CVE-2019-5418

CVE-2019-5418 1. Descripción de la vulnerabilidad Ruby on Rails es un framework de aplicaciones web, relativamente nuevo, construido sobre el lenguaje Ruby. Esta vulnerabilidad se debe principalmente a que Ruby on Rails utiliza el parámetro render file para renderizar vistas fuera de la...

CVE-2021-43798

CVE-2021-43798 Grafana-Lectura-Arbitraria-de-Archivos 8.0.0 8.3.0 Una vulnerabilidad en Grafana CVE-2021-43798 versiones 8.0.0 8.3.0 que permite a un atacante no autenticado leer archivos arbitrarios del servidor aprovechando un path traversal dirigido a la ruta /public/plugins/ para acceder a...

dirsearch

dirsearch - Descubrimiento de rutas web Un avanzado brute-forcer de rutas web dirsearch está siendo desarrollado activamente por @maurosoria y @shelld3v. Únete al servidor de Discord para comunicarte con el equipo. Inicio rápido dirsearch requiere Python 3.11 o superior. git clone...

BloodHound-Tools

¿Qué es esto? Una colección de herramientas que se integran con BloodHound. Bloodhound es el estándar de facto que tanto los equipos de seguridad azules como rojos utilizan para encontrar rutas de movimiento lateral y escalado de privilegios que potencialmente podrían ser explotadas en un entorno...

CVE-2021-3019

CVE-2021-3019 Recorrido de Directorios en LanProxy Lanproxy es una herramienta de penetración de intranet que hace de proxy de los ordenadores personales y servidores de la LAN hacia la red pública. Soporta el reenvío de tráfico tcp y cualquier protocolo de capa superior de tcp acceso a sitios we...

CVE-2025-27210_NodeJS_Path_Traversal_Exploit

CVE-2025-27210NodeJSPathTraversalExploiter Prueba de concepto CVE-2025-27210, una vulnerabilidad precisa de Path Traversal que afecta a aplicaciones Node.js que se ejecutan en Microsoft Windows. Esta vulnerabilidad aprovecha la forma específica en que Windows maneja los nombres de archivo de...

CVE-2025-31486-PoC

Disclaimer: The vulnerabilities described in this article and their reproduction steps are intended solely for cybersecurity research and educational purposes. No one may use the information provided herein for illegal purposes or unauthorized system testing. The author assumes no responsibility...

NimbusPWN-CVE-2022-29799-29800

NimbusPwn — networkd-dispatcher !NOTE Otras distribuciones:...

CVE-2021-42013-Apache-RCE-Poc-Exp

Vulnerability Name Apache Remote Code Execution CVE-2021-42013 Vulnerability Description Apache HTTP Server is an open-source web server from the Apache Software Foundation. It is fast, reliable, and extensible via a simple API. It was discovered that the fix for CVE-2021-41773 in Apache HTTP...

CS4277-CVE-Path-Traversal-Apache-HTTP-Server

CS4277-CVE-Path-Traversal-Apache-HTTP-Server Team Members: Emily Nguyen, Jonathan Kim, Joon Jang Project Topic Selection: Project 1: Recreate and Exploit a Real-World CVE: Path Traversal CVE-2021-41773 in the Apache HTTP Server. Project Goal: We hope to reproduce CVE-2021-41773 to deepen our...

PoC-CVE-2025-52913

CVE-2025-52913 - MiCollab Path Normalization Vulnerability 📌 Overview This repository contains a Proof of Concept PoC for CVE-2025-52913 , a path normalization vulnerability affecting Mitel MiCollab. The issue allows unauthenticated attackers to bypass intended path restrictions by leveraging...

Blackash-CVE-2025-31131

Blackash-CVE-2025-31131 CVE-2025-31131 - YesWiki 4.5.2 Exploit de Path Traversal Descripción YesWiki es un sistema wiki escrito en PHP. El parámetro squelette es vulnerable a ataques de path traversal, lo que permite el acceso de lectura a archivos arbitrarios del servidor. Esta vulnerabilidad es...

The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in improper restrictions on path names to the catalog. This allows attackers to gain unauthorized access to local files and directories.

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in incorrect restrictions on the path to the catalog. Exploiting this vulnerability can allow an attacker to gain unauthorized access to local files and directories on the server...

The vulnerability of the FOQUZ platform, related to incorrect restrictions on the name of the path to the catalog, allows attackers to compromise the integrity of the protected information.

The vulnerability of the FOQUZ platform is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of the FOQUZ platform, related to incorrect restrictions on path names in the catalog, allows attackers to compromise the accessibility of protected information.

The vulnerability of the FOQUZ platform is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability could allow a malicious actor to compromise the accessibility of the protected information...

The vulnerability of the iFlightDoc onboard documentation system, related to incorrect restrictions on the path name to the catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the iFlightDoc onboard documentation system is related to an incorrect limitation on the name of the path to the catalog h. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK” arises from incorrect restrictions on the path name to the catalog, allowing a intruder to write arbitrary files.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

CVE-2025-47273-POC

setuptools Recorrido de Rutas CVE-2025-47273 📖 Resumen Exploit de prueba de concepto para una vulnerabilidad de recorrido de rutas en Python setuptools 78.1.1. Al abusar de la función downloadurl del componente PackageIndex, un atacante puede escribir archivos arbitrarios en cualquier ubicación d...

SourceLeakHacker

Descripción SourceLeakHacker es un escáner de directorios web multihilo. Instalación pip install -r requirements.txt Uso usage: SourceLeakHacker.py options optional arguments: -h, --help show this help message and exit --url URL url to scan, eg: 'http://127.0.0.1/' --urls URLS file contains urls ...