Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, whi...

skype-log-viewer

skype-log-viewer Skype 없이 Skype 기록 다운로드 및 보기 이 프로그램을 사용하면 모든 Skype 채팅 로그를 보고 쉽게 텍스트 파일로 내보낼 수 있습니다. 대화별로 올바르게 정리하며, 그룹 대화가 1:1 채팅과 섞이지 않도록 합니다. 기능 Skype 로그 다운로드 손상된 데이터베이스 지원 내보내기 형식 변경 Skype에서 대화별로 정리 코드 라이선스 GNU GPL v2 콘텐츠 라이선스 Creative Commons 3.0 BY-SA 행동 강령 모든 사람을 존중하십시오...

CVE-2026-67599_ClearOS_RCE

Log Viewer のフィルターパラメータにおける OS コマンドインジェクション パッケージ: ClearFoundation テスト済みバージョン: ClearOS 7.9.1.342252 脆弱性タイプ: OS コマンドインジェクション CWE-78 重大度: 高 CVE : CVE-2026-67599 CVSS v3.1 ベクター: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H スコア: 7.2 この CVE-2026-67599 の割り当てと追跡を支援してくれた VulnCheck に感謝します。 製品説明 ClearOS...

simvyn

simvyn Strumento mobile universale — controlla simulatori iOS, emulatori Android e dispositivi reali da un'unica dashboard e CLI Avvio rapidobash npx simvyn root@kitploit: Avvia il server locale, apre la dashboard web nel tuo browser e scopre automaticamente tutti i simulatori, emulatori e...

CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 Descrizione Il plugin Error Log Viewer By WP Guru per WordPress è vulnerabile alla Lettura Arbitraria di File in tutte le versioni fino alla 1.0.1.3 inclusa tramite l'azione AJAX wpajaxnoprivelvwplogdownload. Ciò consente ad attaccanti non autenticati di leggere il contenuto ...

CVE-2021-21234

CVE-2021-21234 Vulnerabilità di directory traversal nella libreria spring-boot-actuator-logview https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer di WP Guru = 1.0.1.3 - Autorizzazione mancante per la lettura arbitraria di file senza autenticazione Descrizione Il plugin Error Log Viewer di WP Guru per WordPress è vulnerabile alla lettura arbitraria di file in tutte le versioni fino alla 1.0.1.3 inclusa, trami...

CVE-2026-64967 Path Traversal in ATutor

A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process. Product is...

CVE-2026-64967

ATutor's error log viewer contains a path traversal flaw allowing an admin to read arbitrary files outside the logs directory. Version 2.2.4 is confirmed vulnerable; the product is no longer supported and no fix exists, so migration to a maintained alternative is the only remediation. Exploitatio...

VulnCheck KEV: CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

CVE-2026-67599

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...

CVE-2026-67599 ClearOS 7.9 OS Command Injection via Log Viewer filter parameter

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...

EUVD-2026-52409

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can...

CVE-2026-67599

Summary of technical details (CVE-2026-67599, ClearOS 7.9) : An OS command injection vulnerability exists in the Log Viewer endpoint used by the webconfig user. The vulnerability stems from the filter parameter being unsafely interpolated into a shell command in File.php, allowing command substit...

Exploit for CVE-2026-67599

OS Command Injection in Log Viewer Filter Parameter Package...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-61501

Rejetto HFS versions 3.0.0–3.2.0 expose a stored XSS in the admin log viewer: log entries rendered as HTML without sanitization allow a remote unauthenticated attacker to craft a username, write JavaScript to the error log, and execute code in an administrator’s browser when logs are viewed, pote...

CVE-2026-61501 Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs ar...