Tag
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF
2 rules 3 TTPs 2 IOCsNodemailer versions up to 9.0.0 are vulnerable to arbitrary local file read and full-response Server-Side Request Forgery (SSRF) when handling untrusted input for the message-level `raw` option, bypassing intended security flags and allowing sensitive content to be exfiltrated via an attacker-controlled recipient.
Portainer Arbitrary File Read via Git Symlink Injection
2 rules 5 TTPsPortainer is vulnerable to an arbitrary file read vulnerability due to Git symlink injection when deploying stacks from Git repositories, allowing authenticated users to read sensitive files accessible to the Portainer process.
Dalfox Server Mode Unauthenticated Arbitrary File Read
2 rules 3 TTPsDalfox server mode is vulnerable to an unauthenticated arbitrary file read with out-of-band exfiltration via the `custom-payload-file` parameter, allowing attackers to read sensitive files on the host.
Everest Forms Plugin Arbitrary File Read and Deletion Vulnerability
2 rules 3 TTPs 1 CVEThe Everest Forms plugin for WordPress is vulnerable to arbitrary file read and deletion, allowing unauthenticated attackers to access sensitive data or cause denial of service by manipulating the 'old_files' parameter in versions up to 3.4.4.
WP Customer Area Plugin Arbitrary File Read and Deletion Vulnerability
2 rules 1 TTP 1 CVEThe WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation, allowing authenticated attackers to read sensitive files or delete critical files leading to potential remote code execution.
Unlimited Elements for Elementor WordPress Plugin Arbitrary File Read (CVE-2026-4659)
2 rules 1 TTP 1 CVEThe Unlimited Elements for Elementor plugin for WordPress is vulnerable to arbitrary file read due to insufficient path traversal sanitization, allowing authenticated attackers to read sensitive files from the WordPress host.
HashiCorp go-getter Arbitrary File Read Vulnerability (CVE-2026-4660)
2 rules 1 TTP 1 CVE 1 IOCHashiCorp's go-getter library up to v1.8.5 is vulnerable to arbitrary file reads on the file system during certain git operations through a maliciously crafted URL (CVE-2026-4660), potentially allowing attackers to access sensitive information.
Gotenberg Chromium Deny-List Bypass via Case-Insensitive URL Scheme
2 rules 1 TTPGotenberg versions before 8.29.0 are vulnerable to unauthenticated arbitrary file read, where a case-insensitive URL scheme bypasses the Chromium deny-list, allowing attackers to read sensitive files such as /etc/passwd by using mixed-case or uppercase URL schemes like FILE:///etc/passwd, leading to the leakage of sensitive data from the Gotenberg container and bypassing the fix for CVE-2024-21527.
Weaver E-cology Arbitrary File Read Vulnerability (CVE-2022-50992)
2 rules 1 TTP 1 CVEUnauthenticated remote attackers can exploit an arbitrary file read vulnerability (CVE-2022-50992) in Weaver E-cology 9.5 versions prior to 10.52 via the XML-RPC endpoint to access sensitive files.