Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

Flowise - Path Traversal

Flowise = 2.2.8 contains a path traversal vulnerability caused by missing validation of chatflowId and chatId parameters in file handling, letting unauthenticated attackers read and write arbitrary files, exploit requires no authentication. id: CVE-2025-71334 info: name: Flowise - Path Traversal...

YouPHPTube Encoder - Arbitrary File Write

Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack. id: CVE-2019-5128 info: name: YouPHPTube Encoder - Arbitrary...

SiYuan - SQL Execution

SiYuan = v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleRead...

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

SeaweedFS <= 4.29 - Path Traversal File Write

SeaweedFS versions through 4.29 build the S3 API and Iceberg REST catalog routers with mux.NewRouter.SkipCleantrue, which disables URL path cleaning. A .. segment in the request path therefore survives routing and reaches the handlers unnormalised, so a request such as PUT...

FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write

FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled destination field from the JSON request body against the application directory with only a leading underscore prefix and no...

All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage...

DB-GPT <= 0.8.1 - Arbitrary File Write

DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the userid HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON...

Xerte Online Toolkits <= 3.15 - Remote Code Execution

Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication CVE-2026-34413, because the access-control redirect for unauthenticated users does not call exit/die and execution continues server-side. This is...

Camaleon CMS < 2.8.1 Arbitrary File Write to RCE

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a remote...

Gotenberg <= 8.30.1 - Remote Code Execution

Gotenberg through 8.30.1 sanitizes only the keys of the JSON metadata submitted to the PDF metadata write endpoint, leaving the values unvalidated. A newline inside a metadata value is written straight to the ExifTool process standard input, where it terminates the current argument and starts a n...

esm.sh <= v136 - Arbitrary File Write via Path Traversal

esm.sh = 136 contains a path traversal caused by improper canonicalization of the X-Zone-Id HTTP header, letting attackers write files outside the intended storage directory, exploit requires crafted header input. id: CVE-2025-59342 info: name: esm.sh = v136 - Arbitrary File Write via Path...

CVE-2022-30333

A proof of concept for CVE-2022-30333 - a path traversal vulnerability in unRAR versions prior to 6.11. I created this as a demonstration of the exploit for an AttackerKB writeup, and hope to incorporate it in a Metasploit Module soon! Basically, you provide a target including path traversal and...

CVE-2023-47564

CVE-2023-47564 https://www.qnap.com/en/security-advisory/qsa-24-03 https://vulners.com/cve/CVE-2023-47564 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 8.1 "An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the...

CVE-2026-86981

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination...

CVE-2026-86953

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An attacker in physical proximity may be able to cause a denial-of-service...

CVE-2026-86944

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination...

CVE-2026-86918

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination...