CVE-2026-15896 Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parserequest function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

CVE-2026-15896 Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parserequest function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

CVE-2026-15896 Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parserequest function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - Отсутствие авторизации, приводящее к неаутентифицированному произвольному чтению файлов Описание Плагин Error Log Viewer By WP Guru для WordPress уязвим к произвольному чтению файлов во всех версиях до 1.0.1.3 включительно через AJAX-действие...

CVE-2021-43798

CVE-2021-43798 : Vulnérabilité de lecture arbitraire de fichiers dans Grafana Modèle nuclei ajouté pour l'identification sur toutes les versions Windows+Linux Liste des 52 plugins : live icon loki text logs news stat mssql mixed mysql tempo graph gauge table debug zipkin jaeger geomap canvas...

CVE-2025-38502-Linux-LPE

Abraxas Labs · abraxaslabs.tech · github.com/abraxas · @abraxasnull CVE-2025-38502 Выход за границы доступа к локальному хранилищу cgroup BPF в ядре Linux через хвостовые вызовы | ---|--- CVE| CVE-2025-38502 CWE| CWE-125 — чтение за границами буфера Производитель| Ядро Linux Компонент|...

kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the ibuverbspostsend function. A local user can exploit this vulnerability by providing an invalid work queue element size wqesize from userspace without proper validation. This can lead to an...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015 – Произвольное чтение файлов через цепочку фильтров PHP Код программы PHP // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper...

Mandiant-Azure-AD-Investigator

Mandiant Azure AD Investigator Axé sur les TTPs d'UNC2452 Aperçu Ce dépôt contient un module PowerShell permettant de détecter des artefacts pouvant être des indicateurs de l'activité d'UNC2452 et d'autres acteurs de menace. Certains indicateurs sont des indicateurs de compromission de « haute...

CVE-2025-66678

CVE-2025-66678 Hardware Read & Write Utility v1.25.11.26에서 드라이버는 MmMapIoSpace를 통해 임의의 MSR 읽기 및 쓰기와 물리적 메모리 읽기 및 쓰기를 노출시켰으며, 이는 모두 커널 코드 실행을 가능하게 합니다. PoC 상세 PoC는 현재 프로세스의 기본 토큰을 교체하여 NT Authority\SYSTEM이 됩니다. 사용법 1. 취약한 드라이버를 C:\Users\Public에 배치합니다. 2. 관리자 권한으로 익스플로잇을 실행합니다. 참고: 취약한 드라이버는 이 프로젝트에...

CVE-2024-34102

CVE-2024-34102 - Exploitation CosmicSting XXE Exploit pour CVE-2024-34102 CosmicSting - Vulnérabilité XML External Entity XXE dans Adobe Commerce et Magento. 📋 À propos de la vulnérabilité CVE-2024-34102 est une vulnérabilité XXE critique XML External Entity affectant : Adobe Commerce versions...

ZeroHVCI

ZeroHVCI - Обход HVCI без прав администратора или драйвера ядра ZeroHVCI обеспечивает произвольное чтение/запись/вызов функций в ядре в средах, защищённых целостностью кода под защитой гипервизора HVCI, без прав администратора и драйверов ядра. Возможности Полное непривилегированное чтение/запись...

PS5-UMTX-Jailbreak

PS5 UMTX Jailbreak Краткое описание Этот репозиторий содержит WebKit ROP-эксплойт для уязвимости гонки use-after-free в UMTX CVE-2024-43102, сообщённой Synacktiv. По сути, это порт стратегии эксплойта fail0verflow и flatz. Он злоупотребляет UAF для получения чтения/записи в стек потока ядра и...

CVE-2020-1938-Tool

CVE-2020-1938-Tool Tout d'abord, merci à hypn0s pour avoir fourni l'outil de construction de requêtes du protocole AJP AJPY une bibliothèque Python. Ce projet s'appuie sur cela pour réaliser la détection par lots des sites vulnérables à Ghostcat. Utilisation Actuellement, deux fonctionnalités son...

cve-2018-8453-exp

cve-2018-8453-exp cve-2018-8453 exp Ce programme est un exploit pour cve-2018-8453. La vulnérabilité existe dans win7 et versions ultérieures Mais attention : elle n'est exploitable que dans win8.1 et versions ultérieures ! Ce EXP ne peut donc être utilisé que sur WIN8.1 et versions ultérieures...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

Mitel MiCollab - Arbitary File Read

The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attack...

Sonicwall - Pre-Authentication Arbitrary File Read

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

Vite - Arbitrary File Read

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...