In-app reader
Exploit Database
__ Exploits
__ GHDB
__ Papers
__ Shellcodes
__ Search EDB
__ SearchSploit Manual
__ Submissions
**
__
Stats
__
About Us
About Exploit-DB
Exploit-DB History
FAQ
__
Search
flyto-core 2.26.7 - Arbitrary File Write
EDB-ID:
52655
CVE:
N/A
EDB Verified:
_ _
Author:
Jorge González Milla
Type:
webapps
**Exploit: **
__ / __
Platform:
Multiple
Date:
2026-08-18
Vulnerable App:
__
__
# Exploit Title: flyto-core 2.26.7 - Arbitrary File Write
# Date: 2026-07-17
# Exploit Author: Pig-Tail (Jorge González Milla)
# Vendor Homepage: https://github.com/flytohub/flyto-core
# Software Link: https://github.com/flytohub/flyto-core
# Version: flyto-core {out}")
ok = os.path.exists(OUT) and not os.path.realpath(OUT).startswith(os.path.realpath(SBX))
print("BUG CONFIRMED (arbitrary write outside sandbox)" if ok else "NOT CONFIRMED")
print(" sample content:", open(OUT).read().strip())
Tags:
Advisory/Source:
Link
__
__
Databases
Links
Sites
Solutions
Exploits
Search Exploit-DB
Google Hacking
Submit Entry
Papers
SearchSploit Manual
Shellcodes
Exploit Statistics
Databases
Exploits Google Hacking Papers Shellcodes
Links
Search Exploit-DB Submit Entry SearchSploit Manual Exploit Statistics
Sites
Solutions
Courses and Certifications Learn Subscriptions OffSec Cyber Range Proving Grounds Penetration Testing Services
__
Exploit Database by OffSec
Terms
Privacy
About Us
FAQ
Cookies
© OffSec Services Limited 2026. All rights reserved.
About The Exploit Database
** ×
The Exploit Database is maintained by OffSec, an information security training company that provides various Information Security Certifications as well as high end penetration testing services. The Exploit Database is a non-profit project that is provided as a public service by OffSec.
The Exploit Database is a CVE compliant archive of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. Our aim is to serve the most comprehensive collection of exploits gathered through direct submissions, mailing lists, as well as other public sources, and present them in a freely-available and easy-to-navigate database. The Exploit Database is a repository for exploits and proof-of-concepts rather than advisories, making it a valuable resource for those who need actionable data right away.
The Google Hacking Database (GHDB) is a categorized index of Internet search engine queries designed to uncover interesting, and usually sensitive, information made publicly available on the Internet. In most cases, this information was never meant to be made public but due to any number of factors this information was linked in a web document that was crawled by a search engine that subsequently followed that link and indexed the sensitive information.
The process known as “Google Hacking” was popularized in 2000 by Johnny Long, a professional hacker, who began cataloging these queries in a database known as the Google Hacking Database. His initial efforts were amplified by countless hours of community member effort, documented in the book Google Hacking For Penetration Testers and popularised by a barrage of media attention and Johnny’s talks on the subject such as this early talk recorded at DEFCON 13. Johnny coined the term “Googledork” to refer to “a foolish or inept person as revealed by Google“. This was meant to draw attention to the fact that this was not a “Google problem” but rather the result of an often unintentional misconfiguration on the part of a user or a program installed by the user. Over time, the term “dork” became shorthand for a search query that located sensitive information and “dorks” were included with may web application vulnerability releases to show examples of vulnerable web sites.
After nearly a decade of hard work by the community, Johnny turned the GHDB over to OffSec in November 2010, and it is now maintained as an extension of the Exploit Database. Today, the GHDB includes searches for other online search engines such as Bing, and other online repositories like GitHub, producing different, yet equally valuable results.
**Close
OffSec Resources
** ×
Databases
Links
Sites
Solutions
Exploits
Search Exploit-DB
Google Hacking
Submit Entry
Papers
SearchSploit Manual
Shellcodes
Exploit Statistics
**Close
Search The Exploit Database
** ×
Title
_
CVE
_
Type
dos
local
remote
shellcode
papers
webapps
hardware
Platform
AIX
ASP
BSD
BSD_PPC
BSD_x86
BSDi_x86
CGI
FreeBSD
FreeBSD_x86
FreeBSD_x86-64
Generator
Hardware
HP-UX
IRIX
JSP
Linux
Linux_MIPS
Linux_PPC
Linux_SPARC
Linux_x86
Linux_x86-64
MINIX
Multiple
NetBSD_x86
Novell
OpenBSD
OpenBSD_x86
OSX_PPC
OSX
PHP
Plan9
QNX
SCO
SCO_x86
Solaris
Solaris_SPARC
Solaris_x86
Tru64
ULTRIX
Unix
UnixWare
Windows_x86
Windows_x86-64
Windows
ARM
CFM
Netware
SuperH_SH4
Java
BeOS
Immunix
Palm_OS
AtheOS
iOS
Android
XML
Perl
Python
System_z
JSON
ASHX
Ruby
ASPX
macOS
Linux_CRISv32
eZine
Magazine
NodeJS
Alpha
Solaris_MIPS
Lua
watchOS
VxWorks
Python2
Python3
TypeScript
Go
Author
_
Content
_
Port
14
21
22
23
25
42
49
53
66
69
70
79
80
81
102
105
110
111
113
119
123
135
139
143
161
162
164
383
389
402
406
411
443
444
445
446
502
504
513
514
515
532
548
554
555
617
623
631
655
689
783
787
808
873
888
901
998
1000
1040
1089
1099
1100
1114
1120
1194
1235
1471
1521
1533
1581
1589
1604
1617
1723
1743
1761
1812
1858
1861
1900
1947
2000
2022
2049
2100
2103
2121
2125
2181
2242
2315
2375
2380
2381
2401
2480
2525
2640
2810
2812
2947
2954
2990
3000
3030
3050
3052
3128
3129
3181
3200
3217
3306
3333
3378
3389
3460
3465
3500
3535
3632
3690
3790
3814
3817
4000
4002
4070
4081
4105
4111
4322
4343
4434
4444
4501
4555
4592
4661
4750
4848
5000
5060
5061
5080
5081
5093
5151
5180
5247
5250
5272
5308
5432
5466
5554
5555
5600
5655
5666
5800
5803
5814
5858
5900
5984
6066
6070
6080
6082
6101
6112
6129
6379
6502
6503
6660
6667
7001
7002
7070
7071
7080
7100
7144
7210
7272
7290
7426
7443
7510
7547
7649
7770
7777
7778
7787
7879
7902
8000
8001
8002
8004
8008
8020
8022
8023
8028
8030
8080
8081
8082
8088
8090
8181
8300
8400
8443
8445
8473
8500
8585
8619
8800
8812
8839
8880
8888
9000
9001
9002
9080
9090
9091
9100
9124
9200
9251
9256
9443
9447
9784
9788
9855
9876
9900
9987
9993
9999
10000
10001
10080
10202
10203
10443
10616
11000
11211
11460
12203
12221
12345
12397
12401
13327
13701
13722
13838
16992
18821
18881
19000
19810
19813
20000
20002
20010
20031
20111
20171
22003
23423
25672
26000
27015
27700
28015
30000
30303
31337
32400
32674
32764
34205
37215
37777
37848
38292
40007
41523
44334
46824
48080
49152
50000
50496
52311
52789
52869
52986
53413
54345
54890
55554
55555
56380
57772
58080
62514
Tag
WordPress Core
Metasploit Framework (MSF)
WordPress Plugin
SQL Injection (SQLi)
Cross-Site Scripting (XSS)
File Inclusion (LFI/RFI)
Cross-Site Request Forgery (CSRF)
Denial of Service (DoS)
Code Injection
Command Injection
Authentication Bypass / Credentials Bypass (AB/CB)
Client Side
Use After Free (UAF)
Out Of Bounds
Remote
Local
XML External Entity (XXE)
Integer Overflow
Server-Side Request Forgery (SSRF)
Race Condition
NULL Pointer Dereference
Malware
Buffer Overflow
Heap Overflow
Type Confusion
Object Injection
Bug Report
Console
Pwn2Own
Traversal
Deserialization
_ Verified
_ Has App
_ No Metasploit
**Search
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.