#lfi
3 registros
-
Facts
Camaleon CMS 2.9.0: mass assignment (CVE-2025-2304) vira admin, path traversal (CVE-2024-46987) lê a chave SSH e sudo facter dá root.
-
Pterodactyl
Pterodactyl Panel 1.11.10 LFI→RCE (CVE-2025-49132); privesc openSUSE: polkit allow_active (CVE-2025-6018) + libblockdev XFS nosuid (CVE-2025-6019).
-
Imagery
App Python/Werkzeug: stored XSS rouba o cookie do admin, LFI exfiltra o source e command injection dá foothold; root via sudo no backup manager charcol.