CVE-2026-1357

CVE-2026-1357 -- WPvivid RCE Unauthenticated Remote Code Execution RCE in WPvivid Backup & Migration 800%2C000-brightgreen?style=for-the-badge" alt="Installs" Critical flaw impacting over 800,000–900,000+ WordPress sites Unauthenticated arbitrary PHP upload → full server compromise 🌩️ Overview...

CVE-2024-28995-SolarWinds-Serv-U

CVE-2024-28995-SolarWinds-Serv-U SolarWinds Serv-U File Server Serv-U is a multi-protocol file server capable of sending and receiving files from other networked computers through various means. CVE-2024-28995 is an unauthenticated directory transversal vulnerability in SolarWinds Serv-U that wou...

CVE-2024-24919-Check-Point-Remote-Access-VPN

CVE-2024-24919-Check-Point-Remote-Access-VPN CVE-2024-24919 is an unauthenticated arbitrary file read vulnerability that can be treated nothing less than a full unauthenticated RCE. An attacker can read any sensitive files located on the affected appliance with superuser access. An attacker can...

CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability

Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. CVE-2024-23897Arbitrary File Read Vulnerability Jenkins 2.441 and earlier, LTS 2.426.2 and...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion is a rapid development platform for building and deploying web and mobile applications. CVE-2024-20767 - ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file syst...

CVE-2026-65400

CVE-2026-65400 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server Arbitrary File Read PoC A drop-in PoC for GHSA-p9ff-h696-f583. It reads arbitrary files from the machine running the dev server by calling fetchModule over an unauthenticated HMR WebSocket, bypassing the HTTP-layer server.fs.allow restriction. Affected Versions...

CVE-2026-52680_exploit

CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbitrary File Write Unauthenticated arbitrary file write in Apache Kyuubi's REST API via the multipart batch-submission endpoint. POST /api/v1/batches multipart/form-data writes the resourceFile part to $KYUUBIHOME/work/upload// using the...

CVE-2026-14483_exploit

CVE-2026-14483 — Realtyna WPL / Organic IDX Unauthenticated Arbitrary File Upload → RCE Unauthenticated arbitrary file upload leading to RCE in the Realtyna WPL / Organic IDX WordPress plugin real-estate-listing-realtyna-wpl ≤ 5.2.0. The plugin registers an "I/O service" on the public WordPress...

cart

CaRT Compressed and RC4 Transport The CaRT file format is used to store/transfer malware and its associated metadata. It neuters the malware so it cannot be executed and encrypts it so anti-virus software cannot flag the CaRT file as malware. Advantages FAST: CaRT is just as fast as zipping a fil...

die-python

DetectItEasy-Python Native Python 3.11+ bindings for @horsicq's Detect-It-Easy Install From PIP The easiest and recommended installation is through pip. root@kitploit: pip install die-python Using Git root@kitploit: git clone https://github.com/elastic/die-python cd die-python Install Qt into the...

CVE-2026-63223

CVE-2026-63223 — CodeIgniter 4 File Upload RCE Magic Bytes Bypass → isimage/mimein → PHP Webshell → RCE Overview CVE-2026-63223 is a critical-severity CVSS 9.8 unauthenticated remote code execution vulnerability in CodeIgniter 4 , a PHP full-stack web framework, affecting versions prior to 4.7.4...

CVE-2025-10147

CVE-2025-10147 Podlove Podcast Publisher = 4.2.6 - Unauthenticated Arbitrary File Upload The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'moveasoriginalfile' function in all versions up to, and including, 4.2.6...

flowise-arbitrary-file-read-getFileFromStorage

Flowise unauthenticated arbitrary file READ getFileFromStorage — proposed NEW CVE A separate vulnerability from CVE-2025-71338 which is the write sink. This is an unauthenticated arbitrary file read in the Flowise document-store loader "rehydrate" path, affected 1.7.1 – 2.2.3 , fixed in 2.2.4...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate │ │ ├─ privatekey = │ │ ├─ cmd = setproperty │...

CVE-2026-5061

CVE-2026-5061 Consul Template validated where a symlink pointed during template evaluation, but its later dependency fetch read the original path. Retargeting the link between those operations turned an in-sandbox file reference into an out-of-sandbox file disclosure. Intro I found this issue whi...

cve-2021-41773-lab

CVE-2021-41773 — Minimal FastAPI Lab A small, self-contained FastAPI lab demonstrating how decoding user input before validating filesystem boundaries can lead to directory traversal and local file inclusion LFI, modeled after the Apache HTTP Server issues CVE-2021-41773. Features Minimal,...

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated-POC

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated- Remote Code Execution RCE Exploit Author: Ashish Koli Shikari Vendor Homepage: https://thedigitalcraft.com/ Software Link: https://github.com/thedigicraft/Atom.CMS Version: 2.0 CVE: CVE-2022-25487 About this: This script uploads...

cve_2013_3893_trigger.html

This repository does not have a README...

CVE-2019-18426

This was originally published on PerimeterX company's official Github through my work Github account. Eventhough this is my work - all rights and legal concerns belong to PerimeterX company. WhatsApp Vulnerabilities Disclosure - Open Redirect + CSP Bypass + Persistent XSS + FS read permissions +...