Landray EKP - Path Traversal

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sysuicomponent/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to...

Spring Framework Path Traversal in Functional Web Frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

EKC Tournament Manager WordPress plugin - Path Traversal

EKC Tournament Manager WordPress plugin 2.2.2 contains a path traversal caused by insufficient validation, letting logged in admin users download system files outside the WordPress directory. id: CVE-2024-9765 info: name: EKC Tournament Manager WordPress plugin - Path Traversal author: Sourabh-Sa...

Devika v1 - Path Traversal

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

Oracle Business Intelligence - Path Traversal

Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...

FastAdmin < V1.3.4.20220530 - Path Traversal

A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploi...

Apache OFBiz - Directory Traversal & Remote Code Execution

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue. id: CVE-2024-36104 info: name: Apache OFBiz - Directory...

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

Camaleon CMS < 2.8.1 Arbitrary File Write to RCE

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a remote...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

ionCube Tester Plus <= 1.3 - Local File Inclusion

The ionCube Tester Plus plugin for WordPress versions = 1.3 is vulnerable to unauthenticated arbitrary file read via path traversal. The 'ininame' parameter in loader-wizard.php is not properly sanitized, allowing attackers to read sensitive files such as wp-config.php and /etc/passwd without...

routeros-CVE-2018-14847-bytheway

By the Way By the Way is an exploit that enables a root shell on Mikrotik devices running RouterOS versions: Longterm: 6.30.1 - 6.40.7 Stable: 6.29 - 6.42.0 Beta: 6.29rc1 - 6.43rc3 The exploit leverages the path traversal vulnerability CVE-2018-14847 to extract the admin password and create an...

CVE-2023-31059-Repetier-Server-1.4.10-Unauthenticated-Path-Traversal

Repetier-Server = 1.4.10 Author: Mohammed Idrees Banyamer Role: Security Researcher Country: Jordan 🇯🇴 Overview Proof‑of‑concept exploit for an unauthenticated remote path traversal / LFI vulnerability in Repetier‑Server ≤ 1.4.10. The vulnerability allows arbitrary file read via crafted ..%5c...

CVE-2021-41773---Apache-Path-Traversal---RCE

CVE-2021-41773 — Apache Path Traversal & RCE Internship Task: ITSOLERA PVT LTD — Offensive Security Intern: Areeba Zehra Jafri Team Lead: Muhammad Ahsan Ayaz Date: March 18, 2026 Overview Research and exploitation of CVE-2021-41773 — Path Traversal and Remote Code Execution vulnerability in Apach...

CVE-2024-53677-Analysis

CVE-2024-53677 Analysis This repository contains documentation and lab artifacts prepared for analyzing CVE-2024-53677 in Apache Struts. Overview CVE-2024-53677 is a vulnerability in Apache Struts file upload handling. The issue occurs when filename-related metadata from the legacy...

CVE-2025-8088

CVE-2025-8088 : WinRAR Path Traversal via NTFS ADS Abuse 📌 Executive Summary CVE-2025-8088 is a critical path traversal vulnerability in WinRAR versions 7.12 and prior. The flaw exists in the way the application processes archive entry filenames that utilize NTFS Alternate Data Streams ADS. By...

CVE-2025-8088-WinRAR-PathTraversal-PoC

CVE-2025-8088 WinRAR Path Traversal Exploit PoC A Proof-of-Concept exploit demonstrating the WinRAR path traversal vulnerability CVE-2025-8088 affecting versions ≤ 7.12. Vulnerability Details CVE ID : CVE-2025-8088 CVSS Score : 8.4 High Affected Versions : WinRAR ≤ 7.12 Patch Version : Fixed in...

CVE-2024-2044

PoC CVE-2024-2044: pgAdmin 4 Authenticated RCE Linux/POSIX Repositori ini berisi skrip Proof of Concept PoC untuk CVE-2024-2044 , sebuah kerentanan kritis yang menggabungkan Authenticated Path Traversal dan Unsafe Deserialization pada pgAdmin 4 versi 8.3 ke bawah yang berjalan di lingkungan...

cve-2025-8088

CVE-2025-8088: WinRAR Path Traversal Detection Overview This repository documents research and detection strategies for CVE-2025-8088, a path traversal vulnerability in WinRAR. Exploitation of this vulnerability can allow attackers to extract files outside the intended directory, leading to...