CVE-2022-22965-PoC_Payara

CVE-2022-22965 PoC - Téléchargement arbitraire de fichiers Payara Exemple minimal de reproduction de la vulnérabilité Spring CVE-2022-22965 dans Payara/Glassfish. Payload alternatif pour Payara/Glassfish permettant à un utilisateur malveillant de définir une racine web arbitraire, conduisant à un...

cve-2021-41773

CVE-2021-41773 – Apache Path Traversal: отчёт Краткое описание Уязвимость, обнаруженная в Apache HTTP Server 2.4.49, которая в зависимости от конфигурации веб-сервера может раскрывать конфиденциальные файлы системы через атаку Path Traversal Path Traversal: злоумышленник может получить доступ к...

CVE-2019-12185

CVE-2019-12185 eLabFTW 1.8.5 подвержен уязвимости произвольной загрузки файлов через компонент /app/controllers/EntityController.php. Это может привести к удалённому выполнению команд. Злоумышленник может использовать учётную запись пользователя, чтобы полностью скомпрометировать систему с помощь...

cve-reproduction-lab

Лаборатория воспроизведения CVE Обзор Этот проект представляет собой исследовательскую лабораторию кибербезопасности, созданную для демонстрации реального воздействия уязвимостей программного обеспечения посредством контролируемой эксплуатации и имитации защитного исправления. Лаборатория...

CVE-2017-1000117

CVE-2017-1000117 PoC-репозиторий для VulApps Форк от joernchen/CVE-2017-1000117 git clone --recursive https://github.com/VulApps/CVE-2017-1000117.git запишет вывод id в файл vul в /var/www/html. Подробнее на VulApps...

CVE-2026-94132

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

CVE-2026-94132

The AcyMailing Enterprise extension for Joomla (versions 1.0.0 – 11.0.5 ) contains a Remote Code Execution (RCE) vulnerability. The root cause is that the mailbox actions in POP3 mode save incoming MIME attachments to the media/com_acym/upload/ directory without performing extension checks. This ...

CVE-2026-94132 Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

CVE-2026-76555 WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

EUVD-2026-77383

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

CVE-2026-81565: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

PT-2026-86316

🚨 CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to...

CVE-2026-82450: Unrestricted Upload of File with Dangerous Type

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-76597

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

CVE-2026-76597: Improper Access Control

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

CVE-2026-64966: Improper Limitation of a Pathname to a Restricted Directory

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

EUVD-2026-57264

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939 WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...