CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile attraversamento del percorso Proof-of-concept eseguibili per riprodurre la stessa vulnerabilità Apache Camel, uno per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 +...

CVE-2025-60876

CVE-2025-60876: correzione dell'iniezione nel request-target di busybox wget Una correzione che preserva il comportamento per CVE-2025-60876, una vulnerabilità di iniezione di intestazioni HTTP in BusyBox wget, più la proof-of-concept che la dimostra e gli artefatti per inviare la correzione...

CVE-2026-102262 Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

CVE-2026-102262

Newell Brands DYMO ID version 1.5.1.71 is vulnerable to a path traversal issue due to improper spheres of control. The software resolves its plugin Modules directory relative to the process working directory. An attacker can place a malicious job file and DLLs in a directory, then set the process...

CVE-2026-105766

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2024-25293

MJML PoC zur lokalen Codeausführung Ein Proof-of-Concept für die Schwachstelle CVE-2024-25293. Es wurde festgestellt, dass mjml-app v3.0.4 & 3.1.0-beta eine Remote-Codeausführung RCE enthält. In diesem Repository befinden sich eine beispielhafte verwundbare Anwendung und ein...

CVE-2021-41773-Apache-2.4.49-

CVE-2021-41773-Apache-2.4.49- Penetrationstest 1.1. Path Traversal Lesen der Datei /etc/passwd !/bin/bash Script: exploitpathtraversal.sh Mục tiêu: Đọc tệp /etc/passwd từ Apache 2.4.49 TARGETIP="128.0.0.100" URL="http://$TARGETIP/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" echo "+ Khai thác Pat...

CVE-2026-59310

CVE-2026-59310 More echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1...

CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...

CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

ninja-form-exploit

ninja-form-exploit CVE-2026-0740 — Scanner di vulnerabilità multi-thread per il problema di path traversal nel caricamento file di Ninja Forms su WordPress. Descrizione main.py scansiona un elenco di target WordPress per determinare se il plugin Ninja Forms File Uploads è vulnerabile a...

CVE-2026-105683

The Ghost Node.js content management system is vulnerable to a path traversal vulnerability (CWE-35) in the ImageSize Service . Affected versions range from 6.14.0 until 6.27.0 . Due to an input validation issue, authenticated staff users could access local files outside of the intended data stor...

CVE-2026-105683 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

CVE-2026-105683 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

CVE-2026-105683 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

best-CVE-2025-8088

CVE-2025-8088 Exploit WinRAR 🔓 Un exploit proof-of-concept per la vulnerabilità di WinRAR CVE-2025-8088 che colpisce le versioni 7.12 e inferiori. Questo strumento crea un archivio RAR malevolo che incorpora payload in Alternate Data Streams ADS con path traversal, potenzialmente portando...

CVE-2026-90378

A flaw was found in the Linux kernel's mt76 wireless driver, specifically in the mt792x SDIO TX path. When the txprepareskb function fails to prepare a socket buffer skb for transmission, the skb is not properly released. This memory leak can lead to resource exhaustion, potentially causing a...

watchTowr-vs-SmarterMail-CVE-2025-52691

CVE-2025-52691 SmarterMail Pre-Auth RCE Strumento di generazione di artefatti di rilevamento per SmarterMail Pre-Auth RCE 1day Rilevamento in azione Il generatore di artefatti di rilevamento tenta di scrivere il file .aspx nella directory C:\Program Files...

CVE-2026-105676 Ghost: Path Traversal via Locale Setting

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...