CVE-2023-30943

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 우리는 테러 조직 하마스Hamas에 의해 인질로 잡혀 있는 모든 시민의 안전한 귀환을 요구합니다. 모든 인질이 석방되어 안전하게 귀환할 때까지 우리는 멈추지 않을 것입니다. 여러분도 그들을 집으로 데려오는 일에 동참할 수 있습니다.https://stories.bringthemhomenow.net/ CVE-2023-30943 Moodle 취약점 익스플로잇 이 저장소는 널리 사용되는 오픈소스 학습 관리 시스템LMS인 Moodle의 두 가지 취약점에 대한 결합 익스플로잇을...

CVE-2020-1283_Windows-Denial-of-Service-Vulnerability

CVE-2020-8103 익스플로잇 해당 분석 글은 RedyOps Labs 블로그에서 확인할 수 있습니다: https://labs.redyops.com/index.php/2020/04/27/dos-via-arbitrary-folder-creation/ 서드파티 도구 이 익스플로잇 코드는 James Forshaw이 개발한 symboliclink-testing-tools를 기반으로 합니다. symboliclink-testing-tools는 다음에서 찾을 수 있습니다:...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 11.3.757 이전 버전은 CrushFTP 관리자 패널Reports / "Who Created Folder"에서 저장형 HTML 삽입 취약점이 존재하며, 관리자 세션에서 지속적인 HTML 실행을 가능하게 합니다. CWE CWE-79 — 웹 페이지 생성 중 입력 값의 부적절한 중화 크로스 사이트 스크립팅 CVSS v3.1 기본 점수: 4.1 보통 AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N 해결된 버전 공급업체 변경 로그...

Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts Affected ComponentFolder creation endpoint and form model:- backend/openwebui/models/folders.py lines 72-77, FolderForm with extra='allow'- backend/openwebui/models/folders.py lines 95-106, insertnewfolder...

PT-2026-59377

Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts Affected Component Folder creation endpoint and form model: - backend/open webui/models/folders.py lines 72-77, FolderForm with extra='allow' - backend/open webui/models/folders.py lines 95-106, insert new...

CVE-2026-12119

The CVE concerns the Simple File List WordPress plugin (≤6.3.7). A missing authorization check on the frontmanage shortcode attribute allows authenticated users with contributor-level access or higher to perform arbitrary file operations (delete, move, folder creation, download). The vulnerabilit...

CVE-2026-41530

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

CVE-2026-44550 Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, FolderForm uses modelconfig = ConfigDictextra='allow', which permits arbitrary fields to pass through Pydantic validation and be included in modeldumpexcludeunset=True. In...

CVE-2026-44550 Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, FolderForm uses modelconfig = ConfigDictextra='allow', which permits arbitrary fields to pass through Pydantic validation and be included in modeldumpexcludeunset=True. In...

EUVD-2026-29379

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

CVE-2026-41530

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

CVE-2026-41530

The CVE pertains to the automatic folder creation feature in Lhaz and Lhaz+ by Chitora soft, revealing a path traversal flaw. When this feature is enabled and a user extracts an archive containing a crafted file name, files may be extracted to an unintended directory. The available sources descri...

CVE-2026-41530

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

CVE-2026-41530

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

CVE-2026-41530

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

CVE-2026-41530: Improper Limitation of a Pathname to a Restricted Directory

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

Chitora Lhaz 路径遍历漏洞

Chitora Lhaz is a Windows compression tool developed by Chitora Company in Japan. It supports the creation of files in various compression formats and the decompression of those files. Chitora Lhaz has a path traversal vulnerability. This vulnerability stems from an issue with the automatic folde...

PT-2026-39936

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name,...

Lhaz and Lhaz+ vulnerable to path traversal

Overview Lhaz and Lhaz+ provided by Chitora soft contain the following vulnerability. Path traversal CWE-22 - CVE-2026-41530 RyotaK of GMO Flatt Security Inc. and Rei Yano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...