POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — Arbitrary File Write + XML Injection → Remote Code Execution Table of Contents Overview Vulnerability Details Attack Chain Requirements Installation Configuration Usage How It Works Vulnerable Code Pre-Exploitation Checklist Tested On Disclaimer...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — SSRF / local file read via response URL CVE-2026-13233 Untrusted upstream: the provider that fetched the URL its response told it to. Drupal OpenAI Provider aiprovideropenai · SSRF CWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053 Status: Coordinated disclosure complete...

CVE-2025-30208

CVE-2025-30208 A PoC of the exploit script for the Arbitrary File Read vulnerability of Vite /@fs/ Path Traversal in transformMiddleware CVE-2025-30208. Detailed analysis can be refer to this post. Vulnerable in versions prior to : 6.2.3 6.1.2 6.0.12 5.4.15 4.5.10 Overview Vite is a popular...

CVE-2026-36851

CVE-2026-36851 Path traversal / arbitrary file read in UnPoller v2.33.0 via the file:// password prefix. File contents are read from disk and transmitted to the configured UniFi controller URL during authentication. | ---|--- CVE| CVE-2026-36851 Product| UnPoller v2.33.0 earlier versions likely...

CVE-2019-14530

CVE-2019-14530 Path traversal and DoS vulnerability in OpenEMR project Vulnerable function in file: /openemr/custom/ajaxdownload.php Conditions: 1. any authorized user 2. for DoS case: directory "/sites/default/documents/cqmqrda/" must exists on server Due to logic of "unlink" function, path to...

CVE-2023-49981

CVE-2023-49981 School Fees Management System v1.0 - Incorrect Access Control - Directory Listing Description : A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring...

CVE-2026-75855

Title Path Traversal in "create database" / "drop database" server commands allows arbitrary file write and delete outside the configured database directory Summary The POST /api/v1/server endpoint's create database and drop database commands use the caller-supplied database name to build a...

CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - Local File Inclusion Description : Customer Support System 1.0 is vulnerable to Local File Inclusion. An authenticated user has the capability to access and read PHP files from the operating system by exploiting a Local File Inclusion LFI vulnerability...

CVE-2021-29447

CVE-2021-29447 POC to exploit WordPress 5.6-5.7 PHP 8+ Authenticated XXE Injection. More about this CVE here Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress website with Media Library vulnerable to XXE Injection. python lfi.py -u manager -p partylikearockstar -...

CVE-2020-14882

Thank you NS-Sp4ce、Jas502n、s1kr10s、demon、斯文 reference： https://github.com/NS-Sp4ce/CVE-2020-14882 https://github.com/jas502n/CVE-2020-14882 https://github.com/s1kr10s/CVE-2020-14882 usage: CVE-2020-14882.py -h -u URL -f FILE -c CMD optional arguments: -h, --help show this help message and exit -u...

CVE-2016-5639

CVE-2016-5639 Crestron AirMedia AM-100 Traversal and Hashdump Metasploit Modules Two similar modules that take advantage of CVE-2016-5639 to dump hashes and retrieve files through path traversal. I made these modules separate because I wanted experience writing something that could "dump" hashes,...

CVE-2026-109277

A flaw was found in ImageMagick. Missing checks in the -script operation allow an attacker to close file descriptors—handles used by the operating system to access open files or resources—that were not opened by the active task. This vulnerability allows an attacker to circumvent configured...

CVE-2024-27665

CVE-2024-27665 Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting XSS via file upload feature in Syllabus module. Vendor: https://github.com/changeweb/Unifiedtransform PoC Step 1: Log in to the Application and Navigate to Academic module. Step 2: Create Session,Semester,Class,Cour...

CVE-2026-83536 Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-83536

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-83536

A flaw in openstack-network-exporter allows an unauthenticated, remote attacker to perform a Slowloris-style Denial of Service (DoS) attack. The HTTP server component lacks essential timeout settings, such as ReadHeaderTimeout , enabling an attacker to initiate multiple slow HTTP header connectio...

CVE-2026-83536

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2024-1302---Badgermeter-moni-tool-Sensitive-information-exposure

CVE-2024-1302 --- Badgermeter moni tool - Sensitive information exposure https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1302: 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N | CWE-200. Software link :...

CVE-2020-1938-MSF-MODULE

CVE-2020-1938-MSF-MODULE Modified version of auxiliary/admin/http/tomcatghostcat, Read any file Overwrite the file/metasploit-framework/modules/auxiliary/admin/http/tomcatghostcat.rb and restart msfconsole to execute reloadall. Then you can use the module...

CVE-2026-102663

Prior to version 4.2.4 , OpenList is vulnerable to unauthorized disclosure of file metadata and existence information due to a non-separator-aware path check in the search API. When Bleve search is enabled, an authenticated user with restricted access can exploit a flawed strings.HasPrefix compar...