cve-2021-41773

CVE-2021-41773 – Apache Path Traversal 보고서 요약 Apache HTTP Server 2.4.49 버전에서 발견된 취약점으로, 웹 서버 설정에 따라 Path Traversal 공격을 통해 시스템의 민감한 파일을 노출할 수 있음 Path Traversal: 공격자가 ../ 을 포함한 경로를 사용하여 웹 루트 밖의 파일에 접근할 수 있음 정보 취약점 이름 : CVE-2021-41773 영향받는 버전 : Apache HTTP Server 2.4.49 취약점 유형 : Path Traversal 공식 패치...

CVE-2017-1000117

CVE-2017-1000117 のPoCリポジトリ VulApps joernchen/CVE-2017-1000117 からのフォーク git clone --recursive https://github.com/VulApps/CVE-2017-1000117.git は、id の出力を /var/www/html にある vul ファイルに書き込みます。 詳細は VulApps をご覧ください。...

CVE-2022-22965-PoC_Payara

CVE-2022-22965 PoC - Payara 임의 파일 다운로드 Payara/Glassfish에서 CVE-2022-22965 Spring 취약점을 재현하는 최소 예제입니다. 악의적인 사용자가 임의의 웹 루트를 설정하여 임의의 파일 다운로드를 가능하게 하는 Payara/Glassfish용 대체 페이로드입니다. Docker Compose를 사용한 실행 1. Docker Compose를 사용하여 애플리케이션 빌드 root@kitploit: docker-compose up --build 2. 앱을 테스트하려면...

CVE-2019-12185

CVE-2019-12185 eLabFTW 1.8.5는 /app/controllers/EntityController.php 구성 요소를 통해 임의 파일 업로드에 취약합니다. 이로 인해 원격 코드 실행이 발생할 수 있습니다. 공격자는 사용자 계정을 사용하여 POST 요청을 통해 시스템을 완전히 장악할 수 있습니다. 이를 통해 PHP 파일을 웹 루트에 작성하고 원격 서버에서 코드를 실행할 수 있습니다. -- https://nvd.nist.gov/vuln/detail/CVE-2019-12185 사용 예시 인자 root@kitploit...

cve-reproduction-lab

CVE 취약점 재현 실습실 개요 이 프로젝트는 통제된 익스플로잇과 방어적 패치 시뮬레이션을 통해 소프트웨어 취약점의 실제 영향을 시연하도록 설계된 사이버 보안 연구 실습실입니다. 이 실습실은 Apache HTTP Server의 중요한 경로 탐색 취약점인 CVE-2021-41773에 초점을 맞추며, 공격자가 웹 루트 외부의 민감한 파일에 접근할 수 있도록 합니다. 환경은 취약한 서버 시뮬레이션과 패치된 보안 구현을 모두 포함하여 적절한 입력 정규화 및 안전한 구성 관행의 중요성을 강조합니다. 이 프로젝트는 교육, 윤리적 해킹 및...

PT-2026-86316

🚨 CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to...

CVE-2026-76597

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

EUVD-2026-57264

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939 WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939

CVE-2026-65939 affects WhatsUp Gold releases prior to 2026.0.2. The issue allows a privileged attacker to create a LogToFile action that specifies an arbitrary file extension within the IIS web root, enabling potential unauthorized file writes. CVSS:3.1 base score 6.8 (MEDIUM), with an adjacent a...

PT-2026-71120

Name of the Vulnerable Software and Affected Versions WhatsUp Gold versions prior to 2026.0.2 Description A privileged attacker can create a LogToFile action that allows the specification of an arbitrary file extension within the IIS web root. IIS Internet Information Services is a flexible,...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

EUVD-2026-55223

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

EUVD-2026-55230

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

CVE-2026-46458

CVE-2026-46458 affects ICU Scandinavia Boomerang. An information-disclosure flaw allows an unauthenticated attacker to retrieve plaintext credentials by requesting specific XML files from the webroot over static HTTP. The root cause is exposure of sensitive credential files via static HTTP paths....

EUVD-2026-44621

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...