CVE-2024-36527

CVE-2024-36527 PoC and Bulk Scanner Overview POC for CVE-2024-36527: puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server. Based on the security advisory published ...

cve-2024-21413-outlook-monikerlink-lab

CVE-2024-21413 — Outlook Moniker Link Lab / PoC Educational lab notes and a small Proof of Concept PoC demonstrating the CVE-2024-21413 attack flow in a controlled environment TryHackMe-style lab. ⚠️ For educational purposes only. Do not use against systems you don’t own or have explicit permissio...

CVE-2024-56331

CVE-2024-56331 Uptime-Kuma : Local File Inclusion LFI via Improper URL Handling in Real-Browser monitor Summary An Improper URL Handling Vulnerability allows an attacker to access sensitive local files on the server by exploiting the file:/// protocol. This vulnerability is triggered via the...

GHSA-QGW5-7J4F-FG97 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

A vulnerability in Nuclei's workflow template loader allows file: protocol templates to execute without the -file flag, bypassing a security gate that is meant to prevent local file reads on the scanner host. Affected Component The issue is in the workflow template loading path. The main template...

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

A vulnerability in Nuclei's workflow template loader allows file: protocol templates to execute without the -file flag, bypassing a security gate that is meant to prevent local file reads on the scanner host. Affected Component The issue is in the workflow template loading path. The main template...

EUVD-2026-84554

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — SSRF / local file read via response URL CVE-2026-13233 Untrusted upstream: the provider that fetched the URL its response told it to. Drupal OpenAI Provider aiprovideropenai · SSRF CWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053 Status: Coordinated disclosure complete...

CVE-2024-21413-Vulnerabilidad-Outlook-LAB

CVE-2024-21413 – Outlook LAB Vulnerability Vulnerability Description CVE-2024-21413 is a critical vulnerability discovered in Microsoft Outlook that allows a remote attacker to execute malicious links via a carefully crafted email. This exploit uses the file:// protocol to redirect victims to...

Moniker-Link-Lab-Setup

Moniker Link Lab Setup - CVE-2024-21413 🎯 Project Overview Hands-on penetration testing lab demonstrating CVE-2024-21413 moniker link exploitation for NTLM credential theft. This project documents the complete attack chain from setup to credential compromise, including real-world challenges and...

W3TotalChache

W3TotalChache Testing for CVE-2019-6715 Arbitrary File Read/ CVE-2024-12365 SSRF/Info Disclosure usage: python3 w3tcscanner.py -u https://example.com -f /etc/passwd -d 3 import requests import argparse from urllib.parse import urlparse def checkw3tcversionurl: try: response = requests.geturl,...

tryhackme-moniker-link

tryhackme-moniker-link Documentation of my hands-on lab Moniker Link CVE-2024-21413 completed on TryHackMe. Moniker Link CVE-2024-21413 — TryHackMe Lab Overview This repository documents my hands-on study in a TryHackMe room. The goal of this exercise was to understand how the vulnerability works...

libreoffice-remote-arbitrary-file-disclosure

Vulnerability description CVE-2018-6871 First part LibreOffice supports COM.MICROSOFT.WEBSERVICE function: root@kitploit: https://support.office.com/en-us/article/webservice-function-0546a35a-ecc6-4739-aed7-c0b7ce1562c4 The function is required to obtain data by URL, usually used as: root@kitploi...

CVE-2025-11973

Trigger: Read /etc/passwd via file:// and exfiltrate to uploads root@kitploit: curl -sS -A "$UA" -X POST "$BASE/?kdsflag=post" \ --data-urlencode "kdspassword=$SECRET" \ --data-urlencode "posttitle=sub1-lfi" \ --data-urlencode "kdsfeatureurl=file:///etc/passwd" Retrieve the exfiltrated file Compu...

CVE-2025-55853

CVE-2025-55853 - Local File Inclusion via Server Side Request Forgery SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery SSRF. About This PoC for CVE-2025-55853 demonstrates Server Side Request Forgery in the webPDF tool webPDF. used to convert files to PDF. The PDF...

CVE-2025-13380

AI Engine for WordPress: ChatGPT, GPT Content Generator = 1.0.1 - Authenticated Contributor+ Arbitrary File Read The AI Engine for WordPress plugin contains a vulnerability in its image insertion feature that allows any authenticated user with post editing capabilities Contributor, Author, Editor...

CVE-2026-20841

CVE-2026-20841 PoC PoC of the "Windows Notepad RCE" vulnerability. Disclaimers 1. I am NOT the one who discovered this vulnerability. Props to the original authors listed on the official disclosure page. I just recreated the PoC according to the description. 2. I personally don't think this...

CVE-2026-20841

CVE-2026-20841 - Windows Notepad RCE PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary protocol handlers to be triggered via clickable links. Disclaimers 1. Not my discovery. Credit goes to the...

CVE-2026-41177-Squidex-CMS

CVE-2026-41177：Squidex CMS 盲SSRF 针对CVE-2026-41177的技术研究与分析：Squidex CMS Restore API中的一个盲服务器端请求伪造（SSRF）漏洞。 漏洞概述 CVE ID： CVE-2026-41177 受影响组件： Squidex API：备份/恢复引擎（/api/apps/restore） 受影响版本： 替换为有效的管理员令牌）： root@kitploit: curl -X POST http://localhost/api/apps/restore/ \ -H 'Authorization: Bearer ' \ -H...

CVE-2026-20841

CVE-2026-20841 - Windows Notepad RCE PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary protocol handlers to be triggered via clickable links. Disclaimers 1. Not my discovery. Credit goes to the...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...