CVE-2021-34429

CVE-2021-34429 POC for CVE-2021-34429 - Eclipse Jetty 11.0.5 Sensitive File Disclosure Using Encoded URIs to access files inside WEB-INF directory Setting up the testing Environment Prequistics: Installing docker and docker-compose on your system For debain based distros ex. Ubuntu, Kali Linux et...

web-inf-path-trav

WebXMLExp.py Tool for helping in the exploitation of path traversal vulnerabilities in Java web applications. This tool is referenced in the Invicti Security white paper Exploiting path traversal vulnerabilities in Java web applications. Install Python3 is required for this tool. Run the followin...

CVE-2021-26085

CVE-2021-26085 Atlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability POC Vulnerable Endpoints: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties...

CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability Docker-based reproduction environment for CVE-2025-55752, a path traversal vulnerability in Apache Tomcat 10.1.44. Overview CVE-2025-55752 is a path traversal vulnerability in Apache Tomcat's RewriteValve caused by incorrect processing...

CVE-2020-1938

Disclaimer: All use of cybersecurity tools must comply with national laws, industry regulations, and the relevant rules of the target system, and must not be used for any illegal purposes or to infringe upon the lawful rights of others. Users should recognize that no tool can guarantee absolute...

CVE-2021-26086

CVE-2021-26086 Atlassian Jira Server/Data Center 8.4.0 - Limited Remote File Read/Include Vulnerable Endpoints: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties...

Astra Linux – Vulnerability in Jetty9

For Eclipse Jetty versions = 9.4.40, = 10.0.2, and = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example, a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can revea...

CVE-2026-70449

Apache Wicket versions 8.18.0 and before, 9.23.0 and before, and 10.10.0 and before are vulnerable to a Directory Traversal vulnerability. The issue stems from improper validation of locale , style , and variation attributes decoded from package resource URLs. Because these attributes are spliced...

CVE-2026-70449 Apache Wicket: Path traversal in resource style/variation/locale

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package...

CVE-2026-70449 Apache Wicket: Path traversal in resource style/variation/locale

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package...

EUVD-2026-68484

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package...

PT-2026-83786

Name of the Vulnerable Software and Affected Versions Apache Wicket versions prior to 8.19.0 Apache Wicket versions prior to 9.24.0 Apache Wicket versions prior to 10.11.0 Description Improper validation of resource URL attributes allows an unauthenticated remote attacker to read files from the w...

CVE-2026-70449: Improper Limitation of a Pathname to a Restricted Directory

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package...

CVE-2026-46581

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

CVE-2026-23734

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg=false, leading to Path Traversal. The vulnerability i...

CVE-2026-23734 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The...

EUVD-2026-31152

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The...

CVE-2026-23734

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The...

CVE-2026-26336

Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories like WEB-INF via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files...

CVE-2026-26336

Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories like WEB-INF via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files...