CVE-2026-23751-poc

CVE-2026-23751-PoC Proof-of-concept implementation of the .NET HTTP Remoting technique described in Code White's NewRemotingTricks, targeting Tungsten Automation Kofax Capture. CVE-2026-23751 Title: Tungsten Automation Kofax Capture Unauthenticated File Read/Write and Command Execution via .NET...

CVE-2026-67279

The MikroTik RouterOS SSH server is vulnerable to an authentication bypass (CVE-2026-67279) where a client-requested rekey before authentication triggers the server to enter the connection protocol without verifying user credentials. This allows unauthenticated clients to open session channels an...

CVE-2026-72748

CVE-2026-72748 affects the AVideo platform via the unauthenticated endpoint aVideoEncoderChunk.json.php, allowing HTTP PUT writes of up to 4 GB to the server filesystem. The issue can cause disk space exhaustion, denial of service, and potential disruption of the video encoding pipeline; the desc...

CVE-2026-60009

In Eclipse Theia up to 1.73.1, the backend @theia/filesystem binds POST /file-upload in every filesystem-enabled deployment. The handler uses an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no au...

WordPress WPForms Pro plugin <= 1.10.1.1 - Unauthenticated Arbitrary File Write vulnerability

Unauthenticated Arbitrary File Write vulnerability discovered by lhking in WordPress Plugin WPForms Pro versions = 1.10.1.1...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

PT-2026-57990

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 through 2.0.0-milestone-12 Description Deployments using the MongoDB backend are subject to an unauthenticated arbitrary file write via the AAS thumbnail API. The issue occurs because t...

CVE-2019-25714 Seeyon Office Anywhere (OA) A8 Unauthenticated Arbitrary File Write via htmlofficeservlet

Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can wri...

CVE-2026-32297 Angeet ES3 KVM unauthenticated arbitrary file write

The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. Modified configuration files or system binaries could allow an attacker to take complete control of a vulnerable system...

Linux Distros Unpatched Vulnerability : CVE-2020-23171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash...

PT-2025-23417 · Mageia · Deluge

Limited unauthenticated file read in /flag. CVE-2025-46561 New version check over unencrypted channel. CVE-2025-46562 SSRF with information leak and limited unauthenticated file write. CVE-2025-46563 Unauthenticated file read in /js may lead to RCE. CVE-2025-46564 Mageia internal bug:...

CVE-2024-31451 Limited file write in routes.py (GHSL-2023-250)

DocsGPT is a GPT-powered chat for documentation. DocsGPT is vulnerable to unauthenticated limited file write in routes.py. This vulnerability is fixed in 0.8.1...

CVE-2023-37373

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.4. The affected applications accept unauthenticated file write messages. An unauthenticated remote attacker could write arbitrary files to the affected application's file system...

Design/Logic Flaw

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.4. The affected applications accept unauthenticated file write messages. An unauthenticated remote attacker could write arbitrary files to the affected application's file system...

CVE-2023-37373

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.4. The affected applications accept unauthenticated file write messages. An unauthenticated remote attacker could write arbitrary files to the affected application's file system...

CVE-2022-47769

An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell...

CVE-2022-28113: Reliance on Cookies without Validation and Integrity Checking

An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie...

CVE-2021-45420

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to...