CVE-2025-48384-test

Командная строка воспроизведения root@kitploit: git clone --recursive https://github.com/beishanxueyuan/CVE-2025-48384-test.git Изменение указанного GitHub-репозитория root@kitploit: git init repo git -C repo -c protocol.file.allow=always submodule add...

CVE-2018-11776

Уязвимый docker-контейнер для CVE-2018-11776 root@kitploit: docker pull bhdresh/cve-2018-11776:1.0 docker run -dit -p :8080:8080 bhdresh/cve-2018-11776:1.0 PoC PoC - 1 root@kitploit: Request : http://:8080/struts2-showcase-2.3.14/$333+333/help.action Result :...

evilarc

evilarc Назначение evilarc позволяет создавать zip-файлы, содержащие файлы с символами обхода каталогов directory traversal в их встроенных путях. Большинство коммерческих программ для работы с архивами winzip и т.п. предотвращают извлечение zip-файлов, встроенные файлы которых содержат пути с...

CVE-2026-3288-lab

CVE-2026-3288 취약 실습 환경 Docker NGINX Ingress Controller 구성 주입 ⚠️ 경고 : 이 실습 환경은 공인된 보안 교육 목적으로만 의도적으로 취약하게 구성되어 있습니다. 취약점 개요 CVE-2026-3288 CVSS 8.8 높음 - NGINX Ingress Controller의 구성 주입 영향 버전 : v1.13.8, v1.14.4, v1.15.0 공격 벡터 : 경로 구성의 큰따옴표" 주입 영향 : 원격 코드 실행, 비밀 노출, 자격 증명 탈취 관련 취약점 : CVE-2026-24512 유사...

EUVD-2026-42742

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content...

Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability...

CVE-2024-32019_poc

Повышение привилегий через ndsudo локальный эксплойт Netdata Это альтернативный POC для эксплуатации уязвимой утилиты ndsudo, входящей в состав Netdata, с целью локального повышения привилегий. Эксплойт работает путём добавления скрипта в PATH пользователя, подменяя разрешённую команду nvme для...

cve-2024-32002-poc

💥 CVE-2024-32002 – PoC внедрения пути Git подмодуля Мотивация При решении машины Compiled на платформе Hack The Box я столкнулся с любопытным поведением, связанным с Git и подмодулями. При более глубоком исследовании я нашел эту отличную статью исследователя Амала Мурали, в которой подробно...

CVE-2026-31156

CVE-2026-31156 В OpenPLC-v3 существует уязвимость внедрения пути, которая возникает из-за того, что программа не выполняет никаких проверок допустимости параметров пути к файлу, передаваемых из командной строки. Злоумышленники могут читать любые доступные для чтения файлы, конструируя вредоносные...

llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection

CVE-2026-58116 — RCE в WebUI LLaMA-Factory через trustremotecode Доказательство концепции для CVE-2026-58116 CVSS 9.8 Critical: удалённое выполнение кода в LLaMA-Factory = v0.9.5. WebUI LLaMA-Factory жёстко задаёт trustremotecode=True при загрузке модели src/llamafactory/webui/chatter.py:139 и...

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

CVE-2026-77846

ash-project ash_sqlite versions from 0.1.2-rc.0 before 0.2.18 contain a JSON-path injection in AshSqlite.SqlImplementation. The json_extract path is built by concatenating "$." with Enum.join(right, "."), so a single get_path/2 segment containing ., [, ], or $ re-interprets the JSON path (e.g., "...

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path via the TagReference.create function in git/refs/tag.py. An attacker can read local files by supplying a positional reference val...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-5006

HashiCorp Vault and Vault Enterprise are vulnerable to privilege escalation via slash injection in templated policy paths . An authenticated attacker who can control an identity value referenced by a templated policy can embed / characters, which Vault interprets as additional path segments when ...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

PT-2026-79498

Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description Arc Enterprise's Raft FSM Finite State Machine in the applyRegisterFile function accepts attacker-chosen file paths in manifest-registration proposals without validating them against the...