CVE-2024-58392

A flaw was found in PhysicsFS. An attacker could cause a Denial of Service DoS by supplying a specially crafted archive file. Due to an out-of-bounds read flaw when decoding multi-byte UTF-8 character sequences in entry names, the library advances past the end of the input buffer during string...

CVE-2026-110602

A flaw was found in libmspack. An attacker could exploit this vulnerability by enticing a user or application to process a specially crafted KWAJ compressed file containing invalid or truncated headers. When handling these errors, the library attempts to release uninitialized memory pointers,...

CVE-2026-110717 Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2009-2265-fix

CVE-2009-2265 - Adobe ColdFusion RCE Unauthenticated remote code execution via arbitrary file upload in the FCKeditor component bundled with ColdFusion. The file upload endpoint accepts a null-byte injection in the filename parameter, allowing a JSP webshell to be uploaded and executed directly b...

POC_CVE-2024-36420

POCCVE-2024-36420 Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise. Summary CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in: POST /api/v1/openai-assistants-file This lab was used to validate:...

ghostcat

Ghostcat - CVE-2020-1938 Exploit Read Tomcat files via AJP connector port 8009 Usage: python3 ghostcat.py file """ Save the script cat ghostcat.py 'PYEOF' AQUÍ VA EL CÓDIGO COMPLETO DE ARRIBA PYEOF Set permissions and run chmod +x ghostcat.py Read tomcat-users.xml Tomcat Manager credentials pytho...

CVE-2020-5421

Reproduction of Spring Security Vulnerability CVE-2020-5421 Vulnerability Overview CVE-2020-5421 bypasses the protection against RFD attacks via the jsessionid path parameter. The earlier RFD protection was added in response to CVE-2015-5211. What is RFD Reflective File Download RFD is an attack...

CVE-2018-9206-jquery-file-upload

CVE-2018-9206 - Blueimp jQuery-File-Upload Lab Vulnerable Docker environment for CVE-2018-9206 - Unrestricted File Upload in Blueimp jQuery-File-Upload ' Execute it curl "http://localhost:8888/jQuery-File-Upload/server/php/files/test.php" Output: CVE-2018-9206-PWNED Or run the PoC script:...

Use-after-free when using asynchronous file I/O (AIO)

Use-after-free when using asynchronous file I/O AIO Severity: medium CVE-2026-97205 Not vulnerable: 1.31.7+, 1.30.6+ Vulnerable: 0.8.11-1.31.6...

Security Bulletin: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System [CVE-2026-17068, CVE-2026-17073]

Summary IBM i is vulnerable to bypassing Network File System NFS version restrictions due to improper enforcement CVE-2026-17068 and obtaining sensitive information due to missing subtree checks CVE-2026-17073 in NFS as described in the vulnerability details section. Vulnerability Details...

CVE-2026-59774 Gitea Org-mode file disclosure and code execution

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...

EUVD-2026-101281

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...

CVE-2026-59774 Gitea Org-mode file disclosure and code execution

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...

CVE-2026-59774

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...

CVE-2026-59774

Gitea versions 1.22.1 through 1.27.0 are vulnerable to an unauthenticated arbitrary file read flaw. The issue exists because the Org-mode markup renderer fails to override the default ReadFile callback in the go-org library. An attacker can submit Org-mode markup containing an #+INCLUDE directive...

CVE-2026-110649

Versions of Stills before 25.24.2 are vulnerable to an OS command injection flaw. The vulnerability occurs when the application processes crafted media file paths containing $(...) or backticks. This allows an attacker to execute arbitrary shell commands with Node.js process privileges during the...

CVE-2026-110649 Stills before 25.24.2 OS Command Injection via Media File Names

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...

CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

EUVD-2026-101265

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project...

EUVD-2026-101234

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...