CVE-2018-17246

CVE-2018-17246 - Kibana LFI There is no input validation so we can change the name of the JavaScript file to anything we want. In this case, with the path traversal technique, we can choose any file on the Kibana server. One thing to be aware of, however, is node's module caching feature...

cloudfox

🦊 CloudFox 🦊 CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. CLOUDFOX UPDATE REQUIRED: 12/202...

UPnPHostFileRead

Description Local arbitrary file read PoC exploit for the Windows UPnP Device Host service. Reads an arbitrary file in the context of LOCAL SERVICE. Tested against Windows 11 Pro build 26200.8457. Reported to Microsoft. Assessed as "not a vulnerability". How to Build 1. Clone the repository. 2...

CVE-2022-35899

CVE-2022-35899 Unquoted Service Path Asus GameSdk Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path Privilege Escalation Date: 07/14/2022 Exploit Author: Angelo Pio Amirante Version: 1.0.0.4 Tested on: Windows 10 Patched version: 1.0.5.0 Step to discover the unquoted...

Ruby-On-Rails-Path-Traversal-Vulnerability-CVE-2018-3760-

Ruby On Rails Path Traversal Vulnerability（CVE-2018-3760） 中文版本Chinese version Ruby On Rails is a well-known Ruby Web development framework, which uses Sprockets as a static file server in development environment. Sprockets is a Ruby library that compiles and distributes static resource files. The...

cve-2020-14882

CVE-2020-14882 Affected versions: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 POC: http://IP:7001/console/images/%252E%252E%252Fconsole.portal?nfpb=false&pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession"java.lang.Runtime.getRuntime.exec'calc.exe';"; image: EXP: python...

mass_cve-2021-41773

masscve-2021-41773 MASS CVE-2021-41773 Screenshot Usage ! python3 -m pip install requests pyyhon3 cve-2021-41773.py urlist.txt pool Note ! results will be automatically saved in vuln.txt u can add a common dir on...

CVE-2024-53677

CVE-2024-53677 - Apache Struts 2 Root Cause Analysis Lab Environment This repository provides a Docker-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2. This vulnerability involves path traversal through the file upload functionality in Struts 2. Source This lab...

CVE-2025-6218

CVE-2025-6218 | ZDI-CAN-27198 | ZDI-25-409 - WinRAR Path Traversal - Remote Code Execution RCE Proof of Concept More information: https://www.win-rar.com/singlenewsview.html?&L=0 https://www.cvedetails.com/cve/CVE-2025-6218/ https://www.zerodayinitiative.com/advisories/ZDI-25-409/ RARLAB WinRAR...

CVE-2024-4956-Bulk-Scanner

README.md CVE-2024-4956 Bulk Scanner Disclaimer This tool is intended only for educational purposes and for testing in corporate environments. https://twitter.com/nav1n0x/ and https://github.com/ifconfig-me take no responsibility for the misuse of this code. Use it at your own risk. Do not attack...

CVE-2026-65320-fastcore

CVE-2026-65320: Path Traversal Tar Slip in fastcore via untardir Severity: Critical, CVSS 3.1 9.8 Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected: fastcore = 2.2.30 Fixed in: Not fixed at time of writing CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory,...

SpringVulScan

SpringVulScan If you like it, give the author a star SpringVulScan -- Burp Suite Plugin Updates 1.1 1. Added custom root path scanning. 2. Right-click to send to SpringVulScan, custom dictionaries, etc. 3. Optimized detection logic. 4. Custom selection can be used not only for detecting route...

CVE-2026-48282

CVE-2026-48282-POC CVE-2026-48282 is a path traversal vulnerability in Adobe ColdFusion's Remote Development Service RDS with a CVSS score of 10.0 Critical. It allows unauthenticated attackers to read & write arbitrary files via the /CFIDE/main/ide.cfm endpoint, leading to Remote Code Execution...

Get-RBCD-Threaded

Get-RBCD-Threaded Tool to discover Resource-Based Constrained Delegation attack paths in Active Directory Environments Based almost entirely on wonderful blog posts "Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory" by Elad Shamir and "A Case Study in...

GitHound

GitHound Overview GitHound is a BloodHound OpenGraph collector for GitHub, designed to map your organization’s structure and permissions into a navigable attack‑path graph. It: Models Key GitHub Entities GHOrganization : Your GitHub org metadata GHUser : Individual user accounts in the org GHTeam...

CVE-2024-9935

CVE-2024-9935 PDF Generator Addon for Elementor Page Builder = 1.7.5 - Unauthenticated Arbitrary File Download Description The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtwpgaepbdwnldpdf...

CVE-2019-2615

CVE-2019-2615 GET /beawlsmanagementinternal2/wlmanagement HTTP/1.1 Host: 192.168.5.137:7001 User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:66.0 Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/ ;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encodin...

CVE-2020-14882

CVE-2020–14882 Weblogic Unauthorized bypass RCE bypass patch with CVE-2020–14882 private static final String IllegalUrl = new String";", "%252E%252E", "%2E%2E", "..", "%3C", "%3E", ""; list %252E%252E %2E%2E .. %3E %3C ; lower "%252E%252E%252F".lower '%252e%252e%252f' %252E%252E%252F to...

CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel Configuration Information Scanner This tool is used to scan Pterodactyl panel instances in an attempt to retrieve their database configuration information. By exploiting a specific path traversal vulnerability, sensitive configuration data of the panel can be...

CVE-2025-61686_docker

CVE-2025-61686docker Start 1. Build docker-compose up --build 2. Start docker-compose up Reproduction Steps 1. Construct a session that meets the path traversal condition └─$ echo -en '"AAAA../../../tmp/flower"'|base64 -w0 | tr '+/' '-' | tr -d '=' IkFBQUEuLi8uLi8uLi90bXAvZmxvd2VyIg 2. Put the...