CVE-2026-48908-by-yora

🔐 CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder — Unauthenticated File Upload / Potential RCE Developed byyora 📌 About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...

Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Remote Code Execution RCE Exploit Description This script exploits a Remote Code Execution RCE vulnerability in Pluck CMS v4.7.18. The vulnerability allows a malicious user to upload a malicious PHP file to the server and execute it, gaining remote command...

cve-2025-0364

CVE-2025-0364: BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE The BigAntSoft BigAnt Server, which provides a Windows hosted on-premises chat server that focuses on business use cases, is vulnerable to unauthenticated remote code execution via account registration and PHP...

CVE-2025-45955

CVE-2025-45955 Server-Side Request Forgery in DonWeb Ferozo CVE-2025-45955 Description An attacker can exploit this vulnerability by uploading and executing a specially crafted PHP file on the Ferozo hosting platform. When accessed, the file launches a series of SSRF attempts targeting internal...

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

Xerte Online Toolkits <= 3.15 - Remote Code Execution

Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication CVE-2026-34413, because the access-control redirect for unauthenticated users does not call exit/die and execution continues server-side. This is...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-frameworkclass MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q This exploit requires Metasploit to have a FQDN and the...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

CVE-2020-5844

CVE-2020-5844 Authenticated RCE in PandoraFMS 7.0-NG 742 Admin privileged attackers can upload malicious PHP documents. By decoding the base64 file location users can gain a shell as apache user. Discovered by TheCyberGeek PoC python script Usage: python3 CVE-2020-5844.py URL USER PASS...

exploit-CVE-2020-5844

Exploit for CVE-2020-5844 Pandora FMS v7.0NG.742 - Remote Code Execution Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description...

YOURLS: Unauthenticated File Inclusion

Summary YOURLS versions ≤1.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials. Details The vulnerability exists because YOURLS uses URL sanitization functions yourlssanitizeurl,...

CVE-2024-27115-Exploit

SOPlanning 1.52.01 - Remote Code Execution RCE Authenticated Exploit Details Exploit Title : SOPlanning 1.52.01 Simple Online Planning Tool - Remote Code Execution RCE Authenticated Date : 6th October, 2024 Exploit Author : Ardayfio Samuel Nii Aryee Version : 1.52.01 Tested on : Ubuntu Descriptio...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Authenticated Administrator+ Arbitrary File Upload via 'mdjmemailuploadfile' Parameter The WordPress MDJM Event Management plugin version 1.7.8.3 and prior contains an arbitrary file upload vulnerability that allows authenticated administrators to upload maliciou...

Unrestricted-File-Upload-on-SiteMagic-CMS-4.4.2

Unrestricted File Upload on SiteMagic CMS 4.4.2 This repo describe how to exploit unrestricted file upload vulnerability on SiteMagic CMS 4.4.2 About SiteMagic CMS 4.4.2 Website: https://sitemagic.org/ Download: https://sitemagic.org/Download.html PoC - Exploiting unrestricted file upload...

tpadmin-CVE-2026-2113-poc

tpadmin-CVE-2026-2113-poc A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload. Vulnerability Description A critical Remote Code Execution vulnerability exists in H-ui.admin system's WebUploader preview component. The...

MSAPer

MSAPer | CVE-2023-3076 - MStore API Automatic Mass Tool for check and exploiting vulnerability in CVE-2023-3076 - MStore API install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use Make sure you already install Parallel! Then do: git clone...

CVE-2026-36340

CVE-2026-36340 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critical Affected Product: Krayin CRM v2.1.5 Vulnerability Type: Remote Code Execution RCE Authentication Required: Yes Summary A...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC Exploit alt text ExploitDB Dompdf versions 1.2.1 are vulnerable to Remote Code Execution RCE by injecting CSS into the data. The file can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed b...

textpattern-exploit-rce

Textpattern = 4.8.3 Remote Code Execution Authenticated Textpattern until version 4.8.3 allows authenticated users to upload any PHP file. This script automates the process and allows to delete the uploaded file. Usage python3 exploit.py -t TARGET -u USER -p PASSWORD -c COMMAND -f FILENAME -d -t:...

tinyfilemanager-2.4.3-exploit

CVE-2021-45010 Tiny File Manager-2.4.3 exploit A Path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager Project's Tiny File Manager = 2.4.6 allows remote attackers with valid user accounts to upload malicious PHP files to the webroot and achieve...