Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-45454 — Microsoft SharePoint Server Upload Page Folder Path Traversal to Remote Code Execution

aretiq.ai | research | CVE-2026-45454 | #rce | #path-traversal | #sharepoint | #webshell | #cve-2026-45454

Summary

CVE-2026-45454: path traversal in SharePoint's Upload.aspx lets an authenticated attacker write into restricted libraries like the Master Page Gallery, escalating to RCE via ASPX webshells.
CVE
CVE-2026-45454
Published
Collected

original ↗

Related coverage

tool · github.com
Comment2Shell: Zero-Click Pre-Auth RCE Exploit Kit for WordPress (CVE-2026-93485)
Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.
High · vulnerability · github.com
WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)
While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.
research · aretiq.ai
CVE-2026-45453 — Microsoft SharePoint Server Workflow Pages DocURL Parameter Reflected Cross-Site Scripting
CVE-2026-45453: reflected XSS in three SharePoint workflow pages—DocURL is written unencoded into href attributes, executing on hover and enabling session hijacking; fixed in June 2026.
research · aretiq.ai
CVE-2026-48866 — WordPress Gravity Forms Plugin File Upload Path Traversal Arbitrary File Deletion
CVE-2026-48866: unauthenticated attackers can poison Gravity Forms entries with ../ sequences that delete arbitrary server files, including wp-config.php, when an admin removes the entry.
research · aretiq.ai
CVE-2026-48827 — Apache MINA SSHD sshd-git Path Traversal Info Disclosure
CVE-2026-48827: path traversal in Apache MINA SSHD's sshd-git module lets authenticated users escape the Git root via ../ to read from or push to arbitrary repositories.
research · swarm.ptsecurity.com
Path Traversal on Citrix XenMobile Server
CVE-2020-8209 in Citrix XenMobile Server: a path traversal in help-sb-download.jsp lets unauthenticated attackers read arbitrary files — including sftu.properties with encrypted passwords and the key files needed to decrypt them.
back