CVE-2024-5084-Red-Team

🚀 HashForm Exploit – Lab Demo This repository contains a proof-of-concept exploit for CVE-2024-5084, a vulnerability found in the Hash Form WordPress plugin. It’s meant only for learning, lab testing, and security research. 📌 About the Vulnerability CVE ID: CVE-2024-5084 Issue: Unauthenticated fi...

dp_crypto

dpcrypto Exploit de oráculo de cifrado basado en Base64 para CVE-2017-9248 Manejador de diálogo de Telerik UI for ASP.NET AJAX Publicado en exploit-db Actualización 2020 - Tenga en cuenta que la versión en exploit-db ahora está muy desactualizada en comparación con la última versión aquí en GitHu...

beanshooter

beanshooter beanshooter es una herramienta de enumeración y ataque JMX que ayuda a identificar vulnerabilidades comunes en endpoints JMX. https://user-images.githubusercontent.com/49147108/183278179-4a5566a7-5af8-4ce8-a73d-1016876a36d5.mp4 Instalación beanshooter es un proyecto maven y la...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...

CVE-2023-4220-Proof-of-concept

CVE-2023-4220-Proof-of-concept Chamilo LMS Unauthenticated Big Upload File that allows remote code execution CODE IS MADE AND USED FOR HACKTHEBOX CTF PERMX Unauthenticated file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS the php...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload Task → No Auth → 3-String Filter Bypass Overview Unauthenticated arbitrary file upload in DJ-Classifieds for Joomla. The imageupload task endpoint processes file uploads without authentication and relies on a 3-string blocklist ?php, eval, base...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-Injection

CVE-2021-46079 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Html Injection Exploit Author: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 HIGH References: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injection...

fuxploider

fuxploider Fuxploider è uno strumento di penetration testing open source che automatizza il processo di rilevamento e sfruttamento delle vulnerabilità dei form di upload di file. Questo strumento è in grado di rilevare i tipi di file consentiti per l'upload e di determinare quale tecnica funzione...

CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager Arbitrary File Write Path Traversal -orange 📋 Description CVE-2026-20262 is a Path Traversal CWE-22 vulnerability in the web interface of Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage. It allows an authenticated attacker with write permission...

Apache-Pluto-3.0.0--CVE-2018-1306

CVE-2018-1306 Problema en la lógica de autorización de Apache Pluto 3.0.0 que permite a un atacante cargar archivos maliciosos manipulando métodos HTTP. Script escrito en python3. Uso: python3 ./plutorce.py http://192.168.0.1/ webshell.jsp...

CVE-2015-9331

CVE-2015-9331 POC Vulnerability Description CVE-2015-9331 is an arbitrary file upload vulnerability in the WordPress plugin WP All Import. This vulnerability allows an unauthenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution. Affected Versions...

WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload

WordPress Backup Guard plugin before 1.6.0 is susceptible to authenticated arbitrary file upload. The plugin does not ensure that imported files are in SGBP format and extension, allowing high-privilege users to upload arbitrary files, including PHP, possibly leading to remote code execution. id:...

Cisco HyperFlex HX Data Platform - Arbitrary File Upload

Cisco HyperFlex HX Data Platform contains an arbitrary file upload vulnerability in the web-based management interface. An attacker can send a specific HTTP request to an affected device, thus enabling upload of files to the affected device with the permissions of the tomcat8 user. id:...

Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

IncomCMS 2.0 - Arbitrary File Upload

IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server. id: CVE-2020-29597 info: name: IncomCMS 2.0 - Arbitrary File Upload author: princechaddha severity: critical description: |...

Bonita Web 2021.2 - Authentication/Authorization Bypass

Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL. id:...

Roxy Fileman 1.4.5 - Unrestricted File Upload

Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. id: CVE-2018-20526 info: name: Roxy Fileman 1.4.5 -...

DELMIA Apriso - Command Injection

An Improper Control of Generation of Code code injection / file upload → RCE vulnerability affecting DELMIA Apriso Release 2020 → Release 2025. When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place...

CVE-2024-6651

CVE-2024-6651 POC XSS - CVE-2024-6651 Functional PoC for vulnerability CVE-2024-6651, which affects the plugin WP File Upload 4.24.8, allowing Reflected Cross-Site Scripting XSS in WordPress. 📌 Description This vulnerability allows arbitrary JavaScript code injection via an unsanitized parameter ...

CVE-2024-41312.

CVE-2024-41312. InstantCMS - Stored Cross Site Scripting XSS Affected Version: InstantCMS 2.16.3 Steps to Reproduce: 1. Log in to https://demo.instantcms.io as an demo user. 2. Visit https://demo.instantcms.io/photos/upload. 3. Upload the image with the embedded payload test in the Camera Model...