flatCore 1.5.5 - Arbitrary File Upload

Exploit Title: flatCore 1.5.5 - Arbitrary File Upload Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/flatCore/flatCore-CMS Software Link: https://github.com/flatCore/flatCore-CMS Version: 1.5.5 Tested on: Ubuntu Windows CVE : CVE-2019-10652 PoC： 1 1. Access the...

📄 flatCore 1.5.5 Shell Upload

flatCore version 1.5.5 suffers from a remote shell upload vulnerability. Exploit Title: flatCore Arbitrary .php File Upload via acp/acp.php Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/flatCore/flatCore-CMS Software Link: https://github.com/flatCore/flatCore-CMS...

WordPress AI Hub Theme <= 1.3.3 is vulnerable to Arbitrary File Upload

Software AI Hub Type Theme Vulnerable versions = 1.3.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2025-26927 Patch priority High CVSS severity High 10 Developer EPC PSID 5de783124503 Credits luc Required privilege Unauthenticated Published 10 April, 2025...

WordPress Squeeze plugin <= 1.6 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by astra.r3verii in WordPress Plugin Squeeze versions = 1.6...

CVE-2025-31002 WordPress Squeeze plugin <= 1.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: from n/a through = 1.6...

CVE-2025-31002 WordPress Squeeze plugin <= 1.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: from n/a through = 1.6...

CVE-2025-32576 WordPress WP shop plugin <= 2.6.1 - CSRF to Arbitrary File Upload vulnerability

Cross-Site Request Forgery CSRF vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows Upload a Web Shell to a Web Server.This issue affects WP shop: from n/a through = 2.6.1...

CVE-2025-32576 WordPress WP shop plugin <= 2.6.0 - CSRF to Arbitrary File Upload vulnerability

Cross-Site Request Forgery CSRF vulnerability in Agence web Eoxia - Montpellier WP shop allows Upload a Web Shell to a Web Server. This issue affects WP shop: from n/a through 2.6.0...

WordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000025 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phan Trong Quan - VNPT Cyber Immunity in WordPress Plugin Insert or Embed Articulate Content into WordPress versions = 4.3000000025...

WordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Processing Projects versions = 1.0.2...

WordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Le Ngoc Anh in WordPress Plugin WP Remote Thumbnail versions = 1.3.2...

CVE-2025-2525 Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'stAuthenticationController::editprofile' function in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with subscriber-level and above...

CVE-2025-2525 Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'stAuthenticationController::editprofile' function in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with subscriber-level and above...

WordPress Streamit plugin <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Theme Streamit versions = 4.0.1...

WordPress Accessibility Suite plugin <= 4.18 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by theviper17 in WordPress Plugin Accessibility Suite versions = 4.18...

WordPress Streamit Theme <= 4.0.1 is vulnerable to Arbitrary File Upload

Software Streamit Type Theme Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-2525 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 0e50f93134fe Credits István Márton Required privilege Subscriber...

📄 WordPress Royal Elementor Addons 1.3.78 Shell Upload

WordPress Royal Elementor Addons plugin versions 1.3.78 and below suffer from a remote shell upload vulnerability. Exploit Title: WordPress Plugin Royal Elementor Addons = 1.3.78 - Unauthenticated Arbitrary File Upload RCE Date: 2025-04-04 Exploit Author: Sheikh Mohammad Hasan...

Exploit for Unrestricted Upload of File with Dangerous Type in Etoilewebdesign Front_End_Users

WordPress FEUP Arbitrary File Upload Exploit CVE-2025-2005 T...

Arbitrary File Upload

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Arbitrary File Upload due to the TryZipProviderSafe process. An attacker can create files with unauthorized extensions by exploiting...

CVE-2024-13744

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validateproductinputfieldsonaddtocart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the...