Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-29909-MRCMS-vulnerability — Unauthenticated directory enumeration PoC for MRCMS V3.1.2, exploiting missing authentication in /admin/file/list.do to disclose server directory structure and sensitive files. | Kitploit
Tools/GitHubGitHub/qflksheep/cve-2026-29909-mrcms-vulnerability
Vulnerability AnalysisExploitationInformation GatheringWeb SecurityPenetration Testing
GitHubqflksheep/cve-2026-29909-mrcms-vulnerability

CVE-2026-29909-MRCMS-vulnerability

Unauthenticated directory enumeration PoC for MRCMS V3.1.2, exploiting missing authentication in /admin/file/list.do to disclose server directory structure and sensitive files.

View Repository
5 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-29909: MRCMS V3.1.2 - Unauthenticated Directory Enumeration

CVE ID

CVE-2026-29909

Description

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without any credentials.

Proof of Concept (PoC)

root@kitploit:~
GET /admin/file/list.do?path=../../../src/main/resources/ HTTP/1.1
Host: target-server

Impact

  • Unauthorized access to server directory structure
  • Exposure of sensitive configuration files
  • Information disclosure that may lead to further attacks

Credit

Discoverer: zyh

Download Tool