CVE-2025-49113

CVE-2025-49113 – PoC de Ejecución Remota de Código RCE en Roundcube Este repositorio contiene un exploit Proof-of-Concept PoC para CVE-2025-49113 , una vulnerabilidad crítica de ejecución remota de código en versiones de Roundcube Webmail anteriores a 1.5.10 y 1.6.11. La vulnerabilidad surge de u...

VvvebJs <= 2.0.5 - Cross-Site Scripting

Givanz Vvvebjs = 2.0.5 contains a stored XSS caused by manipulation of the "uploadAllowExtensions" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2026-5615 info: name: VvvebJs = 2.0.5 - Cross-Site Scripting author:...

roundcube-cve-2025-49113-lab

DESCARGO DE RESPONSABILIDAD: Solo para uso educativo Laboratorio de RCE en Roundcube Webmail – CVE-2025-49113 Este repositorio documenta mi explotación paso a paso de Roundcube Webmail CVE-2025-49113 en un laboratorio controlado para obtener el secreto almacenado en /secret.txt. ⚠️ Descargo de...

CVE-2025-46078

BUGAuthor: yggcwhat Versión afectada: Huocms Proveedor: https://huocms.com/ Dirección del código fuente: https://gitee.com/digital-flag/huocms Archivo vulnerable: Upload.php Versión afectada： HuoCMS - controller - backend, el parámetro resourcetype se valida contra una lista blanca de extensiones...

CVE-2025-49113

Script en Python para CVE-2025-49113 Uso: python exploit.py https://ubuntu.com/security/CVE-2025-49113 Descripción: Roundcube Webmail anterior a 1.5.10 y 1.6.x anterior a 1.6.11 permite la ejecución remota de código por parte de usuarios autenticados porque el parámetro from en una URL no se vali...

exploit-CVE-2025-49113

CVE-2025-49113 PoC Repository Overview of CVE-2025-49113 CVE-2025-49113 is a critical vulnerability affecting Roundcube Webmail versions prior to 1.5.10 and 1.6.11. Discovered in 2025, this flaw allows remote code execution RCE through PHP Object Deserialization in the /settings/upload.php...

Exploit for CVE-2026-45140

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-71415: Missing Authorization

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

CVE-2026-5096: Server-Side Request Forgery (SSRF)

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

EUVD-2026-46135

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

CVE-2026-16327

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

CVE-2026-16327: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

CVE-2026-16327

The CVE-2026-16327 entry concerns D-Link DNS-320 firmware 1.0.2 where the /web/web_file/upload.php upload handling is vulnerable. Manipulating the File argument enables unrestricted file upload, with the attack executable remotely. The exploit has been publicly disclosed. No further remediation d...

CVE-2026-16327 D-Link DNS-320 upload.php unrestricted upload

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

CVE-2018-25335

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to...

CVE-2018-25335 WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to...

CVE-2018-25335: Missing Authentication for Critical Function

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to...

PT-2026-41561

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to...

CVE-2025-41029: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'...

CVE-2026-5624

CVE-2026-5624 affects ProjectSend r2002; vulnerable component is unknown code in file upload.php, where a manipulation enables cross-site request forgery. Attacks can be initiated remotely and the exploit has been publicly released. Remediation is upgrading to version r2029; the patch is identifi...