CVE-2026-4660-PoC

CVE-2026-4660 PoC Proof of Concept für CVE-2026-4660 HashiCorp Advisory in hashicorp/go-getter. Ich bin der ursprüngliche Melder. Ein Angreifer veröffentlicht ein Terraform-Modul mit einem ref von --pathspec-from-file=/pfad/zu/datei. Wenn das Opfer terraform init ausführt, klont go-getter das...

CVE-2026-39973-PoC

CVE-2026-39973-PoC Dies ist ein kleiner C-APK-Datei-Builder für CVE-2026-39973. Danksagungen OnlyToxi – Hilfe beim Pfad wird weiterhin helfen & emotionale Unterstützung. iBotPeaches/Apktool – Dokumentation & Parsing. Haftungsausschluss Dies ist ein Proof of Concept , der ausschließlich für...

CVE-2021-45010-TinyFileManager-Exploit

CVE-2021-45010 CVE-2021-45010: Eine Path-Traversal-Schwachstelle in der Datei-Upload-Funktionalität in tinyfilemanager.php im Tiny File Manager Project’s Tiny File Manager = 2.4.3 ermöglicht es entfernten Angreifern mit gültigen Benutzerkonten, schädliche PHP-Dateien in das Webroot hochzuladen un...

EUVD-2026-66379

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can levera...

CVE-2026-25964

CVE-2026-25964 PoC - Tandoor Recipes LFI Autenticato Proof-of-Concept per Divulgazione Locale di File Autenticata tramite Importazione Ricette Divulgazione: Originariamente segnalata da me tramite GHSA-6485-jr28-52xx ⚠️ Solo per test di penetrazione/ricerca autorizzati. Informazioni sulla...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache = 2.4.4 Caricamento Arbitrario di File Non Autenticato fino a RCE Panoramica...

CVE-2026-31431

copyfun einfache Demonstration des Exploits für CVE 2026-31431 copyfun vergiftet den Cache für die angegebene Zieldatei mit den bereitgestellten Payload-Bytes...

CVE-2026-77991

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77016

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server...

CVE-2026-77018

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77017

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-7020

CVE-2026-7020 Beliebiger Dateizugriff in Ollama über Tensor-Digest-Pfad-Traversal. Exfiltriert SSH-Host-Keys und beliebige andere Dateien von einem erreichbaren Ollama-Host in drei nicht authentifizierten API-Aufrufen. Writeup: Co-Forscher @gouldnicholas Verwendung root@kitploit: python3 poc.py...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

CVE-2026-36340

CVE-2026-36340 Vulnerabilità di Remote Code Execution RCE in Krayin CRM v2.1.5 Vulnerabilità di Remote Code Execution RCE in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critica Prodotto interessato: Krayin CRM v2.1.5 Tipo di vulnerabilità: Remote Code Execution RCE Autenticazione richiesta: S...

Ni8mare

🔒 Ni8mare Scanner Ethischer Sicherheitsscanner für CVE-2026-21858 Ni8mare-Schwachstelle „Wissen ist Macht, aber nur, wenn es verantwortungsvoll geteilt wird." Umfassendes Schwachstellenerkennungstool für n8n-Workflow-Automatisierungsinstanzen. Erkennt die kritische Schwachstelle CVE-2026-21858 CV...

CVE-2026-34036

CVE-2026-34036 Script proof-of-concept per CVE-2026-34036 , una inclusione locale di file / LFI autenticata in Dolibarr. Il problema è raggiungibile tramite core/ajax/selectobject.php. Un utente autenticato può abusare del parametro objectdesc per far sì che l'applicazione legga file locali...

CVE-2024-23897-Jenkins-4.441

CVE-2024-23897 - Jenkins Lettura Arbitraria di File Compilazione root@kitploit: g++ CVE-2024-23897.cpp -o exploit Utilizzo root@kitploit: /exploit -u http://10.10.10.10 -f /etc/passwd...

CVE-2026-77017 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77018

The Workeera WordPress plugin (Remote Tech Job Board) before 1.0.6 allows users with a subscriber role to submit unrestricted profile values, which the plugin writes as an unvalidated file into a publicly reachable directory. This mass-assignment flaw enables arbitrary file upload and, consequent...