PT-2026-113646

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130076)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130076 advisory. rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130127)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130127 advisory. rsync before 3.5.0contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and...

Linux Distros Unpatched Vulnerability : CVE-2026-78355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130131)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130131 advisory. rsyncbefore 3.5.0contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130077 advisory. When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130072)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130072 advisory. rsync before 3.5.0contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended...

Linux Distros Unpatched Vulnerability : CVE-2026-107377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply...

Copeland XWEB and XWEB Pro Improper Limitation of a Pathname to a Restricted Directory (CVE-2026-22877)

An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack. This plugin only works with Tenable.ot. Please visit...

PT-2026-113963

Name of the Vulnerable Software and Affected Versions Appium versions prior to 7.2.6 Description ZIP extraction in @appium/support allows an archive entry to create a symbolic link to a location outside the extraction directory. A subsequent regular-file entry can then resolve through this link...

CVE-2025-57231

CVE-2025-57231 - Docmost 0.22.0 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2025-57231. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permission to tes...

CVE-2023-45878

CVE-2023-45878 GibbonEdu Gibbon Exploit version 25.0.1 GibbonEdu Gibbon version 25.0.1 and before GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write Read More https://nvd.nist.gov/vuln/detail/CVE-2023-45878 https://herolab.usd.de/security-advisories/usd-2023-0025/ Disclaimer...

CVE-2026-53564

Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...

CVE-2022-44268-

CVE-2022-44268- For HTB practice How to use this python3 poc.py generate -o test.png -r /etc/passwd Upload that test.png file and download python3 poc.py parse -i out.png...

CVE-2025-63830

📂 CKFinder 1.4.3 – Stored Cross-Site Scripting XSS via Malicious SVG Upload CVE ID: CVE-2025-63830 🧭 Overview A stored Cross-Site Scripting XSS vulnerability was identified in CKFinder v1.4.3. The issue resides in the file upload functionality, which fails to properly sanitize SVG files containin...

CVE-2024-27954

CVE-2024-27954 - WordPress wp-automatic Plugin LFI Scanner This project provides a Python-based Local File Inclusion LFI vulnerability scanner targeting CVE-2024-27954 , a critical flaw found in the WordPress plugin wp-automatic. The vulnerability allows unauthenticated attackers to read arbitrar...

CVE-2025-505050

CVE-2025- Des: unauthinticated access to uploaded files POC: navigate to any uploaded file it will be accesed without login Discovered by Aljohara Abdulmohsen Alsubaie...

xzutils_backdoor_obfuscation

xzutilsbackdoorobfuscation This script recreates the obfuscation technique used for the XZ utils attack CVE-2024-3094. It has been tested for xzutils v5.6.0 only. ⚠️ This code is provided for educational purposes only and should not be used for malicious activities. Use at your own risks. ⚠️...

RCE-Simplephpblog-biggiedroid

CVE-2025-15495 - Arbitrary File Upload Leading to Remote Code Execution RCE Product BiggiDroid – Simple PHP Blog CMS Product page: https://biggidroid.com/product/simple-php-blog/ Vulnerability Type Arbitrary File Upload Unrestricted File Upload Remote Code Execution RCE Severity Critical CVSS...

DEBIAN-CVE-2026-110143

Use of uninitialized variable in ThirdParty lmzasdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. Chromium security severity: High...