CVE-2026-3576

CVE-2026-3576 - WordPressプラグイン Planyo Online Reservation System -f --disable-check python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd 実行例 └─$ python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd Checking if target is vulnerable... + Version found: 2.9 + Target is vulnerable...

CVE-2023-36025

CVE-2023-36025 CVE-2023-36025에 대한 간단한 테스트로, https://twitter.com/wdormann/status/1725148437115473947 에서 시연된 PoC를 기반으로 합니다. 이 코드는 기본 설정 그대로 실행되도록 만들어진 것이 아닙니다. ZIP 파일은 사용자가 소유한 서버에 호스팅되어야 하며, file:// URL을 통해 피해자 머신에서 접근할 수 있어야 합니다...

CVE-2025-20384

SPLUNK CVE-2025-20384 모르겠어, 그냥 친구가 보내준 거 보고 대충 막 자바스크립트 코드를 적기 시작했어. 로그 인젝션/위조/중독/난독화 유형 PoC 이 글을 읽어주세요: OWASP Log Injection TL;DR 정적 파일을 찾아 전달하고 임의의 파라미터를 추가하세요. 그래서, 다음과 같이 전달합니다: curl -k...

PYSEC-2026-4196

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptionsrenderpage=True permits file URLs because HTMLDocumentBackend.getbrowserrequestblockreason does not enforce the...

CVE-2026-105750

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptionsrenderpage=True permits file URLs because HTMLDocumentBackend.getbrowserrequestblockreason does not enforce the...

EUVD-2026-92416

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in...

CVE-2021-36750

CVE-2021-36749 정보 - Druid 수집 시스템에서 InputSource는 특정 데이터 소스로부터 데이터를 읽는 데 사용됩니다. 그러나 HTTP InputSource는 인증된 사용자가 Druid 서버 프로세스의 권한으로 로컬 파일 시스템과 같이 의도하지 않은 다른 소스의 데이터를 읽을 수 있도록 허용합니다. 사용자가 Druid에 직접 액세스하는 경우 Druid에서 동일한 수준의 액세스를 허용하는 Local InputSource도 제공하므로 이는 권한 상승이 아닙니다. 그러나 사용자가 HTTP InputSource는...

Incorrect Behavior Order: Validate Before Canonicalize

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via incorrect classification of alternate file: URL spellings in the Agent Client Protocol ACP handler. Alternate but valid file: UR...

CVE-2026-100547

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100547

OpenClaw is a coding agent distributed as the npm package "openclaw". In affected versions 2026.7.1 through 2026.7.2, alternate but valid "file:" URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100547 OpenClaw before 2026.8.1 Authentication Bypass via File URL

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

EUVD-2026-87503

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100547 OpenClaw before 2026.8.1 Authentication Bypass via File URL

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100547 OpenClaw before 2026.8.1 Authentication Bypass via File URL

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-100547

The OpenClaw coding agent (npm package openclaw) versions 2026.7.1 through 2026.7.2 are vulnerable to a local file disclosure flaw. The root cause is that alternate but valid file: URL spellings supplied over the Agent Client Protocol (ACP) are incorrectly treated as relative paths and classified...

PT-2026-99184

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.1 through 2026.7.2 Description OpenClaw, distributed as the npm package openclaw, contains an issue where alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP are treated as relative path...

CVE-2026-100547: Incorrect Behavior Order: Validate Before Canonicalize

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

PT-2026-97849

Name of the Vulnerable Software and Affected Versions pulpcore affected versions not specified Description A path traversal issue exists in the content upload API via the file url parameter. The system employs a validation check that rejects URLs starting with 'file://', but because Python's URL...

CVE-2026-85613: Improper Neutralization of Input During Web Page Generation

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-55421

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...