CVE-2026-109277

ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies...

DEBIAN-CVE-2026-109273

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory conten...

CVE-2026-109273

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory conten...

DEBIAN-CVE-2026-109247

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2024-24919

Intro Simple POC Python script that check & leverage Check Point CVE-2024-24919 vulnerability Wrong Check Point; vulnerable to arbitrary file reading. Requirements Python 3 Pip Required Library/Module Install via PIP requests urllib3 tqdm How To Run PS C:\ python CVE-2024-24919.py list.txt...

CVE-2023-40028

CVE-2023-40028 Proof of Concept This repository contains a proof of concept POC for CVE-2023-40028, demonstrating a vulnerability in the Ghost content management system where authenticated users can upload symlinks, leading to arbitrary file read vulnerabilities. Disclaimer This POC is provided f...

CVE-2025-8110-gogs-poc

CVE-2025-8110 — Gogs Arbitrary File Write PoC Proof-of-concept for an authenticated arbitrary file write in Gogs. By pushing a repository that contains a symbolic link pointing outside the repo and then updating that link's contents through the API, an authenticated user can overwrite files on th...

cve-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read CVSS 10.0 · Unauthenticated · Actively exploited CISA KEV A parser differential between GitLab Workhorse Go reverse proxy and Puma/Grape Ruby lets an unauthenticated attacker bypass Workhorse's accelerated-upload handoff and reach three...

CVE-2023-36664

CVE-2023-36664 : Ghostscript remote code execution Proof of concept for the CVE-2023-36664. Usage To insert a payload into a .eps file : python3 poc.py -f "filename" --payload "command" python3 poc.py -f file.eps --payload firefox To insert a reverse shell payload into a .eps file : python3 poc.p...

CVE-2022-38604

Exploits for CVE-2022-38604 FilesystemEoPs is a copy of this repository with the addition of the x64 compiled projects. Here you can find my Arbitrary File Deletion Vulnerability report. Here you can understand how to use an Arbitrary File Deletion primitive to achieve a Local Privilege Escalatio...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

CVE-2026-85976

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to HTTP response splitting . The root cause is insufficient input sanitization within the Query Console file-exploration endpoint , which can lead to unintended client-side response handling . No specific ...

gitlab-cve-2020-10977

GitLab CVE2020-10977 Introduction This script provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. The CVE is an arbitrary file read which allows you to extract the Rails secretkeybase by downloading the GitLab secrets.yaml file. Which in turn, enables you...

CVE-2021-41773

CVE-2021-41773 Playground This is a small Docker recipe for setting up a Debian bookworm based container with an instance of the Apache HTTPd 2.4.49 that is vulnerable to CVE-2021-41773. CGI has been explicitly enabled so it can be used to test/verify Local file Disclosure behavior as well as...

CVE-2024-21413-Vulnerabilidad-Outlook-LAB

CVE-2024-21413 – Outlook LAB Vulnerability Vulnerability Description CVE-2024-21413 is a critical vulnerability discovered in Microsoft Outlook that allows a remote attacker to execute malicious links via a carefully crafted email. This exploit uses the file:// protocol to redirect victims to...

CVE-2026-7275-moodle

CVE-2026-7275-moodle PoC & documentation for CVE-2026-7275 : Moodle Google Drive Repository repositorygoogledocs — Path Traversal / Arbitrary File Write that can lead to RCE on unpatched Moodle versions. Disclaimer: For authorized security research, auditing, and defensive education only. Do not...

CVE-2024-23346-exploit

CVE-2024-23346-exploit This is a exploit for the known Remote Code Execution RCE vulnerability in the pymatgen CVE-2024-23346 Python library by uploading a malicious CIF file to the hosted CIF Analyzer website on the Chemistry machine from Hack the Box. NVD CVE LINK :...

http-pulse_ssl_vpn.nse

SUMMARY Simple NSE script to detect Pulse Secure SSL VPN file disclosure via specially crafted HTTP resource requests. This exploit reads /etc/passwd as a proof of concept This vulnerability affect 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. INSTALLATION $ git clone...

CVE-2024-45436

Ollama CVE-2024-45436 Exploit A clean and efficient exploit implementation for the Ollama ZIP traversal vulnerability CVE-2024-45436. 中文文档：READMECN.md Vulnerability Description CVE-2024-45436 is a path traversal vulnerability also known as "Zip Slip" in Ollama versions prior to 0.1.47. The...