221 matches found
CVE-2025-24813-POC
JSP Web Shell Uploader A simple Python tool for uploading a basic JSP web shell to one or more targets via HTTP PUT requests. ⚠️ For educational and authorized penetration testing only. Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../...
CVE-Arsenal-Lab
TomcatScanner Advanced Detection and Exploitation Tool for CVE-2025-24813 TomcatScanner is a comprehensive security tool designed for detecting and exploiting the CVE-2025-24813 vulnerability in Apache Tomcat servers. This vulnerability involves a path equivalence issue in the 'file.Name' paramet...
CVE-2025-24813
CVE-2025-24813 - Apache Tomcat Path Equivalence Vulnerability Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../ sequences in paths. CVE ID: CVE-2025-24813 Severity: Critical Reference link: https://github.com/advisories/GHSA-83qj-6fr2-vhqg Po...
nuclei-CVE-2025-24813
nuclei-CVE-2025-24813 This repository contains a yaml-template, to scan whether a Service may be vulnerable to CVE-2025-24813, without disrupting the server/causing any form of damage, using the vulnerability scanner nuclei. CVE-2025-24813 CVE-2025-24813 is a vulnerability in the Apache Tomcat...
GHSA-XHQ7-XMQJ-769H fast-uri vulnerable to improper path equivalence in relative reference normalization
Impact fast-uri's normalize and serialize apply RFC 3986 dot-segment removal removedotsegments to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it...
fast-uri vulnerable to improper path equivalence in relative reference normalization
Impact fast-uri's normalize and serialize apply RFC 3986 dot-segment removal removedotsegments to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it...
npm: fast-uri vulnerable to improper path equivalence in relative reference normalization
npm: fast-uri vulnerable to improper path equivalence in relative reference normalization vulnerability discovered by ? in WordPress npm fast-uri versions 2.4.8...
Path Equivalence
Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize / normalize functions, which incorrectly applied RFC 3986 removedotsegments to relative-path references. That algorithm is defined only for merged...
Path Equivalence
Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize / normalize functions, which incorrectly applied RFC 3986 removedotsegments to relative-path references. That algorithm is defined onl...
Path Equivalence
Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize, normalize, and resolve functions when called with the non-default option reference: 'suffix' on a reference that has no authority. A bare colon in th...
Path Equivalence
Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize, normalize, and resolve functions when called with the non-default option reference: 'suffix' on a reference that has no authority. A...
CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...
CVE-2026-110095
The fast-uri Node.js URI parser and serializer is vulnerable to an improper path equivalence issue in versions before 2.4.8 , 3.0.0 through 3.1.8 , and 4.0.0 through 4.2.2 . The normalize() and serialize() functions incorrectly apply RFC 3986 dot-segment removal to relative-path references before...
CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...
CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize and serialize functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that...
Astra Linux – Vulnerability in Tomcat9
Path Equivalence: The use of ‘file.Name’ an internal dot notation can lead to Remote Code Execution, information disclosure, or the addition of malicious content to uploaded files via the write-enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-...
CVE-2026-88136
Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network...
CVE-2026-70184
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally...