140775 matches found
OnlyOffice-path-traversal
ONLYOFFICE Path Traversal Exploit CVE-2023-46988 đ Overview This script exploits a path traversal vulnerability in ONLYOFFICE Document Server CVE-2023-46988 that allows unauthorized users to copy arbitrary files from the server. The vulnerability exists in the /example/editor endpoint, where the...
cve-2021-42013.get
Apache 2.4.50 - Path Traversal or Remote Code Execution cve-2021-42013.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.50. Vulnerable instance of Docker is provided to get your hands dirty on CVE-2021-42013 If CGI-BIN is enabled...
cve-2021-42013L
cve-2021-42013 Apache 2.4.50 Path traversal vulnerability Follow Youtube Twitter Telegram Vulnmachines.com...
cve-2021-42013
Apache 2.4.50 - Path Traversal or Remote Code Execution cve-2021-42013.py is a python script that will help in finding Path Traversal or Remote Code Execution vulnerability in Apache 2.4.50. Vulnerable instance of Docker is provided to get your hands dirty on CVE-2021-42013 If CGI-BIN is enabled...
CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...
CVE-2026-106103
The Quasar Framework is vulnerable to a Path Traversal and Arbitrary File Write vulnerability in the @quasar/icongenie component prior to version 6.1.1 . The root cause is located in icongenie/lib/utils/get-assets-files.js and icongenie/lib/utils/validate-profile-object.js, where the icongenie ge...
CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...
CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...
CVE-2026-42048
CVE-2026-42048 CVE-2026-42048 Langflow Path Traversal / Arbitrary Directory Deletion PoC https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de Description CVE-2026-42048 : Langflow Arbitrary Directory Deletion Vulnerability description: A path traversal vulnerability in...
CVE-2025-47176
CVE-2025-47176 PoC Browser Bridge ĐĐŋиŅĐ°ĐŊиĐĩ ĐŅĐžŅ proof-of-concept PoC Đ´ĐĩĐŧĐžĐŊŅŅŅиŅŅĐĩŅ ŅиĐŧŅĐģŅŅиŅ ŅŅСвиĐŧĐžŅŅи CVE-2025-47176. ĐĐŊ вĐŊĐĩĐ´ŅŅĐĩŅ ŅĐēĐžĐŊŅŅŅŅиŅОваĐŊĐŊŅĐš ĐŋĐžŅŅОвŅĐš ŅĐģĐĩĐŧĐĩĐŊŅ в Outlook, ŅОдĐĩŅĐļĐ°ŅиК вŅĐĩĐ´ĐžĐŊĐžŅĐŊŅĐš ĐŋŅŅŅ ŅиĐŊŅ ŅĐžĐŊиСаŅии, ĐēĐžŅĐžŅŅĐš СаĐŋŅŅĐēĐ°ĐĩŅ Đ´ĐĩĐšŅŅвиĐĩ вО вŅĐĩĐŧŅ ŅĐēĐ°ĐŊиŅОваĐŊиŅ. ĐĐĐĐĐ: ĐŅĐžŅ PoC ŅиĐŧŅĐģиŅŅĐĩŅ...
GrafTraverse-CVE-2021-43798
GrafTraverse - CVE-2021-43798 MiNi Exploitation Framework Command-line automation tool for authorized security testing of Grafana Directory Traversal CVE-2021-43798. Overview CVE-2021-43798 is an unauthenticated directory traversal vulnerability in Grafana 8.x that allows attackers to read...
esm-lfi-poc
esm.sh LFI PoC packages authorized security research Two th...
CVE-2024-0204
CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive This repository contains a proof-of-concept exploit for the authentication bypass vulnerability CVE-2024-0204 discovered in Fortra's GoAnywhere MFT product. The vulnerability allows an unauthenticated attacker to create an...
CVE-2026-105856 Payload: SQL injection in SQLite/Postgres
Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operator...
Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities
Summary IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-14532 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a Reader-role attacker to obtain version information that causes an uncaught...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
CVE-2026-22356
CVE-2026-22356: Jetpack CRM Path Traversal Vulnerability and RCE Warning: This tool should only be used in authorized test environments. The user is solely responsible for illegal use. đĨ Requirements pip3 install requests urllib3 $ python3 exploit.py https://example.com --rce --cmd "id" + Target ...
GHSA-6GW6-RV2G-25MG Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
Impact When generating an API plugin manifest from an attacker-controlled or compromised OpenAPI description, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath into the manifest without validating that it is a safe package-relative file reference. An attacker can supply...
WordPress-Path-Traversal-CVE-2019-11447
Penetration Test Report WordPress Path Traversal - CVE-2019-11447 Document Information Item| Details ---|--- Document Title| Penetration Test Report - WordPress Path Traversal Client/Exam| HackTheBox Lab - CPTS Exercise 1 Date| August 22, 2026 Assessor| Fernando Viana Penetration Tester Assessmen...