675 matches found
ChopChop
ChopChop ChopChop es una herramienta de línea de comandos para pruebas dinámicas de seguridad de aplicaciones web, inicialmente escrita por el Michelin CERT. Su objetivo es escanear varios puntos finales e identificar la exposición de servicios/archivos/carpetas a través de la raíz web. Las...
zimbramail-CVE-2025-68645-poc
zimbramail-CVE-2025-68645-poc A proof-of-concept exploiting a Local File Inclusion LFI vulnerability existing in the Webmail Classic UI of Zimbra Collaboration ZCS 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. Vulnerability The...
CVE-2026-66493
Path Traversal in File Operations Delete / Copy / Move PhocaCommander ≤ 6.1.3 — Authenticated Admin Manipulates Files Outside Webroot SUMMARY The file action handler in PhocaCommander constructs source and destination paths from attacker-controlled base64-encoded parameters pathfrom, pathwhere...
EUVD-2026-86161
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...
Zimbra Collaboration - Local File Inclusion
Zimbra Collaboration ZCS 10.0 and 10.1 contain a local file inclusion caused by improper handling of user-supplied parameters in the RestFilter servlet, letting unauthenticated remote attackers include arbitrary files from WebRoot, exploit requires crafted requests to /h/rest endpoint. id:...
CVE-2026-61639 Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
CVE-2026-76597 Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...
EUVD-2026-64326
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...
CVE-2026-76597
Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 contain an unauthenticated arbitrary file upload vulnerability in the list email plugin controller , which allows an attacker to upload non-executable files to the web root without authentication. The CVSS 4.0 score is 8.7 (HIGH)...
PT-2026-79573
Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description The list email plugin controller allows an unauthenticated user to upload non-executable files directly to the web root. Recommendations Update to version 4.7.2 or later...
CVE-2026-18412
The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability during the installation of .ocmod.zip files. The installer extracts these files but fails to validate that the extracted paths remain within the intended directory. An attacker can craft a malicious extension u...
CVE-2026-18412 The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability
OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...
CVE-2026-18412: Undefined Security Weakness
OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...
CVE-2026-66914
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
CVE-2026-66914 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
EUVD-2026-54480
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
CVE-2026-66914
CVE-2026-66914 concerns the Joomla extension SEBLOD. Affected versions are SEBLOD < 3.30.0, < 4.7.0, and
CVE-2026-66914: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
GHSA-WG2Q-39H6-66X9 goshs has a Path Traversal issue
Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. Finding Medium: upload filename escapes the served tree residual of CVE-2026-35393 The multipart filename fix updown.go lines 135-136 splits on the path...
goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)
GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes PUT/POST upload/?mkdir/?delete and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route...