CVE-2021-43798

CVE-2021-43798 Grafana 8.x 路径遍历（未授权） 所有荣誉归 j0v 及其推文 https://twitter.com/j0v0x0/status/1466845212626542607 免责声明 仅供教育目的使用。本人不对你的行为负责。请自行斟酌使用。 本着善意，我已推迟发布此 PoC，直到该漏洞公开或补丁可用。 目录 解释 - 漏洞说明 攻击向量 - 可执行的攻击列表 利用脚本 - 利用脚本使用说明 解释 我注意到 j0v 的一条推文声称发现了 Grafana 路径遍历漏洞。出于好奇，我开始查看 Grafana...

CVE-2021-43798-Grafana-path-traversal-tester

Probador de Path Traversal en Grafana Este script automatiza la prueba de endpoints de plugins de Grafana conocidos por posibles vulnerabilidades de path traversal usando curl. 🛠 Características Lee rutas objetivo desde un archivo p. ej. paths.txt Envía solicitudes HTTP usando --path-as-is para...

CVE-2021-43798

CVE-2021-43798 CVE-2021-43798 是一个高严重性的路径遍历漏洞（CVSS 3.1 评分：7.5），影响 Grafana 8.0.0-beta1 至 8.3.0 版本。它允许未经身份验证的攻击者通过利用 /public/plugins/:pluginId 端点的输入清理不当，读取服务器上的任意文件。 dork : fofa : title="Grafana" && port="3000" shodan : http.title:"Grafana" port:3000 payload :...

CVE-2021-43798

CVE-2021-43798:Grafana 任意文件读取漏洞 添加了 Windows+Linux 全版本识别的 nuclei 模板 52个插件列表： live icon loki text logs news stat mssql mixed mysql tempo graph gauge table debug zipkin jaeger geomap canvas grafana welcome xychart heatmap postgres testdata opentsdb influxdb barchart annolist bargauge graphite dashli...

CVE-2021-43798

uso: grafana-exploit.py -h -H/--host HOST grafana-exploit.py: error: los siguientes argumentos son requeridos: -H/--host ejemplo: python3 grafana-exploit.py --host si se lee exitosamente un archivo arbitrario muestra la URL de la solicitud y el comando curl +RequestURL...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 迷你利用框架 用于授权安全测试 Grafana 目录遍历漏洞（CVE-2021-43798）的命令行自动化工具。 概述 CVE-2021-43798 是 Grafana 8.x 中存在的一个未认证目录遍历漏洞，攻击者可以通过 /public/plugins/ 端点读取底层文件系统中的任意文件。根本原因在于对插件资产请求的路径清理不当，导致 ../ 序列能够逃逸出预期目录。 GrafTraverse...

EUVD-2026-84870

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

PT-2026-97058

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1 Description An authenticated user can cause a denial of service by...

PT-2026-95597

Name of the Vulnerable Software and Affected Versions Weaver E-cology affected versions not specified Description An unauthenticated SQL injection allows remote attackers to execute arbitrary SQL queries. This occurs when malicious input is submitted through the userIdentifiers GET parameter in t...

CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

CVE-2026-12609

CVE-2026-12609 affects Eclipse Theia (versions 1.66.0 to 1.73.1) where the backend of the @theia/plugin-ext module exposes the /hostedPlugin/:pluginId/:path(*) endpoint. The endpoint resolves the requested path with path.resolve(localPath, filePath) without ensuring the result stays within the pl...

EUVD-2026-44955

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

CVE-2026-4275

CVE-2026-4275 affects the Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress up to version 4.2.3. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw arising from using __return_true as the permission_callback for the /install_plugin and /activate_plugin REST...

CVE-2026-4275

The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of 'returntrue' as the permissioncallback for the /installplugin and /activateplugin REST API endpoint...

CVE-2026-50869

An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request...

CVE-2026-9109 GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage

The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping...

Portainer 安全漏洞

Portainer is a lightweight user management interface developed by Portainer Foundation for managing Docker environments and Docker hosts. Vulnerabilities exist in versions of Portainer Community Edition from 2.33.0 to 2.33.8, as well as in versions prior to 2.39.2 and 2.41.0. These vulnerabilitie...

CVE-2026-33719 AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured...