CVE-2025-24813

CVE-2025-24813 Apache Tomcat - Remote Code Execution via Session Deserialization Unauthenticated partial PUT + path traversal + gadget-driven deserialization Description Apache Tomcat instances with the default servlet PUT enabled readonly=false allow writing files via HTTP PUT requests. By...

CVE-2025-5880

Whistle 2.9.98 contains an unpatched path traversal vulnerability because the /cgi-bin/sessions/get-temp-file endpoint fails to adequately sanitize user input in the filename parameter. By supplying absolute paths or traversal sequences like /etc/passwd, an attacker can bypass directory...

CVE-2026-8713

CVE-2026-8713 — Avada Fusion Builder WordPress Exploit Pre-Auth Path Traversal → Arbitrary File Delete → Force Reinstall → RCE Overview CVE-2026-8713 is a CVSS 9.1 critical vulnerability in the Avada Fusion Builder plugin/theme for WordPress. The maybedeletefiles function in the FusionFormDBEntri...

CVE-2020-12640

CVE-2020-12640: Inclusión Local de Archivos PHP a través del "Valor del Plugin" en Roundcube Webmail Existe una vulnerabilidad de Path Traversal en versiones de Roundcube anteriores a 1.4.4, 1.3.11 y 1.2.10. Debido a que los parámetros "plugins " no realizan saneamiento/filtrado de entrada, un...

LabAutomationCVE-2021-43798

LabAutomationCVE-2021-43798 I make a script for pentest automation where i exploit CVE-2021-43798 a path traversal on Grafana to steal user secrets SSH key and then gain privileges on a Linux system using SUID. I automate this lab to share the pentest methodology...

CVE-2024-38821-POC

CVE-2024-38821: Prueba de Concepto PoC: Bypass de Autenticación en Spring Framework Esta es una prueba de concepto para la vulnerabilidad CVE-2024-38821 Pasos de Ejecución 1. Construir la imagen Docker Spring Boot 3.3.4, basado en Spring Framework 6.1.13 cd vuln docker build -t cve-2024-38821-poc...

CVE-2025-27237

CVE-2025-27237 Local privilege escalation vulnerability in Zabbix Agent/Agent2 for Windows via OpenSSL configuration file hijacking. Overview Field| Value ---|--- CVE ID| CVE-2025-27237 CVSS v4.0| 7.3 HIGH CWE| CWE-427: Uncontrolled Search Path Element Type| Local Privilege Escalation Vendor|...

CVE-2026-57830

Helix Ultimate Framework — Unauthenticated Path-Traversal Arbitrary File/Folder Read+Delete This is a confirmed DoS + cross-tenant filesystem access vulnerability, NOT RCE. An RCE-escalation theory delete configuration.php to re-expose the Joomla installer was tested live and disproved — see "RCE...

Exploit for CVE-2026-105221

abraxaslabs.tech · github.com/abraxas ·&...

Weblogic_Unauthorized-bypass-RCE

CVE-2020–14882 Bypass no autorizado RCE de Weblogic CVE-2020-14882 Script de prueba de bypass no autorizado RCE de Oracle Weblogic Funciona en Python3 Solicitudes POST /console/images/%252E%252E%252Fconsole.portal HTTP/1.1 Host: User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537....

CVE-2021-41773-PoC

CVE-2021-41773 Vulnerabilidad de path traversal y divulgación de archivos en Apache HTTP Server 2.4.49 Este script prueba Apache HTTP Server 2.4.49 Uso: CVE-2021-41773.py opciones Solo para una IP: python CVE-2021-41773.py IPaddress Opción -f Para lista de IPs en un archivo Ejemplo: python...

F5-BIG-IP

CVE-2020-5902 — F5 BIG-IP TMUI RCE Proof-of-Concept exploit for the critical path-traversal / remote code execution vulnerability in F5 BIG-IP's Traffic Management User Interface TMUI. ⚠️ For authorized penetration testing and security research only. Unauthorized use against systems you do not own...

CVE-2026-49049

CVE-2026-49049 Vulnerability Analysis: Unauthenticated Arbitrary File Write in JoomShaper Helix3 Joomla This repository contains materials, technical analysis, and a Proof of Concept PoC for the critical vulnerability CVE-2026-49049 found in the outdated template framework Helix3 by JoomShaper fo...

CVE-2025-8088-WinRAR-Zero-Day-Path-Traversal

CVE-2025-8088: Path Traversal de Día Cero de WinRAR — De Cero a Pwn 🗿 Introducción – El “Viejo Amigo” Acaba de Ser Descubierto Descuidado WinRAR — el clásico polvoriento que todos tienen instalado pero nadie actualiza — acaba de recibir un zero-day de alta severidad : CVE-2025-8088. Severidad: CV...

CVE-2025-8088

POC for CVE 2025-8088 WinRAR -o...

httpd-2.4.49

httpd-2.4.49 crítico: Recorrido de Rutas y Ejecución Remota de Código en Apache HTTP Server 2.4.49 y 2.4.50 solución incompleta de CVE-2021-41773 CVE-2021-42013...

CLEANSTART-2026-YE75739 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the temporal-server package. Previously, resolving relative paths containing parent directory '...

CLEANSTART-2026-IV86887 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...

Security vulnerability affects the rundeck package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...

CVE-2026-9290

CVE-2026-9290 — WP User Manager: exploit da LFI a RCE Path Traversal pre-autenticazione tramite il parametro 'tab' → Inclusione Locale di File Panoramica CVE-2026-9290 è una vulnerabilità di Local File Inclusion non autenticata ad alta severità CVSS 7.5 nel plugin WordPress WP User Manager – User...

LayarKacaSiber-CVE-2021-41773

CVE-2021-41773 - Apache HTTP Server 2.4.49 Cómo ejecutar el laboratorio CVE-2021-41773 - Path Traversal 1. Instale y ejecute Docker en su PC/Portátil 2. Clone este repositorio de GitHub 3. Vaya a la carpeta Path Traversal 4. Ingrese los siguientes comandos docker build -t...