CVE-2020-12112

CVE-2020-12112 🚨 BigBlueButton 版本低于 2.2.4 存在 LFI 漏洞，允许访问敏感文件。 故事 📜 在一次使用 BigBlueButton 进行的远程学习课程中，我班上的一名学生分享了我老师的幻灯片演示链接，我注意到文件名包含在 URL 中。 root@kitploit: 学生：“不用记笔记了，我已经拿到幻灯片了。” 我：“好吧，那我得写一份安全报告了。” 😂 稍微摆弄一下，我就能获取到服务器的 /etc/passwd 文件，并发现开源解决方案 Big Blue Button 存在一个安全漏洞。 我报告了该漏洞，BBB 团队迅速回应并在短短几天内修复了它...

CVE-2023-37739---Path-Traversal-in-i-doit-Pro-25-and-below

CVE-2023-37739 - Path Traversal en i-doit Pro 25 y anteriores i-doit Pro 25 y versiones anteriores son vulnerables a una vulnerabilidad de Path Traversal. Estas vulnerabilidades podrían permitir a atacantes autenticados remotos con privilegios bajos o altos navegar a ubicaciones que no deberían s...

Remot3d

Remot3d - 一种简单的利用方式 即将更新 可以轻松快速地创建一个后门，该后门可通过运行PHP语言程序的服务器上的Linux终端用于远程进程。 旨在绕过服务器上禁用的系统功能，特别是用于读取敏感文件 /etc/passwd。 捐赠 如果这个项目对你的渗透测试很有帮助，并且你想要支持我，你可以请我喝杯咖啡 : 截图 --------------------------------------------------------------- Remot3d 功能列表 为Windows或Linux服务器创建后门（可运行PHP文件） 利用 imapopen 漏洞绕过禁用函数...

CVE-2022-46604-Responsive-File-Manager

CVE 2022 46604 – 响应式文件管理器 ⚠️ 免责声明 本仓库仅供教育和研究目的使用。 此处提供的信息和代码只可用于受控环境，例如私有实验室机器。 未经授权对你不拥有或未获明确许可测试的系统使用此代码是非法且不道德的。 作者不对因使用此材料而导致的任何滥用或损害负责。 🔍 关于漏洞 CVE 2022 46604 是在 响应式文件管理器 中发现的一个漏洞，该插件是一个经常集成到 Web 应用程序和内容管理系统中的文件管理插件。该漏洞存在于 9.13.4 版本 中，由于对 path 参数的输入验证不足，未经认证的用户可以执行目录遍历 并访问服务器上的敏感文件。 根据...

Vitejs-exploit

Vite Exploit CVE-2025-31125 Descripción: Explota el path traversal en el endpoint @fs del servidor de desarrollo de Vite CVE-2025-31125 para acceder a archivos sensibles como /etc/passwd y /etc/hosts mediante URLs manipuladas. Creado por Muhammad Waseem. Uso: python viteexploit.py -u...

CVE-2022-44311

CVE-2022-44311 描述 发现 html2xhtml v1.3 在函数 static void elmclosetreenodet nodo at procesador.c 中存在越界读取。该漏洞允许攻击者通过精心构造的 html 文件访问敏感文件或导致拒绝服务 DoS。 复现步骤 要复现该漏洞，下载易受攻击版本的 html2xhtml v1.3 并编译项目： root@kitploit: wget http://www.it.uc3m.es/jaf/html2xhtml/downloads/html2xhtml-1.3.tar.gz tar -xzvf...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-76198

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...

Linux Distros Unpatched Vulnerability : CVE-2026-55554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after...

CVE-2016-20081

HB Audio Gallery Lite 1.0.0 (WordPress) has a path traversal in audio-download.php via the file_path parameter that allows unauthenticated access to arbitrary files outside the gallery directory (e.g., wp-config.php). Root cause: inadequate validation of the file_path input. The connected documen...

CVE-2017-20250

CVE-2017-20250 affects WordPress plugin Mac Photo Gallery 3.0 through a path traversal vulnerability in macdownload.php that allows unauthenticated attackers to download arbitrary files (e.g., wp-load.php) by manipulating the albid parameter. Reported impact includes potential high confidentialit...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to insufficient path sanitization in the osfs.ChrootOS component. An attacker can gain unauthorized access to unintended filesystem locations by supplying crafted paths containing directory traversal sequences...

CVE-2026-39364 Vite has a `server.fs.deny` bypass with queries

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...

Incorrect Behavior Order: Validate Before Canonicalize

Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through the server.fs.deny component. An attacker can access sensitive files by appending specific query parameters such as ?raw,...

CVE-2026-0847

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling...

CVE-2021-47899 YetiShare File Hosting Script 5.1.0 Remote File Upload SSRF Vulnerability

YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote file upload feature. Attackers can exploit the url parameter in the urluploadhandler endpoint to access sensitive files like /etc/passwd by...

GHSA-R2H2-G46H-8MX8 pretix has Broken Access Control Allowing Cross-User File Access via UUID

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...

EUVD-2020-26954

Malware in sbrugna...

EUVD-2018-0503

Malware in sbrugna...

EUVD-2017-15762

Malware in sbrugna...