CVE-2025-4123

Grafana CVE-2025-4123 익스플로잇 CVE ID: CVE-2025-4123 심각도: High 영향: Server-Side Request Forgery SSRF, Cross-Site Scripting 영향을 받는 버전: Grafana 11.2, Grafana 11.3, Grafana 11.4, Grafana 11.5, Grafana 11.6, Grafana 12.0 전체 글 Writeup root@kitploit: ❯ sudo python server.py --host http://127.0.0.1 + Using...

CVE-2026-82426

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-82427

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-57129

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser.processfilemention accepts file-mention values and falls back from workspace-relative resolution to Pathfilepath without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or...

CVE-2020-5902

요약 BIG-IP 버전 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 및 11.6.1-11.6.5.1에서 Traffic Management User InterfaceTMUI, 구성 유틸리티라고도 함에 공개되지 않은 페이지에서 원격 코드 실행RCE 취약점이 존재합니다. 크레딧: Positive Technologies의 Mikhail Klyuchnikov 개념 증명 root@kitploit:...

CVE-2026-57145

CVE-2026-57145 affects PraisonAI , an AI multi-agent framework. The multiedit tool in src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open() for reading and writing without path traversal rejection, symlink resolution, workspace boundary validat...

EUVD-2026-77595

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks...

CVE-2026-57145 PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks...

CVE-2021-43798

CVE-2021-43798 Grafana 8.x: Обход пути без аутентификации Вся заслуга принадлежит j0v и его твиту https://twitter.com/j0v0x0/status/1466845212626542607 Отказ от ответственности Это только для образовательных целей. Я не несу ответственности за ваши действия. Используйте на свой страх и риск...

CVE-2026-56839 PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODETOOLS wrappers keep workspaceroot as None and pass workspace=None to readfile, searchreplace, and applydiff helpers that enforce path containment only for a truthy workspace. An application that exposes codereadfile,...

CVE-2026-56839

PraisonAI (Python package praisonai), a multi-agent LLM framework, is affected by a fail-open workspace boundary in its CODE_TOOLS wrappers. Prior to 4.6.59 , the global variable _workspace_root defaults to None, and the lower-level helpers (read_file, search_replace, apply_diff) only enforce pat...

CVE-2026-56839 PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODETOOLS wrappers keep workspaceroot as None and pass workspace=None to readfile, searchreplace, and applydiff helpers that enforce path containment only for a truthy workspace. An application that exposes codereadfile,...

CVE-2024-23334

CVE-2024-23334 Aiohttp = !IMPORTANT 이 스크립트는 교육 목적으로만 제공됩니다. 불법적인 사용은 엄격히 금지됩니다. 실행 방법 root@kitploit: $ git clone https://github.com/wizarddos/CVE-2024-23334 $ cd CVE-2024-23334 $ python3 exploit.py -u url -f file -d static directory !Note URL과 static 디렉터리의 슬래시를 일치시키는 것을 잊지 마세요. http://127.0.0.1/처...

CVE-2026-57119 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...

CVE-2026-57119 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...

CVE-2026-57129

PraisonAI (praisonaiagents Python package) is vulnerable to arbitrary file read via the MentionsParser._process_file_mention function in mentions.py. When an @file: mention path is not found relative to the workspace, the code falls back to Path(file_path) without traversal, symlink, or workspace...

EUVD-2026-77543

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser.processfilemention accepts file-mention values and falls back from workspace-relative resolution to Pathfilepath without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or...

CVE-2026-57129 PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser.processfilemention accepts file-mention values and falls back from workspace-relative resolution to Pathfilepath without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or...

CVE-2024-9047-Exploit

CVE-2024-9047: WordPress File Upload 플러그인용 익스플로잇 설명 WordPress File Upload 플러그인은 4.24.11 이하의 모든 버전에서 wfufiledownloader.php 파일을 통해 경로 탐색Path Traversal 취약점에 노출됩니다. 이 취약점으로 인해 인증되지 않은 공격자가 의도된 디렉터리 외부의 파일을 읽거나 삭제할 수 있습니다. 성공적인 악용을 위해서는 대상 WordPress 설치 환경이 PHP 7.4 이하 에서 실행되고 있어야 합니다. 영향 심각도: 치명적 CVSS...

CVE-2021-41773_CVE-2021-42013_Exploits

CVE-2021-41773 및 CVE-2021-42013 악용 개요 이 저장소는 Apache HTTPD의 두 가지 취약점인 CVE-2021-41773과 CVE-2021-42013을 악용하는 데 중점을 둡니다. 이 CVE는 Apache HTTPD 서버에서 파일 매핑file mapping 및 원격 코드 실행remote code execution으로 이어질 수 있는 경로 탐색path traversal 취약점을 나타냅니다. 이러한 CVE에 대한 심층 정보근본적인 결함, 취약한 구성, 악용 방법 등를 보려면 다음 종합 블로그 게시물을...