CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Unauthenticated Arbitrary File Upload. Description : The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to missing file type validation and missing capability checks in the...

CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---Joomla

CVE-2026-21627 Unauthenticated Arbitrary File Inclusion in Joomla's Novarain Framework nrframework Overview A critical vulnerability in the Tassos/Novarain Framework plgsystemnrframework Joomla plugin allows unauthenticated attackers to include arbitrary PHP files on the server, instantiate...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Unrestricted File Upload to RCE Description Bludit CMS versions before 3.18.4 allow an authenticated attacker with a valid API token to upload files of any type and extension via the POST /api/files/ endpoint. The uploadFile function performs no file extension or...

CVE-2026-4350

CVE-2026-4350 - Perfmatters WordPress Arbitrary File Deletion Description CVE-2026-4350 is an arbitrary file deletion vulnerability in the Perfmatters WordPress plugin. CVE Details CVE: CVE-2026-4350 Severity: HIGH CVSS: 8.1 Affected Plugin: Perfmatters Affected Version: = 2.5.9.1 Exploit python3...

CVE-2025-68001

CVE-2025-68001 WordPress g-FFL Checkout Plugin 📡 Stay ahead of the curve. Join @KNxploited on Telegram — your exclusive source for the latest CVEs, zero-days, and cutting-edge exploit research. Updated constantly. Not for everyone. 📋 Overview CVE-2025-68001 is a critical Unauthenticated Arbitrary...

CVE-2026-31431-CopyFail-Lab

CVE-2026-31431 "Copy Fail" — Linux Kernel LPE Lab Overview This repository documents a complete lab investigation of CVE-2026-31431 Copy Fail , a high-severity local privilege escalation LPE vulnerability in the Linux kernel's algifaead cryptographic module, disclosed on April 29, 2026. CVSS Scor...

CVE-2021-43798

CVE-2021-43798 by Privacy Hunter Affected versions: Grafana 8.0.0-beta1 to 8.3.0 patched versions excluded Vulnerability type: Directory Traversal Severity: Critical Platform: Grafana open-source monitoring and observability platform ⚠️ Vulnerability details Directory traversal can be performed in...

CVE-2026-30345

CVE-2026-30345 Proof of Concept Arbitrary file write vulnerability in CTFd 3.8.2 backup import functionality. Quick Start Before running cve202630345bashrcpoc.py Make sure to update the values accordingly for your exploit. Values such as RHOST, ATTACKER IP or PORT, and the credentials used for th...

CVE-2024-42845-Exploit

CVE-2024-42845: Remote Code Execution RCE in Invesalius 3.1 Exploit Details Exploit Title : Invesalius 3.1 - Remote Code Execution RCE Discovered By : Alessio Romano sfoffo, Riccardo Degli Esposti partywave Exploit Author : Alessio Romano sfoffo, Riccardo Degli Esposti partywave Date : 2024-08-23...

CVE-2024-40111-Exploit

CVE-2024-40111: Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Exploit Details Exploit Title : Stored Cross-Site Scripting XSS in Automad 2.0.0-alpha.4 Date : 2024-06-20 Exploit Author : Jerry Thomas w3bn00b3r Vendor Homepage : Automad Software Link : Automad GitHub Repository Category ...

CVE-2024-27115-Exploit

SOPlanning 1.52.01 - Remote Code Execution RCE Authenticated Exploit Details Exploit Title : SOPlanning 1.52.01 Simple Online Planning Tool - Remote Code Execution RCE Authenticated Date : 6th October, 2024 Exploit Author : Ardayfio Samuel Nii Aryee Version : 1.52.01 Tested on : Ubuntu Descriptio...

CVE-2026-22038

CVE-2026-22038 — AutoGPT Stagehand Blocks Log API Keys in Plaintext CVE ID: CVE-2026-22038 Product: AutoGPT Platform Stagehand integration Affected Versions: All versions up to and including autogpt-platform-beta-v0.6.45 Patched In: autogpt-platform-beta-v0.6.46 Vulnerability Type: CWE-532 —...

CVE-2025-56223

CVE-2025-56223 Denial of Service – Upload Document API Description An attacker can rapidly upload a large volume of files to cause denial of service. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Nadi...

CVE-2025-56218

CVE-2025-56218 Unrestricted File Upload Description An attacker may upload an Excel file that contains a malicious script or a phishing URL. The application converts the file to PDF and forwards it to the intended recipient for digital signature. Because hyperlinks in the generated PDF are...

CVE-2026-41551

CVE-2026-41551 Reproduction Vulnerability: Siemens ROS fileserver / fileserver2 service relative path traversal CVSS v3.1: 9.1 AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:N Affected versions: ros-sharp all name.substr10; // remove "package://" std::string package = address.substr0,...

CVE-2021-41277_SSRF

CVE-2021-41277SSRF CVE-2021-41277 can be extended to an SSRF Description Metabase is an open source data analytics platform. Metabase versions 0.40.5 were affected by CVE-2021-41277 which led to local file inclusion according to the CVE description. While analyzing the finding described in Metaba...

CVE-2026-111234

The SimplePie library (through version 1.9.0 ) contains a local file read vulnerability. The root cause is the handling of file:// URLs within redirects or autodiscovery links, which can cause the file_get_contents() function to read files accessible to the web server process. Malicious feed serv...

EUVD-2026-102346

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111234 SimplePie through 1.9.0 Local File Read via file:// Redirect

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

EUVD-2026-102342

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...