CVE-2023-29384

CVE-2023-29384 CVE-2023-29384 Auto Exploiter per plugin WordPress Job Board and Recruitment Tipo di vulnerabilità: Caricamento arbitrario di file...

CVE-2019-16724

Descrizione della vulnerabilità File Sharing Wizard 1.5.0 consente a un attaccante remoto di ottenere l'esecuzione di codice arbitrario sfruttando un overflow del buffer basato su Structured Exception Handler SEH in un parametro HTTP POST. Questo exploit è stato testato su Windows 7 Home...

nuclei-template-cve-2025-31324-check

Controllo SAP CVE-2025-31324 Panoramica Questo template è progettato per verificare la presenza della vulnerabilità SAP NetWeaver CVE-2025-31324. Questa vulnerabilità consente a utenti non autorizzati di caricare file JSP tramite l'endpoint /developmentserver/metadatauploader, il che può portare ...

CVE-2023-22809-sudoedit-privesc

CVE-2023-22809 sudo Elevazione dei privilegi Versioni di sudo interessate: da 1.8.0 a 1.9.12p1 Questo script automatizza lo sfruttamento della vulnerabilità CVE-2023-22809 per ottenere una shell di root. Lo script verifica se l'utente corrente ha accesso per eseguire il comando sudoedit o sudo -e...

CVE-2021-21972

CVE-2021-21972 VMware vSphere Client Upload di File Non Autorizzato per l'Esecuzione di Codice Remota RCE Il vSphere Web Client HTML5 è essenzialmente un'interfaccia amministrativa che consente la gestione di un'installazione vSphere. Il vSphere Client fornisce a un amministratore l'accesso alle...

Wordpress-Hack-CVE-2018-6389

WordPress › Leggimi Piattaforma di Pubblicazione Personale Semantica Prima di tutto Benvenuto. WordPress è un progetto molto speciale per me. Ogni sviluppatore e contributore aggiunge qualcosa di unico al mix, e insieme creiamo qualcosa di bello di cui sono orgoglioso di far parte. Migliaia di or...

CVE-2019-11447

CVE-2019-11447 - PoC Sfrutta CuteNews 2.1.2 tramite controlli deboli sul caricamento dei file utilizzati per caricare un'immagine avatar, portando a RCE. Installazione Clona il repository e installa i requisiti. pip install -r requirements.txt Utilizzo Per caricare un avatar è necessario un accou...

CVE-2019-14751_PoC

CVE-2019-14751PoC Una Proof of Concept per CVE-2019-14751 Descrizione della vulnerabilità NLTK Downloader prima della versione 3.5 è vulnerabile a un directory traversal, che consente agli attaccanti di scrivere file arbitrari tramite un ../ dot dot slash in un pacchetto NLTK archivio ZIP che vie...

CVE-2026-81727 NLTK before 3.10.3 Hardlink File Overwrite via downloader

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incrdownload methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader...

EUVD-2026-67077

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incrdownload methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader...

CVE-2026-81727 NLTK before 3.10.3 Hardlink File Overwrite via downloader

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incrdownload methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader...

EUVD-2026-67076

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in its model-artifact APIs. The root cause is that TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs bypass pathsec enforcement by performing raw file operations on caller-controlled paths, allowing attack...

CVE-2026-81726 NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

CVE-2026-81726 NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

EUVD-2026-67071

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-81721 openssl_encrypt before 1.4.9 Denial of Service via KDF

opensslencrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to...

CVE-2026-81721

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters (Argon2, scrypt, or balloon) in encrypted file metadata and keystore headers. An unauthenticated attacker over the network can craft a malicious encrypted file declaring arbitrarily large KDF parameters, triggering unbounded memor...

EUVD-2026-67070

opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...

CVE-2026-81720

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter found in identity file protection blocks. Because the value is passed unboundedly into Argon2 key derivation, an attacker with write access to local identity stores can craft a malicious identity file with an excessive memor...