CVE-2026-83742

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

CVE-2021-41773

CVE-2021-41773 — Apache 路径遍历与 RCE 利用 关于 TryHackMe "Modern Web Stacks" 房间的 writeup，重点利用 CVE-2021-41773 ，这是 Apache HTTP Server 2.4.49 中的一个路径遍历漏洞，当 modcgi 启用时可导致远程代码执行。 概述 项目| 详情 ---|--- 漏洞| CVE-2021-41773 — Apache 2.4.49 路径遍历 / RCE 目标服务| 端口 8080 上的 Apache HTTP Server 受影响版本| Apache/2.4.49 Unix 根因|...

spring4shell-local-verification-lab

Spring4Shell 本地影响条件验证、修复与复测项目 项目简介 本项目用于学习和验证 Spring Framework CVE-2022-22965，也就是 Spring4Shell 漏洞的影响条件、风险表现、修复方法和修复后复测流程。 项目在个人搭建的本地授权环境中完成。项目重点不是对真实目标进行攻击，而是通过搭建修复前和修复后的 Spring MVC 测试环境，逐项确认漏洞相关影响条件，并使用安全、可控的只读方式观察 Spring 数据绑定内部属性路径在版本升级前后的差异。 本项目完成了以下流程： JDK、Maven 和 Apache Tomcat 环境准备 Spring MV...

CVE-2025-63589

CVE-2025-63589 CMSimpleXH index.php 路径处理中的反射型 XSS 发现日期： 2025年10月6日 产品： CMSimpleXH（开源平面文件 CMS） 受影响版本： 1.8 CVE 编号： CVE-2025-63589 是否需要认证： 不需要（未认证） 攻击类型： 反射型跨站脚本（XSS） 估算 CVSS v3.1： AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1（中危） index.php 中的前端控制器接受动态路径段（用于路由到模板/页面），并将这些值传递给模板渲染。代码在将这些路径段插入到属性和锚点 href...

CVE-2026-83742 wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

CVE-2026-83742

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

CVE-2026-83742 wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms

Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...

CVE-2026-83742

The wolfSSL wolfSSH library (versions v1.4.11 through v1.5.0 ) is vulnerable on non-Windows platforms due to an unsigned integer underflow in the wstrncat() function within src/port.c. An authenticated remote attacker can trigger this by sending a crafted SFTP path to wolfSSH_RealPath() in src/ss...

DELMIA Apriso - Command Injection

An Improper Control of Generation of Code code injection / file upload → RCE vulnerability affecting DELMIA Apriso Release 2020 → Release 2025. When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place...

ZKTeco BioTime v8.5.5 - Path Traversal

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. id: CVE-2023-38950 info: name: ZKTeco BioTime v8.5.5 - Path Traversal author: iamnoooob,pdresearch severity: high description: | A pa...

Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

QNAP Photo Station - Path Traversal

QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. id: CVE-2019-7195 info: name: QNAP Photo Station - Path Traversal author: s4e-io severity: critical description: | QNAP devices running Pho...

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

Craft CMS - Remote Code Execution via Template Path Manipulation

This template identifies a critical Remote Code Execution RCE vulnerability in Craft CMS, identified as GHSA-2p6p-9rc9-62j9. The vulnerability exists due to improper handling of the --templatesPath query parameter, allowing attackers to execute arbitrary code by referencing malicious Twig...

CVE-2026-97671

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

CVE-2026-44011-poc

CVE-2026-44011: PoC de RCE autenticado en Craft CMS Este script de Python adapta el ataque descrito en el aviso de seguridad de Craft CMS. Un usuario autenticado de Craft puede alcanzar una ruta de configuración de diseño de campos vulnerable y provocar que el servidor ejecute comandos. Alcance y...

CVE-2025-56499

CVE-2025-56499 通过本地规则提供者中缺失的路径验证实现任意文件读取 上游修复：https://github.com/MetaCubeX/mihomo/pull/2177 受影响版本：mihomo = v1.19.11 摘要 在解析 rule-providers 配置时，type = "file" 分支未能对提供的路径进行验证。通过身份验证的攻击者控制 schema.Path 后，可以将提供者指向任何可读的本地文件。由于大多数任意文件不符合预期的规则格式，解析错误（包括大量文件内容片段）会引入内存日志，并通过 /logs API 暴露。由于 mihomo...

CVE-2025-52691

CVE-2025-52691 SmarterMail 未授权任意文件上传远程代码执行 概述 严重未授权任意文件上传，允许远程代码执行。 字段| 值 ---|--- 产品| SmarterMail 受影响版本| Build 9406 及更早 CVSS| 10.0（严重） 类型| 任意文件上传 攻击向量| HTTP（未授权） 影响| 远程代码执行 攻击流程 flowchart LR AAttacker -- B"Find Upload Endpoint" B -- C"/api/upload" C -- D"Upload ASPX Shell" D -- E"Path Traversal" ...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 测试环境与Nuclei模板 本仓库包含一个用于检测 CVE-2021-21980（vSphere Web Client 路径遍历）的高置信度 Nuclei 模板，以及一个模拟该漏洞行为的小型模拟环境，用于安全的本地测试。 文件： cve-2021-21980.yaml：包含多种编码变体和匹配器的 Nuclei 模板 app.py：模拟 /eam/vib 路径遍历漏洞的小型 Flask 应用 Dockerfile：带有自签名 TLS 证书的模拟服务器容器镜像 docker-compose.yml：运行模拟服务器，监听主...

CVE-2026-97671 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...