CVE-2025-30208

CVE-2025-30208 A PoC of the exploit script for the Arbitrary File Read vulnerability of Vite /@fs/ Path Traversal in transformMiddleware CVE-2025-30208. Detailed analysis can be refer to this post. Vulnerable in versions prior to : 6.2.3 6.1.2 6.0.12 5.4.15 4.5.10 Overview Vite is a popular...

CVE-2026-53508

oasdiff (a Go command-line tool and package for comparing OpenAPI specs, hosted at github.com/oasdiff/oasdiff ) failed to enforce the --allow-external-refs=false flag on the git-revision load path (rev:path form, e.g. main:openapi.yaml). From version 1.13.2 through 1.18.0 , external $refs were re...

CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-53553 Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff File Compare, when handling file paths provided by the client. This issue has been patched in version 1.18.0...

CVE-2026-53553

Goploy is an open-source automation deployment system affected by a path traversal vulnerability in the /deploy/fileDiff (File Compare) backend API endpoint. The flaw occurs when handling client-supplied file paths, enabling arbitrary file read with potential for remote server compromise , as ind...

Grafana-CVE-2021-43798

Grafana-CVE-2021-43798 Grafana File-Read Versión afectada: 8.0.0-lastest Poc-http-get /public/plugins/plugins-lst/../../../../../../../../filename plugins-lst por defecto root@kitploit: alertlist annolist grafana-azure-monitor-datasource barchart bargauge cloudwatch dashlist elasticsearch gauge...

Cisco-ASA-FTD-Web-Services-Traversal

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability CVE-2020-3452 Usage: CVE-2020-3452.py https://target Vulnerability description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Softwar...

CVE-2026-79750

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs. Prior to version 1.0.30 , while list views and config edits correctly enforce per-user ownership, the tool-execution API does not. Any authenticated non-admin user can invoke tools on MCP serve...

CVE-2022-44268-PoC

CVE-2022-44268-PoC This repository includes a test file for CVE-2022-44268 ImageMagick Arbitrary File Read. Testing 1. Upload the pngout.png into a Webapplication 2. Check if the image can be cropped, cut or edited in any way 3. Download the edited image 4. Use identify -verbose editimage.png to...

CVE-2024-23897

CVE-2024-23897: Vulnerabilidad de Lectura Arbitraria de Archivos en Jenkins que lleva a RCE Introducción Este repositorio contiene un script de Python que explota una vulnerabilidad crítica CVE-2024-23897 en Jenkins, que permite la lectura arbitraria de archivos y la ejecución remota de código RC...

CVE-2025-25599

CVE-2025-25599 Details Bolt is an open-source content management system built using the Symfony PHP framework. During a short security assessment, Certitude identified several vulnerabilities including an arbitrary file read. Users with the role EDITOR , CHIEFEDITOR , ADMIN , or DEVELOPER may abu...

CVE-2024-24919-Exploit

CVE-2024-24919-Exploit Resumen Este repositorio contiene un exploit en Python para el CVE-2024-24919, una vulnerabilidad que permite leer archivos sensibles de la página vulnerable. Este exploit primero verifica si el objetivo es vulnerable, y luego obtiene la ruta que especifiques. Severidad :...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Inclusión de Archivos Local no Autenticada 📝 Descripción El plugin Kubio AI Page Builder para WordPress es vulnerable a la Inclusión de Archivos Local LFI en todas las versiones hasta la 2.5.1 incluida, a través de la función kubiohybridthemeloadtemplate. Esto...

CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2024-23897

Usage root@kitploit: python poc.py usage: python poc.py http://127.0.0.1:8888/ /etc/passwd...

CVE-2024-28995

CVE-2024-28995 SolarWinds Serv-U era susceptible a una vulnerabilidad de directory traversal que permitiría el acceso para leer archivos sensibles en la máquina host. INSTALACIÓN git clone https://github.com/gotr00t0day/CVE-2024-28995.git cd CVE-2024-28995 pip3 install -r requirements.txt USO...

CVE-2023-40028

CVE-2023-40028 Proof of Concept This repository contains a proof of concept POC for CVE-2023-40028, demonstrating a vulnerability in the Ghost content management system where authenticated users can upload symlinks, leading to arbitrary file read vulnerabilities. Disclaimer This POC is provided f...

CVE-2025-30208

🔥 CVE-2025-30208 Vite Arbitrary File Read Vulnerability Scanner Advanced vulnerability scanner for CVE-2025-30208 with enterprise-grade features Professional penetration testing tool for Vite Arbitrary File Read vulnerability detection 🚀 Quick Start • 📋 Features • 🔧 Usage • 📊 Examples • 🛡️ Securit...

CVE-2024-40422

CVE-2024-40422 Encontré esto en exploit-db, decidí hacer el mío propio para practicar. Este exploit buscará el archivo passwd e imprimirá su contenido en un sistema vulnerable. Este script explota una vulnerabilidad de path traversal en Devika v1. Créditos a Alperen Ergel por encontrar la...

CVE-2010-4231-EXPLOIT

CVE-2010-4231 - Vulnerabilidad de Directory Traversal en Cámaras IP Camtron y TecVoz CVE-2010-4231 es una vulnerabilidad de directory traversal que existe en la interfaz de administración basada en web de la Cámara IP Camtron CMNC-200 Full HD y la Cámara IP TecVoz CMNC-200 Megapíxel. La...