Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

WordPress Core 5.0.0 - Crop-image Shell Upload

WordPress through 5.0.3 allows Path Traversal in wpcropimage. An attacker who has privileges to crop an image can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. i...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure

Webmin before 1.290 and Usermin before 1.220 contain a path traversal caused by calling the simplifypath function before decoding HTML, letting remote attackers read arbitrary files, exploit requires sending crafted '..%01' sequences. id: CVE-2006-3392 info: name: Webmin 1.290 / Usermin 1.220 -...

DELMIA Apriso - Command Injection

An Improper Control of Generation of Code code injection / file upload → RCE vulnerability affecting DELMIA Apriso Release 2020 → Release 2025. When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place...

CAREL Boss Mini <= 1.4.0 - Local File Inclusion

Boss Mini 1.4.0 Build 6221 contains a file inclusion caused by manipulation of the 'path' argument in boss/servlet/document, letting remote attackers include arbitrary files, exploit requires remote access. id: CVE-2023-3643 info: name: CAREL Boss Mini = 1.4.0 - Local File Inclusion author:...

LG LED Assistant - Thumbnail Path Traversal File Upload

A path traversal vulnerability exists in the endpoint handler for /api/thumbnail in Common.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed. id: CVE-2024-2863 info: name: LG LED Assistant - Thumbnail...

Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

CVE-2025-4517-poc

CVE-2025-4517 PoC – Python tarfile 路径遍历导致的任意文件写入 CVE-2025-4517 （CVSS 9.4 – 严重） Python 的 tarfile 模块存在一个漏洞，当使用 TarFile.extractall 或 TarFile.extract 并设置 filter="data" 或 filter="tar" 时，允许在解压目录之外进行任意文件写入。 受影响版本 ： Python 3.12+（当显式使用 filter="data" 或 filter="tar" 时） Python 3.14+（当依赖新的默认 filter="data" 时）...

POC_CVE-2024-4322

CVE-2024-4322: PoC de LoLLMS WebUI y laboratorio de validación con Nuclei Este repositorio proporciona laboratorios locales Dockerizados para reproducir CVE-2024-4322 , una vulnerabilidad de path traversal en LoLLMS WebUI v9.6, y para validar que la plantilla de Nuclei asociada no coincide con...

CVE-2020-3452-Cisco-Python-Scanner

CVE-2020-3452 扫描器 一个安全且非破坏性的 Python 扫描器，用于检测 Cisco ASA / FTD WebVPN 目录遍历漏洞 CVE-2020-3452 。 CVE-2020-3452 是一个严重的未认证路径遍历漏洞，允许远程攻击者在 Cisco ASA 或 FTD 设备上读取任意文件。 概述 该工具通过利用 WebVPN 翻译表端点中的目录遍历缺陷，测试攻击者是否能在未认证的情况下读取敏感文件（如门户页面、脚本及配置相关文件）。 注意 ：此脚本仅执行 GET 请求，不 尝试利用漏洞或写入任何数据。 漏洞详情 CVE ID : CVE-2020-3452 严重性 ...

HackTheBox-Facts

HTB Facts — Guía completa Dificultad: Media SO: Linux Etiquetas: Web, MinIO, Camaleon CMS, Path Traversal, SSTI, Escalada de Privilegios Tabla de Contenidos 1. Reconocimiento 2. Enumeración Web — Puerto 80 3. Descubrimiento de MinIO — Puerto 54321 4. Camaleon CMS — Acceso de Administrador 5...

CVE-2026-18386 WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backupfile' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

Grafana-Password-Decryptor

Grafana 密码解密工具 用于从多种格式解密和破解 Grafana 密码的 Python 工具包。 代码作者：strikoder 该工具能做什么？ 处理 两种类型 的 Grafana 密码存储： 🔐 AES-256 Base64 （datasource 表）→ 使用 AESDecrypt.py 直接解密 🔨 PBKDF2HMACSHA256 （user 表）→ 使用 grafana2hashcat.py 转换为 Hashcat 格式 完美适用于 CVE-2021-43798 路径遍历漏洞的后利用阶段。 什么是 CVE-2021-43798？ 一个存在于 Grafana...

CVE-2026-39813

🛡️ CVE-2026-39813 - Vulnerabilidad de Path Traversal en Fortinet FortiSandbox 📌 Descripción General CVE-2026-39813 es una vulnerabilidad crítica de path traversal que afecta a Fortinet FortiSandbox. La vulnerabilidad se debe a una validación incorrecta de las rutas de archivo proporcionadas por el...

CLEANSTART-2026-OB24504 Previously, resolving relative paths containing parent directory ('

Multiple security vulnerabilities affect the kube-state-metrics package. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-WZ31386 Previously, resolving relative paths containing parent directory ('

Multiple security vulnerabilities affect the ingress-nginx-controller package. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CVE-2026-26336-PoC

CVE-2026-26336 — Lectura de archivos no autenticada en Alfresco Share Resumen Alfresco Share expone un endpoint /share/page/resource/ utilizado para servir recursos estáticos. En versiones vulnerables, este endpoint no restringe adecuadamente el path traversal, lo que permite a un atacante no...

cve-2026-39440-funnelforms-fix

Corrección CVE-2026-39440 FunnelForms Un plugin de WordPress de instalación directa que bloquea el controlador de importación de demostraciones vulnerable en FunnelForms Pro ≤ 3.8.1 para mitigar la Ejecución Remota de Código CVE-2026-39440, CVSS 9.9. La Vulnerabilidad...

CVE-2026-5027

CVE-2026-5027 - Path Traversal a Ejecución Remota de Código en Langflow Descripción Las versiones de Langflow hasta la 1.8.4 inclusive no sanean el parámetro filename en el endpoint POST /api/v2/files. Un atacante puede usar secuencias de path traversal ../ para escribir archivos en ubicaciones...