189 matches found
Check-WP-CVE-2020-35489
Check-WP-CVE-2020-35489 CVE-2020-35489 The CVE-2020-35489 is discovered in the WordPress plugin Contact Form 7 5.3.1 and older versions. By exploiting this vulnerability, attackers could simply upload files of any type, bypassing all restrictions placed regarding the allowed upload-able file type...
RSFiles! for Joomla - Arbitrary File Upload
RSFiles! comrsfiles for Joomla 1.17.12 allows unauthenticated arbitrary file upload via the rsfiles.upload task. The write method performs no authentication, CSRF token, or file extension checks, allowing upload of executable PHP files to the web-accessible downloads/ directory. id: CVE-2026-5782...
CVE-2025-66802
CVE-2025-66802 Sourcecodester Covid-19 Contact Tracing System 1.0 – Unrestricted File Upload Leading to Remote Code Execution Description Sourcecodester Covid-19 Contact Tracing System version 1.0 contains a vulnerability classified as Unrestricted Upload of File with Dangerous Type CWE-434. The...
WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE
The Super Backup & Clone - Migrate for WordPress plugin indeed-wp-superbackup is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to and including 2.3.3. Unauthenticated attackers can...
Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload
Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress = 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit...
ShowDoc - Remote Code Execution
The open-source API documentation tool ShowDoc had a remote code execution vulnerability before version 2.8.7 This vulnerability allowed unauthenticated remote attackers to upload .php files because the image upload function was not authenticated and the file extension validation was improper. id...
Vanna - SQL injection
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
CVE-2026-1357
CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...
CVE-2026-Pending-Django-Summernote-RCE
CVE-2026-XXXXX Pending: django-summernote Arbitrary File Upload RCE This repository contains a Proof of Concept PoC for a Conditional Remote Code Execution RCE vulnerability discovered in django-summernote version 0.8.20.0 and earlier. Vulnerability Details Product : django-summernote Version : =...
CVE-2024-49653
📜 WordPress Portfolleo Plugin Exploit CVE-2024-49653 🚨 Vulnerability Details Title: WordPress Portfolleo plugin = 1.2 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in James Eggers Portfolleo portfolleo allows uploading a web shell...
CVE-2024-49668
🚨 CVE-2024-49668: Vulnerabilidad de subida arbitraria de archivos en el plugin Verbalize WP de WordPress 📋 Resumen CVE-2024-49668 es una vulnerabilidad crítica en las versiones 1.0 y anteriores del plugin Verbalize WP de WordPress. Esta vulnerabilidad permite a atacantes no autenticados subir...
CVE-2026-32475
CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-32475 CVSS 9.0 Critical, CWE-434: an unauthenticated arbitrary file upload in the Elementor Pro Forms module that leads to remote code execution. Fixed in Elementor Pro 4.2.2 2026-08-19. Reported b...
CVE-2026-1657
CVE-2026-1657: Carga Arbitraria de Archivos sin Autenticación en el Plugin EventPrime Aviso de exención de responsabilidad: Este repositorio se crea con fines educativos y divulgación ética exclusivamente. La vulnerabilidad ha sido reportada responsablemente al proveedor y ha sido parcheada. No...
CVE-2020-13671-old
CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...
CVE-2026-49827
WebErpMesv2 (Resource Management and Manufacturing Execution System) versions 1.19 and prior are affected. A vulnerability in the HR Expense scan_file upload allows self-registered users to upload arbitrary PHP files, enabling Remote Code Execution. The issue is exacerbated by open registration (...
CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...
CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...
CVE-2025-1070
CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded...
