CVE-2026-119672

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

CVE-2026-119672 mongofiles may disclose GridFS content to standard output through a stored filename

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

MasterPHP2SHELL

PHP2Shell Unified Multi-Repo Orchestrator CVE-2026-109618 +...

rustypaste < 0.18.1 - Filename Header Path Traversal

rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory. id: CVE-2026-90774 info: name: rustypaste 0.18.1 - Filename Header Path Traversal author: carfeii severity: high...

jotty.page < 1.22.0 - Path Traversal

jotty·page 1.22.0 contains a path traversal caused by lack of validation on filename parameter in /api/app-icons/filename, letting unauthenticated attackers read arbitrary files outside intended directory. id: CVE-2026-42564 info: name: jotty.page 1.22.0 - Path Traversal author: Het-Kalariya...

Avid NEXIS Agent - Arbitrary File Read

Avid NEXIS E-series, F-series, PRO+, and System Director Appliance SDA+ before 2025.5.1 contain an unauthenticated arbitrary file read caused by improper validation of the filename parameter, letting unauthenticated attackers read sensitive files, exploit requires no authentication. id:...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

CodiMD <2.5.4 - Insecure Filename Randomization

CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an...

GeoDjango Spatial Search Code Execution

The spatial search vulnerability in the GeoDjango software platform for Django web applications is related to improper external handling of filenames or file paths. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

PT-2026-135267

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab filename can lead to path traversal. The attack may be...

CVE-2017-12615-EXP

CVE-2017-12615-EXP .\CVE-2017-12615.exe @@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@ @@@ @@@@@@@@ @@@ @@@@@@ @@@@@ @@@ @@@@@@@ !@@ @@! @@@ @@! @@ @@@ @@! @@@ @@@@ @@! @@@@ @@ @@@ @@!@ @@@@ !@@ !@! @!@ !@! @!!!:! @!@!@!@! .!!@! @!@ !@! !@! @!! @!@!@!@! !@! .!!@! @!@!@!@ !@! !!@@!! :!! !: .:! !!: !!: !!:...

cve-2023-38831

CVE-2023-38831 WinRAR Exploit PoC This repository contains a Python proof-of-concept PoC script for exploiting CVE-2023-38831, a vulnerability in WinRAR versions Arguments: : Path to the decoy file e.g., document.pdf, image.jpg. : Path to the payload file to execute e.g., script.bat, malware.exe....

cve-2020-27358-27359

CVE-2020-27358 / CVE-2020-27359 Exploitation steps for CVE-2020-27358 and CVE-2020-27359 CVE-2020-27358 An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature that allows users to export their conversation threads as CSV allows non-privileged users to export o...

CVE-2026-25645

CVE-2026-25645 Insecure Temporary File Reuse in requests.utils.extractzippedpaths Executive Summary A vulnerability was identified in the requests library Python within the public utility function requests.utils.extractzippedpaths. The function utilizes a predictable, non-unique filename when...

vaultize_CVE-2024-36079

About Vulnerability The on-premise Vaultize DRM v.21.07.27 is vulnerable to the upload of arbitrary files. Files whose names contain part of the absolute path of the file system may be uploaded due to the lack of filename filtering. When you try to download the files the application creates a...

CVE-2026-90042

A flaw was found in the Ceph filesystem client within the Linux kernel. This vulnerability arises from the improper handling of memory buffers during filename decryption, specifically when buffers are allocated in the vmalloc region. This can lead to a kernel panic, causing the system to crash. A...

CVE-2026-40987

CVE-2026-40987: Spring Integration Remote File Synchronization Path Traversal PoC This repository is a minimal reproduction PoC for CVE-2026-40987, as disclosed in the official Spring Security Advisory. Official advisory: https://spring.io/security/cve-2026-40987/ Official title: Remote-file...

CVE-2025-60787-Detection-motionEye-RCE-via-Config-Injection

README.md CVE-2025-60787 Detection: motionEye RCE via Config Injection Unauthenticated Remote Code Execution in motionEye Still Images - Image File Name Example PoC payload: $touch /tmp/test.%Y-%m-%d-%H-%M-%S When motion restarts, the shell command executes and creates /tmp/test. Detection Covera...

Movies <= 0.6 - Cross-Site Scripting

A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4539 info: name: Movies = 0.6 - Cross-Site Scripting author: daffainfo...