CVE-2026-81837

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-75337

The static resource interface /api/static/deployKey/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root...

CVE-2026-54083

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-53571

CVE-2026-53571 CVE-2026-53571 server.fs.deny Umgehung auf Windows alternativen Pfaden PoC. Der Inhalt von Dateien, die durch server.fs.deny festgelegt sind, kann im Browser unter Windows zurückgegeben werden. root@kitploit: mkdir CVE-2026-53571 cd CVE-2026-53571 npm init -y npm install...

CVE-2021-42013

CVE-2021-42013 Verwundbarer Dienst Installation Mehrere Optionen: 1. Docker-Container root@kitploit: docker run -d -p 8080:80 12345qwert123456/apache2450cve-2021-42013 2. Dockerfile root@kitploit: git clone https://github.com/12345qwert123456/CVE-2021-42013.git cd...

CVE-2021-41773

CVE-2021-41773 Verletzlicher Dienst Installation Mehrere Optionen: 1. Docker-Container root@kitploit: docker run -d -p 8080:80 12345qwert123456/apache2449cve-2021-41773 2. Dockerfile root@kitploit: git clone https://github.com/12345qwert123456/CVE-2021-41773.git cd...

APOLOGEE

🌀 APOLOGEE - Siemens Feldpanel-Scanner: APOLOGEE ist ein Python-Skript und ein Metasploit-Modul, das ein verstecktes Verzeichnis auf Siemens APOGEE PXC BACnet Automation Controllers alle Versionen vor V3.5 und TALON TC BACnet Automation Controllers alle Versionen vor V3.5 enumeriert. Mit einem CV...

cve-2021-41773-checker

🛑 CVE-2021-41773 Verificatore CVE-2021-41773 Verificatore è uno strumento CLI basato su Python che controlla se un server web di destinazione è vulnerabile alla vulnerabilità di path traversal di Apache che colpisce Apache HTTP Server 2.4.49. È progettato come un proof of concept a scopo didattic...

CVE-2026-38093

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10 , contains a path traversal (CWE-22) vulnerability in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME value returned by ContentResolver.query() directly in file path const...

EUVD-2026-67771

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

PT-2026-83128

file picker aka flutter file picker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAY NAME obtained from ContentResolver.query directly in file path construction without...

VulnCheck KEV: CVE-2026-78003

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

PT-2026-82871

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - Spring MVC and WebFlux applications tha...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2025-6218_WinRAR

🧪 CVE-2025-6218: Path Traversal in WinRAR 📌 Descrizione Questo laboratorio dimostra come sfruttare la vulnerabilità CVE-2025-6218 nelle versioni vulnerabili di WinRAR per Windows. Questa vulnerabilità consente a un file .rar malizioso di sovrascrivere file al di fuori della directory di estrazion...

CVE-2023-50164-POC

Questo è un Proof of Concept PoC per CVE-2023-50164, che descrive una nuova vulnerabilità di path traversal che può portare a Remote Code Execution RCE in struts-core. Per risolvere il problema, si consiglia di aggiornare a Struts 2.5.33 o Struts 6.3.0.2 o versioni successive. Questo repository s...

CVE-2025-0851

CVE-2025-0851 Questa vulnerabilità è causata da una vulnerabilità di File Traversal nelle funzioni untar e unzip, fornite dall'utility per estrarre archivi di modelli tar e zip utilizzati nel caricamento dei modelli in Deep Java Library un framework open source per il deep learning in Java...

CVE-2021-41773

CVE-2021-41773 Utilizzo root@kitploit: docker-compose up -d --build vuln-server-no-cgid python no-cgid/exploit.py root@kitploit: docker-compose up -d --build vuln-server-cgid-sh python cgid-sh/exploit.py Cos'è CVE-2021-41773? CVE-2021-41773 Vulnerabilità di directory traversal in Apache HTTP Serv...