wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...

cve-2022-31692

CVE-2022-31692 Demo Overview A simple Spring Boot application demonstrating configuration that is vulnerable to CVE-2022-31692. This vulnerability may attract attention due to its severity - it has a CVSS 3.x base score of 9.8 as it allows authentication bypass. The purpose of this project is to...

CVE-2023-6553

CVE-2023-6553 Due to a incorrect include statement in the "Backup Migration" plugin, a attacker can achieve RCE Summary of the CVE The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems...

CVE-2026-115354

A flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown input can exploit this flaw to read arbitrary local files fro...

CVE-2026-115355

A flaw was found in Mistune. A remote attacker can exploit a path traversal vulnerability in the Include directive by supplying manipulated file paths to access and read arbitrary files on the system. Furthermore, an attacker can inject malicious content through unescaped error messages and...

CVE-2022-46364-htb-ctf

DevArea SOAP Exploitation Tool CVE-2022-46364 Description This specialized exploit targets the DevArea environment on Hack The Box. It leverages a critical vulnerability in Apache CXF 3.2.14 CVE-2022-46364 to perform Local File Inclusion LFI and Server-Side Request Forgery SSRF. The script abuses...

CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015 – PHP Filter Chain Arbitrary File Read Program Code PHP // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper include"php://filter/convert.base64-encode/resource...

CVE-2026-115354

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

CVE-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115350

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw blockhtml tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path...

CVE-2026-115354

Mistune versions before 3.3.0 are vulnerable to a path traversal vulnerability within the opt-in Include directive . An attacker who can submit Markdown to be processed via Markdown.read() can provide relative or absolute paths to read arbitrary local files, such as /etc/passwd . Additionally, th...

CVE-2026-115355

The Mistune markdown parser (versions prior to 3.3.0 ) is vulnerable to a path traversal flaw within the Include directive . Attackers can leverage ../ sequences in include paths to read arbitrary files on the system. Additionally, the parser fails to escape certain error messages and included fi...

EUVD-2026-108423

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

EUVD-2026-108425

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115355 Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115354 Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

CVE-2026-115353

The Mistune markdown processor (versions before 3.3.0 ) is vulnerable to a path traversal vulnerability in the RST include directive . An attacker can exploit this by submitting markdown containing include directives with relative paths (e.g., ../ sequences) or absolute paths . This allows the at...

EUVD-2026-108422

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensiti...

CVE-2026-115350

Versions of Mistune prior to 3.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the Include directive . The root cause is that the renderer emits content from included .html, .xhtml, or .htm files as raw block_html tokens. An attacker who can plant a readable HTML fi...