CVE-2020-1938

CVE-2020-1938 Questa CVE-2020-1938 corregge l'errore del PoC di https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat.git e ne ha verificato il funzionamento con Apache Tomcat/8.0.43. Metodo di esercitazione 1. Creare docker-compose.yml 2. docker compose up -d 3. python3...

cve-2022-44268

CVE-2022-44268 ImageMagick è una suite software gratuita e open-source multipiattaforma per visualizzare, convertire e modificare immagini raster e vettoriali. Può leggere e scrivere oltre 200 formati di file immagine. ImageMagick è rilasciato sotto licenza Apache 2.0. È disponibile sotto forma d...

CVE-2021-43798

CVE-2021-43798 by Privacy Hunter प्रभावित संस्करण: Grafana 8.0.0-beta1 से 8.3.0 तक पैच किए गए संस्करणों को छोड़कर कमजोरी का प्रकार: Directory Traversal निर्देशिका में भ्रमण प्रभाव स्तर: अत्यंत खतरनाक Critical प्लेटफ़ॉर्म: Grafana ओपन-सोर्स मॉनिटरिंग और ऑब्ज़र्वेबिलिटी प्लेटफ़ॉर्म ⚠️ कमजोरी का विवर...

CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability

CVE-2025-68645 — LFI della Classic UI di Zimbra Defender Pack Questo repository è un pacchetto di riferimento orientato ai difensori per CVE-2025-68645 , un problema di Local File Inclusion LFI in Zimbra Collaboration ZCS 10.0.x e 10.1.x Classic Webmail UI causato da una gestione impropria dei...

CVE-2025-12137

1 Helper per chiamare l'API REST del plugin con il nonce corrente root@kitploit: async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path, method...

CVE_2026_7515

CVE20267515 CVE-2026-7515: BetterDocs Pro = 3.8.0 - Nicht authentifizierte Local File Inclusion zu RCE-Exploit...

Elastix-2.2.0-CVE-2012-4869

Elastix 2.2.0 Local-File-Inclusion-Exploit - CVE-2012-4869 Beschreibung Dieses Skript nutzt eine Local File Inclusion LFI-Schwachstelle in Elastix 2.2.0 aus, die Remote-Codeausführung RCE ermöglicht, indem Befehle über den callmepage.php -Endpunkt eingeschleust werden. Der Exploit basiert auf...

CVE-2025-60574

Scopritori di vulnerabilità e autori di exploit Stefano Andreatta & Jacopo Candido Augelli CVE-2025-60574 Descrizione della vulnerabilità Una vulnerabilità di Local File Inclusion LFI è stata identificata in tQuadra CMS 4.2.1117. Il problema esiste nel percorso "/styles/", che non riesce a...

CVE-2025-11973

Auslöser: /etc/passwd über file:// auslesen und in Uploads exfiltrieren root@kitploit: curl -sS -A "$UA" -X POST "$BASE/?kdsflag=post" \ --data-urlencode "kdspassword=$SECRET" \ --data-urlencode "posttitle=sub1-lfi" \ --data-urlencode "kdsfeatureurl=file:///etc/passwd" Exfiltrierte Datei abrufen...

CVE-2024-24919

CVE-2024-24919 يهدف هذا المشروع إلى إنشاء أتمتة لدراسة ثغرة CVE-2024-24919 بشكل أفضل. api.py : يجمع عناوين IP المحتملة المعرّضة للثغرة. CVE-2024-24919.py : يقوم بالهجوم بالقوة الغاشمة باستخدام ملف عناوين IP وملف الدلائل. worldListLFI.txt : قائمة بدلائل نظام لينكس. الاستخدام استنسخ هذا المستودع عل...

CVE-2025-2294

CVE-2025-2294 परिचय CVE-2025-2294 — WordPress के लिए Kubio AI Page Builder प्लगइन में Local File Inclusion LFI प्रकार की एक गंभीर भेद्यता है। यह भेद्यता अप्रमाणित unauthenticated दूरस्थ हमलावर को एक विशेष रूप से तैयार पैरामीटर भेजने की अनुमति देती है, जिससे प्लगइन सर्वर पर किसी मनमानी फ़ाइल को...

apache_2.4.50

Apache HTTP Server 2.4.50 LFI & RCE Uno script python3 per CVE-2021-42013 - Apache HTTP Server 2.4.50 LFI & RCE. RCE richiede che cgi-bin sia abilitato Per Iniziare Esecuzione del programma LFI root@kitploit: python3 apache2.4.50.py -t http://apache.hack/ -lfi /etc/passwd RCE root@kitploit: pytho...

CVE-2019-5418

CVE-2019-5418: Ruby on Rails Path Traversal & beliebiges Dateilesen Dieses Projekt ist eine Umgebung zum Üben und Reproduzieren der Local File Inclusion-Schwachstelle CVE-2019-5418 in Ruby on Rails. Die Schwachstelle ermöglicht es, durch Path Traversal über den Accept-Header beliebige Dateien im...

ghostcat

Ghostcat - CVE-2020-1938 Exploit Liest Tomcat-Dateien über den AJP-Connector Port 8009 Verwendung: python3 ghostcat.py Datei """ Skript speichern cat ghostcat.py 'PYEOF' AQUÍ VA EL CÓDIGO COMPLETO DE ARRIBA PYEOF Berechtigungen erteilen und ausführen chmod +x ghostcat.py tomcat-users.xml lesen...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Übersicht Dieses Repository enthält einen Proof-of-Concept PoC-Exploit für CVE-2022-46364 , eine Local File Inclusion LFI-Sicherheitslücke in Apache CXF. Die Sicherheitslücke entsteht durch unsachgemäße Handhabung von XOP XML-binary Optimized Packaging...

liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...

CVE-2023-26563-26564-26565

Il vendor ha apparentemente risolto tutte le vulnerabilità dettagliate a partire dalle versioni rilasciate dopo il 2024. Ruptura InfoSecurity non ha verificato che queste correzioni siano complete. Vedere i commenti del vendor su...

CVE-2021-41773

Scanner CVE-2021-41773 Este script testa a vulnerabilidade de path traversal e inclusão local de arquivos no Apache versão 2.4.29. Este script não retorna arquivos locais, apenas verifica o servidor web e informa se ele é vulnerável ou não. Uso: python3 cve-2021-41773-scanner.py Endereço IPv4...

CVE-2026-63179

Winter CMS (a Laravel-based PHP content management system) versions up to and including 1.2.12 allow authenticated backend users to disclose arbitrary files readable by the PHP process. The root cause is that the LESS parser (via the wikimedia/less.php integration in Winter Storm) was instantiate...

CVE-2026-63179 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...