CVE-2022-44268-pilgrimage

CVE-2022-44268 任意ファイル読み取り PoC - PNGジェネレーター これは、https://www.metabaseq.com/imagemagick-zero-days/ によって発見された ImageMagick のバグの概念実証です。 これは Pilgrimage HackTheBox チャレンジ用の自動化ツールです。 これは https://git.rotfl.io/v/CVE-2022-44268 からのフォークです。 ImageMagick v. 7.1.0-48 および 6.9.11-60 でテスト済み。 使い方 プロジェクトのクローン git clone...

CVE-2018-14847

CVE-2018-14847 Это proof of concept критической уязвимости WinBox CVE-2018-14847, которая позволяет произвольное чтение файлов с паролями в открытом виде. Уязвимость давно исправлена, поэтому этот проект завершён и больше не будет поддерживаться или обновляться. Вы можете форкнуть его и обновить...

CVE-2024-28995

CVE-2024-28995 PoC и массовый сканер Обзор Этот репозиторий содержит доказательство концепции PoC и массовый сканер для уязвимости обхода каталогов SolarWinds Serv-U CVE-2024-28995. Эта уязвимость позволяет неавторизованному доступу читать конфиденциальные файлы на хост-машине. Уязвимость была...

CVE-2006-3392

CVE-2021-42913 1.290 이전의 Webmin과 1.220 이전의 Usermin은 HTML을 디코딩하기 전에 simplifypath 함수를 호출하는데, 이로 인해 원격 공격자가 임의의 파일을 읽을 수 있습니다. "..%01" 시퀀스를 사용하는 방식으로 입증되었으며, 이는 "../" 시퀀스를 제거한 후 "%01"과 같은 바이트가 파일명에서 제거되기 전에 우회합니다...

CVE-2019-1010268

PoC-эксплойт для CVE-2019-1010268 Автор: Tonyynot14 Протестировано на Kali Linux Вдохновение взято с https://www.exploit-db.com/exploits/43113 Использование root@kitploit: python3 exploit.py -l domainname -a apppath -r /etc/passwd...

CVE-2020-19360

Fhem FileLoglogWrapper Уязвимость произвольного чтения файлов CVE-2020-19360 Описание уязвимости В версии FHEM 6.0 существует уязвимость включения файлов, которая возникает из-за того, что параметр file в FHEM/FileLoglogWrapper позволяет злоумышленнику включать файлы. Злоумышленник может...

CVE-2023-2825

CVE-2023-2825 Неаутентифицированный Обход каталога приводит к чтению файлов. Краткое описание CVE В GitLab CE/EE обнаружена проблема, затрагивающая только версию 16.0.0. Неаутентифицированный злоумышленник может использовать уязвимость обхода пути для чтения произвольных файлов на сервере, если...

CVE-2022-35650

CVE-2022-35650 이것은 Moodle에서의 임의 파일 읽기 취약점입니다. 사전 요구 사항 교사 또는 관리자 수준 사용자의 계정을 탈취해야 합니다. 단계 1. 이 저장소를 클론하세요: root@kitploit: git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git 2. 익스플로잇을 압축하기 위해 다음 명령을 실행하세요: root@kitploit: zip exploit.zip imsmanifest.xml pool.dat 3. 계정에 쓰기 권한이 있는 강좌로 이동하세요. 4...

CVE-2026-85688

TEN Framework 0.11.71 is vulnerable to unauthenticated arbitrary file read and write via the TMAN Designer file-content API endpoints (/api/designer/v1/file-content). Attackers can send POST and PUT requests to read arbitrary files or write malicious content to system paths, enabling code executi...

EUVD-2026-71137

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...

CVE-2026-85687

CVE-2026-85687 affects the surya 0.22.1 screenshot server, where the /info, /page, and /process routes accept raw file_path parameters without validation. The unsanitized paths are passed directly to Image.open or pypdfium2.PdfDocument , allowing an unauthenticated attacker to read any image or P...

CVE-2026-85687 surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

EUVD-2026-71136

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

CVE-2026-85668

Xinference (v3.x, affected commit 4a94832, specifically v3.3.0) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path parameter without authentication or path confinement, reads and p...

EUVD-2026-71124

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

CVE-2026-85665 Bruno 3.4.2 Arbitrary File Read via Unconfined Body File Path

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

CVE-2026-85665

Bruno versions through 3.4.2 are affected by an arbitrary file read vulnerability caused by insufficient validation of file paths in request body declarations. An attacker who can influence a collection's body:file path can embed parent-directory traversal (../) sequences that resolve outside the...

EUVD-2026-71121

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

EUVD-2026-71117

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-85620

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass in its SQL validation layer. The root cause is that function-name validation is not applied to RangeFunction nodes in FROM clauses , allowing attackers to invoke file-reading functions such as pg_read_file via FROM-clause syntax and read ar...