PanaceaSoft-0day-Exploit

PanaceaSoft-0day-Exploit Exploit 0day PanaceaSoft todos os produtos https://packetstormsecurity.com/files/157869/PanaceaSoft-Shell-Upload.html sem write-up leia: PHP Upload Handler do jQuery File Upload...

Bypass-File-Upload-on-Koken-CMS

Koken CMS पर फ़ाइल अपलोड बाइपास करें यह रिपॉज़िटरी बताती है कि Koken CMS - 0.22.24 प्रमाणित पर फ़ाइल अपलोड प्रतिबंधों को कैसे बाइपास किया जाए। Koken CMS के बारे में Koken एक निःशुल्क सामग्री प्रबंधन प्रणाली है जो फोटोग्राफरों, डिज़ाइनरों और कलाकारों के लिए डिज़ाइन की गई है। वेबसाइट:...

Unrestricted-File-Upload-on-SiteMagic-CMS-4.4.2

Upload di file senza restrizioni su SiteMagic CMS 4.4.2 Questo repository descrive come sfruttare la vulnerabilità di upload di file senza restrizioni su SiteMagic CMS 4.4.2 Informazioni su SiteMagic CMS 4.4.2 Sito web: https://sitemagic.org/ Download: https://sitemagic.org/Download.html PoC -...

Limesurvey-RCE

Limesurvey-RCE LimeSurvey RCE autenticato Prova di concetto: 1. Crea i tuoi file config.xml e i file della reverse shell php 2. Crea un archivio con questi file 3. Accedi con le credenziali 4. Vai su Configurazione - Plugin - Carica e installa 5. Scegli il tuo file zippato 6. Carica 7. Installa 8...

CVE-2026-59314

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

EUVD-2026-67196

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

exploits

exploits Le PoC pubblicate sono disponibili su exploitdb.com Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

EUVD-2026-67182

ResourceCacheService.getCacheName builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new FileresourceParentFolder, newFileName before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 -...

CVE-2026-59294

Spring AI 's ResourceCacheService.getCacheName() builds an on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, before passing the result to new File(resourceParentFolder, newFileName). This allows an arbitrary file write via path traversal w...

CVE-2026-59294 Arbitrary File Write via Path Traversal in ResourceCacheService

ResourceCacheService.getCacheName builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new FileresourceParentFolder, newFileName before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 -...

EUVD-2026-67180

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-59292 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-59292

CVE-2026-59292 affects Spring Integration , where the default file-based PropertiesPersistingMetadataStore persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions , allowing local users with high privileges to read metadata. The CVSS 3....

CVE-2026-59291

Spring Cloud Function versions 5.0.0–5.0.3, 4.3.0–4.3.4, and 4.2.0–4.2.7 are vulnerable to arbitrary file read and SSRF via the function that processes input data. An attacker can access arbitrary files or make unauthorized network requests by supplying crafted input that is improperly handled. T...

CVE-2026-59291 Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

EUVD-2026-67179

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-76219

A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree, without proper option validation or...

CVE-2026-76217

A flaw was found in GitPython where it fails to properly validate options provided to its git rm and git checkout commands. A remote attacker with low privileges could exploit this by supplying crafted parameters, such as --pathspec-from-file and --pathspec-file-nul. This vulnerability allows for...

libreoffice-convert vulnerable to path traversal / arbitrary file write

Impact options.fileName is used to build a filesystem path path.jointempDir.name, fileName and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content t...

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write vulnerability discovered by ? in WordPress Npm libreoffice-convert versions 1.8.2...