shell。它仅使用 Python 标准库。 漏...

EUVD-2026-71137

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...

CVE-2026-9548

Synology Chat Server versions prior to 2.4.5-22148 are affected by a Cross-Site Scripting (XSS) vulnerability in the extract domain function, caused by improper neutralization of input during web page generation. A remote authenticated user with low privileges can exploit this via a UI interactio...

EUVD-2026-67461

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-40541

Synology Chat Server before 2.4.5-22148 contains an improper input neutralization vulnerability in the extract domain component, classified as a cross-site scripting (XSS) flaw. Remote authenticated users can, through a UI interaction, read or write arbitrary files and trigger denial-of-service a...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

UBUNTU-CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

PT-2026-82623

Name of the Vulnerable Software and Affected Versions UI-TARS-desktop mcp-http-server version 1.2.4 prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 Description The startServer.ts file in the mcp-http-server package defaults the listen address to :: when no host is provided. This causes t...

PT-2026-82684

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db...

GHSA-WF6J-GR27-G7CH GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...