CVE-2026-84941

An information disclosure vulnerability in the SAML Single Sign-On SSO functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could...

NPM: n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

NPM: n8n: Git Node branch..remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

CVE-2022-47615

CVE-2022-47615 LearnPress Plugin 4.2.0 - Descripción de LFI sin autenticación Descripción El plugin no valida varios parámetros en los endpoints REST lp/v1/courses/archive-course antes de usarlos en una sentencia include, lo que podría provocar problemas de LFI. Cómo usar root@kitploit: $ python3...

LFiFreak

LFI Freak Características Funciona con Windows, Linux y OS X Incluye bind y reverse shell tanto para Windows como para Linux Escrito en Python 2.7 ¿De qué se trata todo esto? Una herramienta única para explotar inclusiones de archivos locales usando los métodos PHP Input, PHP Filter y Data URI...

FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability

FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability LFI in FHEM 6.0 allows an attacker to include a file, it can lead to sensitive information disclosure. CVE-2020-19360 https://vulners.com/cve/CVE-2020-19360 PoC To exploit vulnerability, someone could use...

CVE-2024-28752

Apache CXF CVE-2024-28752 Reproduction Environment Vulnerability Advisory: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Environment Startup samples/javafirstjaxwsfactorybean IDEA Start the webservice service via ServerStarter.java Build Use JDK8 root@kitploit: mvn clean...

HTB-Pterodactyl-Writeup

Penetration Test Report — HackTheBox: Pterodactyl Date: April 8, 2026 Target: Pterodactyl HackTheBox Difficulty: Medium OS: Linux openSUSE Leap 15.6 Tester: V0idW1re Executive Summary The Pterodactyl machine on HackTheBox presented a realistic attack scenario involving a misconfigured web...

gitlab-12.9.0-file-read

The warn For demonstration purpose and ethical hacking only. The what A wanted to be better script than what can be found on exploit-db about the authenticated arbitrary read file on GitLab v12.9.0 CVE-2020-10977 The how 1. Meet the dependency you probably already have the rest pip3 install...

CVE-2025-66516-POC

⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC...

LFI-FINDER

🍀 HERRAMIENTA DE BÚSQUEDA LFI 🍀 Escrito por TMRSWRR Versión 1.0.0 Instagram: TMRSWRR 📹 Cómo usar 📹 Haz clic en la imagen... LFI-FINDER es una herramienta de código abierto disponible en GitHub que se centra en detectar vulnerabilidades de inclusión de archivos locales LFI. La inclusión de archivo...

CVE-2021-43798

CVE-2021-43798 by Privacy Hunter Affected versions: Grafana 8.0.0-beta1 to 8.3.0 patched versions excluded Vulnerability type: Directory Traversal Severity: Critical Platform: Grafana open-source monitoring and observability platform ⚠️ Vulnerability details Directory traversal can be performed in...

LFI-to-RCE-SE-Suite-2.0

Remote Code Execution in SoftExpert Excellence Suite 2.0 - CVE-2023-30330 Authenticated Local File Inclusion to Remote Code Execution on SoftExpert Excellence Suite EQM. CVE-2023-30330 SE Suite 2.x versions before 2.1.3 Tested on versions: 2.0.15.31 and 2.0.15.115 LFI PoC...

-Grafana-LFI-CVE-2021-43798

🚀 Grafana LFI Exploit CVE-2021-43798 Automation script in Python 3 to exploit the Local File Inclusion LFI vulnerability in Grafana versions 8.0.0 to 8.3.0. This exploit allows directory traversal to read sensitive operating system files without authentication. ✨ Features Python 3.10+ compatibili...

CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel Unauthenticated RCE root@kitploit: / |\ \ / /| | | / | | | | || | / | || / | | \ V / | || / / | |/ / | | | | , /| || \ / / | / || /| //||/ || // ||/ /| Exploit for Pterodactyl Panel ≤ 1.11.10 - unauthenticated LFI to RCE. The Vulnerability The...

CVE-2024-24919

CVE-2024-24919 This project aims to create an automation to better study CVE-2024-24919. api.py : Collects possible vulnerable IPs. CVE-2024-24919.py : Performs brute force given the IP file and the directories file. worldListLFI.txt : List of Linux directories. Usage Clone this repository on you...

CVE-2021-41277

CVE-2021-41277 Metabase GeoJSON map local file inclusion Version: x.40.0-x.40.4 Usage : root@kitploit: chmod -x CVE-2021-41277.sh ./CVE-2021-41277.sh http://ip:port/ /etc/passwd References https://vulners.com/cve/CVE-2021-41277...

CVE-2017-12637_SAP-NetWeaver-URL-Traversal

CVE-2017-12637SAP-NetWeaver-URL-Traversal Proof-of-concept LFI Scanner: Automated detection of /etc/passwd exposures via directory traversal and regex matching. root@kitploit: LFI Scanner A lightweight Python proof-of-concept to scan target hosts for Local File Inclusion LFI vulnerabilities by...

CVE-2024-28995

CVE-2024-28995 Automated Path Traversal & Local File Read Features Version Detection : Retrieves the Serv-U version from the server header. Vulnerability Check : Compares the detected version against a known vulnerable version 15.4.2 or lower. Default Path Testing : Tests predefined paths for bot...

CVE-2022-44268

CVE-2022-44268 This repository contains a Proof of Concept POC for a vulnerability in ImageMagick v. 7.1.0-49, a widely used open-source image manipulation library. The vulnerability allows an attacker to embed the content of an arbitrary file into a resized image when ImageMagick parses a PNG...

svg-cheatsheet

SVG SSRF Cheatsheet Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols...