Yaws 1.91 - Local File Inclusion

Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080. id: CVE-2017-10974 info: name: Yaws 1.91 - Local File Inclusion author: 0xAkoko severity: high description: Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080. impact: |...

Kubio AI Page Builder <= 2.5.1 - Local File Inclusion

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubiohybridthemeloadtemplate function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...

CAREL Boss Mini <= 1.4.0 - Local File Inclusion

Boss Mini 1.4.0 Build 6221 contains a file inclusion caused by manipulation of the 'path' argument in boss/servlet/document, letting remote attackers include arbitrary files, exploit requires remote access. id: CVE-2023-3643 info: name: CAREL Boss Mini = 1.4.0 - Local File Inclusion author:...

Deltek Maconomy 2.2.5 - Local File Inclusion

Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.WMCS/ PATHINFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.WMCS/etc/passwd URI. id: CVE-2019-12314 info: name: Deltek Maconomy 2.2.5 - Local File Inclusion author: madrobot severity:...

CVE-2026-12227-visualcomposer-lfi-poc

CVE-2026-12227 - Visual Composer Unauthenticated LFI via vcv-template Validation Lab Security-research material for reproducing and validating CVE-2026-12227 : an unauthenticated local file inclusion in Visual Composer Website Builder's page-template resolution CVSS 3.1 9.8, plus a verified...

CVE-2026-12227

CVE-2026-12227 — Visual Composer Website Builder Unauthenticated LFI Python 3 PoC for CVE-2026-12227 Wordfence: Local File Inclusion via the vcv-template query parameter in Visual Composer Website Builder visualcomposer on wordpress.org. | ---|--- Platform| WordPress plugin Component| Visual...

TongDa-RCE

TongDa-RCE La inclusión de archivos de Tongda + la subida de archivos provoca RCE Instrucciones de uso RCE remoto: python3 tongdarce.py targert getsehll: python3 tongdashell.py target...

CVE-2026-85706-PoC-Toolkit

CVE‑2026‑85706 – Kit de herramientas de lectura de archivos no autenticada en GitLab ⚠️ SOLO USO ÉTICO – PRUEBAS DE SEGURIDAD AUTORIZADAS Este repositorio proporciona herramientas únicamente para profesionales de seguridad autorizados, equipos azules y pentesters. El acceso no autorizado a sistema...

unhook-bof

Este es un Beacon Object File para refrescar los DLL y eliminar sus hooks. El código proviene de la investigación de Cylance "Universal Unhooking": https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software Para usarlo: Cargue unhook.cna en Cobalt Strike mediante Cobal...

unhook-bof

Este es un Archivo de Objeto Beacon para refrescar DLLs y eliminar sus hooks. El código proviene de la investigación Universal Unhooking de Cylance: https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software Para usarlo: Carga unhook.cna en Cobalt Strike mediante Cobal...

ApacheSkywalking

ApacheSkywalking Inyección SQL de Apache SkyWalking para leer archivos sensibles...

TotalCMS-Arbitrary_File-Upload--XSS_Steal_Cookies---TotalDepot

TotalCMS Carga Arbitraria de Archivos - XSS y robo de cookies Autor: Sergio Descripción: TotalCMS está afectado por la vulnerabilidad de Carga Arbitraria de Archivos - XSS que permite Cross-Site Scripting XSS y también el robo de cookies de sesión. Vectores de ataque: Una vulnerabilidad en la...

CockpitCMS-Arbitrary-File-Upload--XSS---Assets

Cockpit CMS 2.7.0 Carga de archivos - XSS Autor: Sergio Descripción: Vulnerabilidad de subida de archivos en Cockpit CMS 2.7.0 que permite a un atacante local subir un archivo PDF con XSS oculto. Vectores de ataque: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L PoC: Esta es la versión del software. Este es...

grafana-unauth-file-read

grafana-unauth-file-read : CVE-2021-43798 Lectura no autorizada de archivos en Grafana 0day Parece que el nuevo 0day LFI en Grafana existe gracias al plugin grafana-clock-panel. Basta con enviar una petición GET de la forma: GET /public/plugins/grafana-clock-panel/../../../../../../../etc/passwd...

OESA-2026-4081 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A flaw was found in G...

OESA-2026-4068 git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: Processing an incomplete post-handshake message for a QUIC connection can cause a...

OESA-2026-4056 gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...

OESA-2026-4055 gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...

OESA-2026-4053 gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...

OESA-2026-4054 gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...