CVE-2025-70828

CVE-2025-70828 Summary An arbitrary file read vulnerability was discovered in Datart v1.0.0-rc.3. The application fails to properly validate the JDBC connection URL during data source configuration. Vulnerability Details Vulnerability Type: Improper Input Validation CWE-20 / Arbitrary File Read...

CVE-2025-24071

CVE-2025-24071 Windows File Explorer Spoofing Vulnerability - CVE-2025-24071 Leak the NTLM hash of Windows through the extraction of a manipulated ZIP or RAR file, and by exploiting a vulnerability in the handling of .library-ms files a type of file used by Windows to specify libraries and networ...

CVE-2025-13407

CVE-2025-13407 GravityForms 2.9.23.1 - Unauthenticated Arbitrary File Upload TELEGRAM GROUP ADRESS: https://t.me/toolsandpoc...

CVE-2024-28995

CVE-2024-28995 PoC SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. Queries Shodan: product:"Rhinosoft Serv-U httpd" "Serv-U FTP Server" Fofa: app="SolarWinds-Serv-U-FTP" References...

CVE-2025-46822

CVE-2025-46822 Unauthenticated Arbitrary File Read via Absolute Path Description: While Path.resolve method is being used to protect against path traversal I have found that the usage of absolute path successfully read internal files , the endpoint is also not authenticated this means anyone can...

CVE-2022-1257

CVE-2022-1257 PoC: McAfee Agent Database Credential Harvesting Made by scottk817 This script is a PoC for CVE-2022-1257 , a vulnerability in the McAfee Agent Trellix Agent when working with it's database. The vulnerability allows attackers to retrieve and decrypt credentials from the McAfee Agent...

CVE-2020-13671

CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...

CVE-2026-48908

🚨 CVE-2026-48908 — Full Server Compromise via Arbitrary File Upload Critical Unauthenticated File Upload → Remote Code Execution RCE A critical vulnerability in SP Page Builder allows unauthenticated attackers to upload arbitrary files and achieve Remote Code Execution RCE , potentially leading t...

CVE-2025-2539

CVE-2025-2539 - WordPress File Away = 3.9.9.0.1 - Arbitrary File Read 🔥 Vulnerability Summary The WordPress plugin File Away version = 3.9.9.0.1 is vulnerable to an unauthenticated arbitrary file read vulnerability. This allows attackers to read any file on the server, such as wp-config.php,...

CVE-2025-26892

CVE-2025-26892 – WordPress Celestial Aura Theme = 2.2 Arbitrary File Upload Authenticated 📄 Description An Unrestricted File Upload vulnerability exists in the WordPress Celestial Aura theme developed by dkszone up to version 2.2. A low-privileged authenticated user can upload arbitrary PHP files...

CVE-2023-4636

CVE-2023-4636 The vulnerability in the limelight is an unauthenticated remote code execution RCE issue stemming from insufficient controls on file paths occurring during image processing via Imagick. It enables adversaries to supply files via FTP, leading to local file inclusion and remote code...

day05-grafana-sqlexpr-lab

Day 5 – Grafana SQL Expressions → DuckDB LFI CVE-2024-9264 TL;DR: On affected Grafana 11.x builds, a logged-in Viewer can use SQL Expressions. Grafana forwards the expression to DuckDB on the server. With readtext / readblob, you can read local files LFI. We plant a flag at /opt/flag.txt. Build →...

cve-2015-3306-lab

CVE-2015-3306 — ProFTPD modcopy Pre-Auth Arbitrary File Copy A fully reproducible lab and a hand-written exploit for CVE-2015-3306 — built as a learning exercise in vulnerability research: patch diffing, manual triggering, and raw-socket exploit development. The bug ProFTPD's modcopy module...

day03-jenkins-23897

Day 3 — Jenkins CLI arbitrary file read CVE-2024-23897 Idea: Jenkins ≤ 2.441 LTS ≤ 2.426.2 expands @/path inside CLI args. Unauthenticated users can make Jenkins read local files and reflect their first lines via the CLI help output. Fixed in 2.442 / 2.426.3. Build → Run 1 Build docker build -t...

CheckFlashPlayerVersion

CheckFlashPlayerVersion Check the Browser's FlashPlayer version to check if it is vulnerable to exploit CVE-2016-7855 Usage: Clone this repository and then open the html file in the browser where you want to check the Flash Player version...

CVE-2025-5961

CVE-2025-5961 Migration, Backup, Staging – WPvivid Backup & Migration 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft...

CVE-2025-7847-POC

CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...

CVE-2021-29447

CVE-2021-29447 WordPress 5.6-5.7 - Authenticated Author+ XXE https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/ usage: -l LHOST example: 127.0.0.1 -n NAME example: payload.wav -dn DTDNAME example: evil.dtd -r READ example: ../wp-config.php evil-wav-dtd-xxe.py: error: the...

PoC-CVE-2019-10743

Zip Slip Demo This project demonstrates the Zip Slip vulnerability CVE-2019-10743 using the vulnerable version of the mholt/archiver package. What is Zip Slip? Zip Slip is vulnerability that was uncovered by the security researchers from Snyk. It was found that the vulnerability is impacting...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...