CVE-2026-38093

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10 , contains a path traversal (CWE-22) vulnerability in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME value returned by ContentResolver.query() directly in file path const...

PT-2026-83128

file picker aka flutter file picker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAY NAME obtained from ContentResolver.query directly in file path construction without...

EUVD-2026-67771

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

VulnCheck KEV: CVE-2026-78003

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - Spring MVC and WebFlux applications tha...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

PT-2026-82871

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2025-6218_WinRAR

🧪 CVE-2025-6218: Path Traversal in WinRAR 📌 Descrizione Questo laboratorio dimostra come sfruttare la vulnerabilità CVE-2025-6218 nelle versioni vulnerabili di WinRAR per Windows. Questa vulnerabilità consente a un file .rar malizioso di sovrascrivere file al di fuori della directory di estrazion...

CVE-2023-50164-POC

Questo è un Proof of Concept PoC per CVE-2023-50164, che descrive una nuova vulnerabilità di path traversal che può portare a Remote Code Execution RCE in struts-core. Per risolvere il problema, si consiglia di aggiornare a Struts 2.5.33 o Struts 6.3.0.2 o versioni successive. Questo repository s...

CVE-2021-41773

CVE-2021-41773 exploit PoC con configurazione Docker. Portarsi nella directory contenente la configurazione Apache e il Dockerfile condivisi nel repository. Creazione dell'immagine: docker build -t cve-2021-41773:1.0 . Esecuzione dell'immagine Docker: docker run --rm -d -p 4444:80...

CVE-2020-3153

CVE-2020-3153 Codice POC per CVE-2020-3153 - vulnerabilità di path traversal in Cisco anyconnect Leggi di più sulla vulnerabilità qui: https://ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal/ Passaggi per ottenere una shell di Windows sul desktop con...

srikanth-lingala__zip4j_CVE-2018-1002202_1-3-2

zip4j Questo repository contiene il codice sorgente decompilato per le versioni 1.3.2 vulnerabile e 1.3.3 corretta della libreria zip4j per CVE-2018-1002202, per il dataset CWE-Bench-Java. Il repository zip4j originale su Github non include il codice di queste versioni. Versioni Versione 1.3.2...

CVE-2026-54083 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-54083

Wazuh is an open-source security platform (XDR/SIEM). The ip-customblock active response script contains a path traversal vulnerability: it concatenates the srcip field from alert JSON directly onto the /ipblock/ base directory without validating that the value is a well-formed IP address. Unlike...

CVE-2026-54083 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-9290

CVE-2026-9290 — WP User Manager: exploit da LFI a RCE Path Traversal pre-autenticazione tramite il parametro 'tab' → Inclusione Locale di File Panoramica CVE-2026-9290 è una vulnerabilità di Local File Inclusion non autenticata ad alta severità CVSS 7.5 nel plugin WordPress WP User Manager – User...

CVE-2026-8713

CVE-2026-8713 — Avada Fusion Builder Exploit per WordPress Path Traversal non autenticato → Eliminazione arbitraria di file → Reinstallazione forzata → RCE Panoramica CVE-2026-8713 è una vulnerabilità critica con CVSS 9.1 nel plugin/tema Avada Fusion Builder per WordPress. La funzione...

CVE-2025-1661

CVE-2025-1661 - Inclusione Locale di File LFI non autenticata in HUSKY – Products Filter Professional per WooCommerce Descrizione Il plugin HUSKY – Products Filter Professional for WooCommerce per WordPress è vulnerabile a Local File Inclusion LFI in tutte le versioni fino alla 1.3.6.5 inclusa...

CVE-2025-8088

CVE-2025-8088 : Vulnerabilità di Path Traversal in WinRAR tramite abuso di NTFS ADS 📌 Riepilogo Esecutivo CVE-2025-8088 è una vulnerabilità critica di path traversal in WinRAR versioni 7.12 e precedenti. Il difetto risiede nel modo in cui l'applicazione elabora i nomi dei file delle voci di...