CVE-2025-68645

🛡️ CVE-2025-68645 - Analyse d'inclusion de fichier local LFI dans Zimbra 📌 Aperçu Ce document décrit une vulnérabilité d'inclusion de fichier local LFI affectant Zimbra Collaboration Suite. Le problème provient d'une gestion inappropriée du paramètre suivant : /h/?javax.servlet.include.servletpath...

autofs-cve-2026-84568

CVE-2026-84568 — Заметки по обратной разработке и воспроизведение Независимая обратная разработка патча autofs для macOS для CVE-2026-84568 , а также рабочий PoC для нарушения границы доверия. Apple опубликовала рекомендацию. Mr.Gedik @h4ck2s3c сообщил об ошибке. Этот репозиторий документирует...

CVE-2026-105174

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...

CVE-2026-105293

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2025-32462

CVE-2025-32462 – sudo POC 스크립트 이것은 CVE‑2025‑32462 권한 상승 탐지 스크립트로, 직접 sudo 탐지와 비특권 사용자 우회 탐지의 두 가지 모드를 제공합니다. 파일 구조 파일| 설명 ---|--- poc.sh| CVE-2025-32462 취약점 검증 파일 bash, dash 지원 version.txt| 버전 일치 도구에 사용되는 파일 영향을 받는 버전 영향을 받는 sudo 버전은 1.8.8 1.9.17이며, 주로 Linux 시스템에 영향을 미칩니다. 사용법 1 – 스크립트 클론 $ git...

Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-

Nexus — 로컬 권한 상승 PoC 위조된 Git 객체를 통한 Gitea template-sync 경로 순회 → root HackTheBox 머신 Nexus 를 위한 개념 증명proof-of-concept 권한 상승 익스플로잇. root 소유의 systemd 서비스가 Gitea template 저장소를 디스크로 동기화할 때 엔트리 이름을 정제하지 않아, 인증된 저권한 사용자가 디렉터리 순회를 통해 root 권한으로 임의 파일을 쓸 수 있습니다 — 여기서는 /root/.ssh/authorizedkeys에 SSH 키를 심는 데...

CVE-2026-105293

Legcord versions 1.1.0 through 1.3.0 are vulnerable to a path traversal vulnerability within the theme IPC handlers. The root cause is the use of unvalidated theme ids , which allows scripts running in the Discord origin (e.g., via XSS ) to escape the designated themes directory. Attackers can ab...

CVE-2026-105293 Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

EUVD-2026-92157

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105293 Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105293 Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

cve-2022-24785-poc-lab

Обзор Это простое приложение Node Express, используемое для исследования уязвимости обхода пути в Moment.js CVE-2022-24785. Установка git clone https://github.com/pS3ud0RANd0m/momentjs.git cd momentjs cat package.json Change 'moment' to '2.29.4' if wanting to test bypasses of the current patch. n...

EUVD-2026-92135

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

EUVD-2026-92134

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105174

A path traversal vulnerability exists in Gerapy up to version 0.9.13 within the Project Management component. The issue is located in the project_create function of the gerapy/server/core/views.py file, where improper handling of the project_name argument allows for unauthorized directory access....

CVE-2026-105174 Gerapy Project Management views.py project_create path traversal

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...

EUVD-2026-92154

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...

CVE-2026-105174 Gerapy Project Management views.py project_create path traversal

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...