CVE-2026-5203

CVE-2026-5203 — CMS Made Simple ≤ 2.2.22 RCE Path Traversal + Arbitrary File Upload Summary The UserGuide module's XML import functionality in CMS Made Simple ≤ 2.2.22 fails to sanitize user-supplied filenames, allowing an authenticated administrator to upload arbitrary files e.g. PHP web shells...

CVE-2026-6815

CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 Path Traversal & Arbitrary File Write Authenticated This repository contains a Proof of Concept PoC exploit for CVE-2026-6815, an arbitrary file write and path traversal vulnerability in Casdoor. The vulnerability has been fixed in version 3.54.1...

CVE-2025-56399

CVE-2025-56399 – Authenticated Remote Code Execution in laravel-file-manager v3.3.1 🧭 Overview An authenticated Remote Code Execution RCE vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. By...

CVE-2026-21137

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege...

CVE-2025-49132-poc

CVE-2025-49132-poc I made this poc for CVE-2025-49132, as it was interesting to make and it's part of a challenge over at my cyber platform deepreview ! This CVE takes advantage of a file inclusion vulnerability that can be escalated to a Remote Code Execution with the pearcmd.php script. This is...

CVE-2020-1611

Juniper Junos Space prior to 19.4R1 Local File Inclusion Vulnerability CVE-2020-1611 PoC Juniper Junos Space prior to 19.4R1 is vulnerable to a local file inclusion vulnerability. An attacker with normal user rights could exploit this vulnerability. The "Download Report" function is vulnerable...

CVE-2025-69080

Gecko Theme LFI Exploit CVE-2025-69080 Unauthenticated Local File Inclusion LFI vulnerability in WordPress Gecko Theme = 1.9.8 ⚠️ Description This exploit targets a high-severity CVSS 8.1 Local File Inclusion vulnerability in the JanStudio Gecko WordPress theme. The vulnerability allows an...

CVE-2025-6440

🧨 CVE-2025-6440 – WooCommerce Designer Pro Unrestricted File Upload Unauthenticated Arbitrary File Upload viawcdpsavecanvasdesignajax WooCommerce Designer Pro plugin – Remote Code Execution RCE 📖 Description The WooCommerce Designer Pro plugin for WordPress contains an unauthenticated arbitrary...

CVE-2026-21137

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege...

EUVD-2026-97201

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege...

CVE-2026-21137

A path traversal vulnerability exists in Smart Switch prior to version 3.7.73 . This flaw allows physical attackers to access files with Smart Switch privilege . No specific exploit details or remediation steps are provided in the documents.

CVE-2023-38831

CVE-2023-38831 winrar exploit 6.22 = Quick poc git clone https://github.com/nhman-python/CVE-2023-38831.git cd cd CVE-2023-38831 python3 poc.py poc example usage python3 simplefile.txt script.bat output.zip...

CVE-2026-87690

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is vulnerable to a relative path traversal (CWE-22). The module fails to sanitize file names from a Meterpreter directory listing—controlled by a hostile iOS device—when interpolating them into a local destination path fo...

EUVD-2026-97177

The Metasploit Framework post module post/appleios/gather/iosimagegather is affected by a relative path traversal vulnerability CWE-22. The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the loc...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

CVE-2026-6271

CVE-2026-6271 — Career Section WordPress Plugin RCE Scanner Plugin: Career Section career-section CVE ID: CVE-2026-6271 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Vulnerability Type: Unauthenticated Arbitrary File Upload → Remote Code Execution Affected...

CVE-2025-66802

CVE-2025-66802 Sourcecodester Covid-19 Contact Tracing System 1.0 – Unrestricted File Upload Leading to Remote Code Execution Description Sourcecodester Covid-19 Contact Tracing System version 1.0 contains a vulnerability classified as Unrestricted Upload of File with Dangerous Type CWE-434. The...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory in the File Picker Menu. Attack Vectors: Scripting A vulnerability in the...

POC-ES-File-Explorer-CVE-2019-6447

PoC ES File Explorer 4.1.9.7.4 CVE-2019-6447 This is a very simple implementation in bash of the CVE-2019-6447 PoC. It basically uses curl to send the requests with the right parameters. I've built it as I was looking for a similar script during a CTF and couldn't find any. You can play around wi...

CVE-2024-10410

Source code Online Hotel Reservation System in PHP/MySQLi with Source Code | SourceCodester Description A high risk vulnerability was found in Online Hotel Reservation System, affecting the upload function of /marimar/admin/modroom/controller.php file. The bypass detection operation of image...