CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of...

CVE-2025-54677

Sink: Weak check only checks Content-Type, which leads to RCE system arbitrary file upload vulnerability PoC: Change the Content-Type field to image/png and the file signature to GIF87a...

PoC-CVE-2019-10743

Zip Slip Demo This project demonstrates the Zip Slip vulnerability CVE-2019-10743 using the vulnerable version of the mholt/archiver package. What is Zip Slip? Zip Slip is vulnerability that was uncovered by the security researchers from Snyk. It was found that the vulnerability is impacting...

CVE-2026-21857

CVE-2026-21857: Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Overview Field| Details ---|--- CVE ID| CVE-2026-21857 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products redaxo/source versions: = 5.20.1 CWE Classification CWE-22: Improper...

WinRAR-CVE-2025-8088-Exploitation-Toolkit

☠️ CVE-2025-8088 WinRAR Exploit Tool ☠️ SYSTEM ACCESS: GRANTED TARGET: WINRAR VULNERABILITY A sophisticated, military-grade GUI tool designed for creating malicious RAR archives that exploit the WinRAR path traversal vulnerability CVE-2025-8088. This tool leverages advanced NTFS Alternate Data...

CVE-2024-9932

CVE-2024-9932 Wux Blog Editor = 3.0.0 - Unauthenticated Arbitrary File Upload Description: The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This...

CVE-2024-23897

Jenkins File Read Vulnerability - CVE-2024-23897 CVE-2024-23897 is a critical vulnerability in Jenkins that allows unauthenticated attackers to read arbitrary files on the Jenkins controller's file system. This flaw arises from improper handling of command arguments in the args4j library,...

http-pulse_ssl_vpn.nse

SUMMARY Simple NSE script to detect Pulse Secure SSL VPN file disclosure via specially crafted HTTP resource requests. This exploit reads /etc/passwd as a proof of concept This vulnerability affect 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. INSTALLATION $ git clone...

CVE-2026-48907

CVE-2026-48907 - Joomla! JCE Unauthenticated RCE Joomla! JCE extension This tool is for educational and authorized testing purposes only. Use only on systems you own or have explicit permission to test The author is not responsible for any misuse or illegal activities Always obtain proper...

CVE-2018-14847

WinboxExploit This is a proof of concept of the critical WinBox vulnerability CVE-2018-14847 which allows for arbitrary file read of plain text passwords. Blogpost https://n0p.me/winbox-bug-dissection/ Requirements Python 3+ This script will NOT run with Python 2.x or lower. How To Use The script...

CVE-2024-31771

CVE-2024-31771 TotalAV Arbitrary File Write TotalAV version 6.0.x https://github.com/restdone/CVE-2024-31771/assets/42227817/ffe0c2ec-4ea6-4c29-852f-456b2e62f5b1 Timeline: 13th Feb, 2024 : Discovered 6.0.740 vulnerable and reported to TotalAV. 15th Feb, 2024: TotalAV confirmed and reproduced the...

imagemagick-lfi-poc

ImageMagick LFI PoC CVE-2022-44268 The researchers at MetabaseQ discovered CVE-2022-44268, i.e. ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image e.g., for resize, the resulting image could have embedded the content of an arbitrary remote file if the...

PoC-CVE-2025-3914-Aeropage-WordPress-File-Upload

CVE-2025-3914 - Arbitrary File Upload in Aeropage Sync for Airtable WordPress Description The Aeropage Sync for Airtable WordPress plugin ≤ v3.2.0 is vulnerable to authenticated arbitrary file uploads due to insufficient file type validation in the aeropagemediadownloader function. Attack Vector ...

tpadmin-CVE-2026-2113-poc

tpadmin-CVE-2026-2113-poc A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload. Vulnerability Description A critical Remote Code Execution vulnerability exists in H-ui.admin system's WebUploader preview component. The...

CVE-2023-45878

CVE-2023-45878 CVE-2023-45878 GibbonEdu Arbitrary File Write...

CVE-2026-52680_exploit

CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbitrary File Write Unauthenticated arbitrary file write in Apache Kyuubi's REST API via the multipart batch-submission endpoint. POST /api/v1/batches multipart/form-data writes the resourceFile part to $KYUUBIHOME/work/upload// using the...

CVE-2025-3616

Metasploit Module: Greenshift WordPress Plugin Arbitrary File Upload CVE-2025-3616 This repository contains a Metasploit module to exploit CVE-2025-3616 , an arbitrary file upload vulnerability in the Greenshift WordPress plugin versions 11.4 through 11.4.5. The exploit allows authenticated users...

sudowp-dropzone-elementor

SudoWP DropZone for Elementor Contributors: SudoWP, WP Republic Original Authors: WEB-SHOP-HOSTING Tags: elementor, dropzone, upload, security-patch, fork, cve-2024-5153, honeypot Requires at least: 5.6 Tested up to: 6.7 Stable tag: 1.7.17 License: GPLv2 or later Security Notice This is a...

CVE-2025-32682

🐚 CVE-2025-32682 - Arbitrary File Upload in MapSVG Lite = 8.5.34 📌 Plugin Details Name: MapSVG Lite Affected Version: = 8.5.34 Vulnerability Type: Arbitrary File Upload CVE ID: CVE-2025-32682 Published Date: 15 April, 2025 CVSS Score: 9.9 Critical 💥 Vulnerability Summary The MapSVG Lite plugin fo...

CVE-2021-43798

CVE-2021-43798 Grafana unauthorized arbitrary file reading vulnerability On December 4, 2021, a security researcher revealed an arbitrary file reading vulnerability in Grafana on the Internet. Unauthorized attackers can use this vulnerability to obtain sensitive files on the server. The...