vaultize_CVE-2024-36079

About Vulnerability The on-premise Vaultize DRM v.21.07.27 is vulnerable to the upload of arbitrary files. Files whose names contain part of the absolute path of the file system may be uploaded due to the lack of filename filtering. When you try to download the files the application creates a...

Progress-MOVEit-Transfer-2020.1-Stored-XSS-CVE-2020-28647

Progress MOVEit Transfer 2020.1 Stored XSS CVE-2020-28647 During a recent web application test engagement one of the applications in scope was a MOVEit Transfer 2020 web application. While performing the assessment a Stored Cross-Site Scripting XSS vulnerability was identified. This blog post wil...

CVE-2023-26255-6

Jira plugin STAGIL Navigation FileName Parameter Arbitrary File Read Vulnerability POC Script Usage as follows: Single URL Detection 1. Use the command line to detect a single URL, pass the URL parameter with -U 2. Observe the returned result; if it shows "is vulnerable!", then the vulnerability...

CVE-2022-23935

CVE-2022-23935 The Exiftool software program, in versions prior to 12.38, has a security vulnerability that can be exploited through a specially crafted filename. This vulnerability allows for command injection, where an attacker can execute arbitrary commands on the system by appending a pipe...

CVE-2022-29597

CVE-2022-29597: Local File Inclusion in RSS v500 The RRS v500 application by Solutions Atlantic is vulnerable to a Local File Inclusion LFI vulnerability. Any authenticated user has the ability to reference internal system files within requests made to the...

CVE-2024-31835

CVE-2024-31835 Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a craftedpayload to the file name parameter. Affected Component: FlatPress CMS Admin Panel File Upload Field Fixed version: Flatpress v1.3 - will be fixed in...

Apache Struts2 CVE-2024-53677 upload traversal RCE

CVE-2024-53677 Struts2 FileName traversal writes a JSP cmd shell into the webroot. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 CVE-2024-53677 upload path traversal to JSP webshell.""" from future import annotations import re import socket import ssl from kittysploit import from...

ImageMagick CVE-2022-44268 Detect

Detects ImageMagick/GraphicsMagick conversion endpoints filename read primitive. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ImageMagick/GraphicsMagick conversion endpoints filename read primitive.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CVE-2016-4971

CVE-2016-4971 On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename. See the post on my blog for some detail. Usage On your server, node wget.js On your test computer, wget http://url.to.your/server...

CVE-2026-40987

CVE-2026-40987: Spring Integration Remote File Synchronization Path Traversal PoC This repository is a minimal reproduction PoC for CVE-2026-40987, as disclosed in the official Spring Security Advisory. Official advisory: https://spring.io/security/cve-2026-40987/ Official title: Remote-file...

ESAFENET CDG - Arbitrary File Download

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. id: CVE-2019-9632 info: name: ESAFENET CDG - Arbitrary File Download author: pdteam severity: hi...

rConfig <= 3.9.4 - Authenticated OS Command Injection

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the...

Langflow <= 1.8.4 - Path Traversal to RCE via File Upload

The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request. id: CVE-2026-5027 info: name: Langflow = 1.8.4 -...

Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal

Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST AP...

Amazon Linux 2023 : mod_security, mod_security-mlogc (ALAS2023-2026-3247)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3247 advisory. GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules CVE-2026-104269 Tenable has extracted the preceding description block directly from the tested product security...

Important: mod_security

Issue Overview: GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules CVE-2026-104269 Affected Packages: modsecurity Issue Correction: Run dnf update modsecurity --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3247 --releasever 2023.12.20261026 to...

Important: mod_security

Issue Overview: GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules CVE-2026-104269 Affected Packages: modsecurity Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Amazon Linux 2 : mod_security (ALAS-2026-4010)

The version of modsecurity installed on the remote host is prior to 2.9.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4010 advisory. GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules CVE-2026-104269 Tenable has extracted the...

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow , the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript , a...

Linux Distros Unpatched Vulnerability : CVE-2026-106587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH before 10.6, the value none for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is...