esm.sh <= v136 - Local File Inclusion

esm.sh = 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request. id: CVE-2025-59341 info: name: esm.sh = v136 - Local File Inclusion author: 0xAkoko severity: high description:...

CVE-2015-2166-EXPLOIT

CVE-2015-2166 - Ericsson Drutt Mobile Service Delivery Platform MSDP におけるディレクトリトラバーサルの脆弱性 CVE-2015-2166 は、Ericsson Drutt Mobile Service Delivery Platform MSDP バージョン 4、5、6 の Instance Monitor に影響を与えるディレクトリトラバーサルの脆弱性です。この脆弱性により、リモートの攻撃者は、デフォルトの URI において "..%2f" ドットドットエンコードされたスラッシュ...

auto-cve-2022-44268.sh

auto-cve-2022-44268 CVE-2022-44268 ImageMagick任意ファイル読み取りの悪用を自動化 Original finding: https://www.metabaseq.com/imagemagick-zero-days/ PoC Repository: https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC 説明 ImageMagickは「profile」というテキスト文字列を ファイル名として解釈し、その内容を生のプロファイルとして読み込み...

CVE-2024-24919-Sniper

CVE-2024-24919-Sniper 概要 CVE-2024-24919 Sniper は、Check Point Security Gateway の情報漏えい脆弱性をスキャンするために設計された Python スクリプトです。このスクリプトは、単一ターゲットと一括スキャンの両方に対応し、マルチスレッドを利用してスキャン速度を向上させます。ターゲットを指定し、スキャン動作を制御するためのさまざまなコマンドラインオプションをサポートしています。 特徴 CVE-2024-24919 脆弱性のスキャンおよび悪用 単一ターゲットおよび一括スキャンのサポート...

CVE-2024-2961-Remote-File-Read

CVE-2024-2961 リモートファイル読み取り このスクリプトは、CVE-2024-2961 に記載されているように、iconv ライブラリが文字エンコーディング変換を誤って処理するシステムの脆弱性を悪用する方法を示しています。これにより、攻撃者は PHP フィルタチェーンと不適切なエンコーディング処理を利用して、サーバー上の任意のファイルを読み取ることができます。 このスクリプトは、細工されたペイロードのアップロード、生成されたファイルの取得、およびその内容の表示のプロセスを自動化します。これは、次の記事で詳述されている研究に基づいています：Iconv...

http-vuln-cve2020-3452.nse

http-vuln-cve2020-3452.nse CVE-2020-3452 : Cisco ASA および FTD の未承認リモートファイル読み取り Nmap NSE スクリプト...

cosmicsting-cve-2024-34102-exploit

CosmicSting CVE-2024-34102 エクスプロイトスイート CVE-2024-34102 用の完全なエクスプロイトスイート - Adobe Commerce / Magento 2.4.x における CosmicSting XXE 脆弱性。 脆弱性の詳細 CVE : CVE-2024-34102 CVSS 9.8 タイプ : XML External Entity Injection XXE 影響 : 未認証のリモートファイル読み取り、SSRF、潜在的なRCE 影響を受けるバージョン : Adobe Commerce...

SUSE CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

DEBIAN-CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

UBUNTU-CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-17615

CVE-2026-17615 is an XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider component. The root cause is that SourceProvider.writeTo() creates a SAXParser without disabling external entity resolution. An unauthenticated attacker can exploit this by sending a specially crafted XML bo...

CVE-2026-17615 Resteasy-core: resteasy sourceprovider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

EUVD-2026-68654

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

Linux Distros Unpatched Vulnerability : CVE-2026-17615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending ...

CVE-2026-70449: Improper Limitation of a Pathname to a Restricted Directory

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package...

CVE-2026-17615: Improper Restriction of XML External Entity Reference

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...