Bypass-File-Upload-on-Koken-CMS

Koken CMSでのファイルアップロード制限の回避 このリポジトリでは、Koken CMS - 0.22.24（認証済み）のファイルアップロード制限を回避する方法を説明しています。 Koken CMSについて Kokenは、フォトグラファー、デザイナー、アーティスト向けに設計された無料のコンテンツ管理システムです。 ウェブサイト：http://koken.me/ Koken CMSはSoftaculousでも利用可能です：https://www.softaculous.com/apps/cms/Koken ファイルアップロード制限の回避（PoC） Koken...

CVE-2026-70376

CVE-2026-70376 — Pluck CMS 全站 CSRF → RCE 宽松模式（fail-open）的 Referer 校验 + 无 CSRF 令牌 + 双扩展名上传 管理员仅需访问一次页面，即可删除内容、注入页面并植入 WebShell 概览 · 摘要 · 根因 · 攻击链 · 利用 · 修复建议 · 时间线 📋 概览 | ---|--- CVE ID| CVE-2026-70376 Tracking ID| PT-2026-68036 产品| pluck-cms/pluck — Pluck CMS（纯文件 PHP） 受影响版本| 4.7.x 至 4.7.21-dev / ...

CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro 未認証ファイルアップロード RCE Advanced Reviews → saveattachments → Custom Fonts strpos バイパス → shell.woff2.php 概要 CVE-2026-58480 別名 CVE-2026-15158 としても追跡 は、Blocksy Companion Pro 要件: プレミアムライセンスに加えて、WooCommerce Extra Advanced Reviews と Custom Fonts の両拡張機能が有効であること。無料の...

CVE-2026-38526-POC

CVE-2026-38526 - Krayin CRM RCEエクスプロイト Krayin CRM ≤ 2.2.x - 無制限のファイルアップロードによるリモートコード実行。 このPoCは、脆弱なTinyMCEアップロードエンドポイント（/admin/tinymce/upload）を悪用してPHPウェブシェルをアップロードし、サーバー上でコマンド実行を実現します。 機能 CSRFトークン処理による完全自動ログイン 二重拡張子を使用してアップロード制限をバイパス リバースシェルと単一コマンド実行をサポート 信頼性の高いLaravel CSRFトークンのリフレッシュ クリーンで使いやすい...

CVE-2023-38831

CVE-2023-38831 WinRARエクスプロイトの検知ロジック このリポジトリには、CVE-2023-38831（WinRAR ZIPファイルのなりすまし / 二重拡張子エクスプロイト）の検知ロジックが含まれており、生のクエリ/コードブロック、ETW固有のプロバイダ名+イベントIDを提供します。 ターゲットシステム上の脆弱なバージョンのWinRAR（ 6.23） 動作の概要 CVE-2023-38831は以下の場合に悪用されます： ユーザーが悪意のあるZIPファイルをWinRARで開く アーカイブに以下が含まれている： ● おとりのファイル（例：invoice.pdf ） ●...

Blocksy Companion 2.1.46 - RCE

!/usr/bin/env python3 Exploit Title: Blocksy Companion 2.1.46 - RCE CVE: CVE-2026-58480 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub: https://github.com/mbanyamer Author Blog : https://banyamersecurity.com/blog/ Vendor...

Blocksy Companion 2.1.46 Shell Upload

Blocksy Companion version 2.1.46 suffers from an unauthenticated arbitrary file upload and double-extension bypass that allows for shell uploads. !/usr/bin/env python3 Exploit Title: Blocksy Companion 2.1.46 - RCE CVE: CVE-2026-58480 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Autho...

CVE-2026-61457

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

CVE-2026-61457

CVE-2026-61457 : The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 is vulnerable to a file upload extension bypass in the API media controller. The validation in HandlesMediaUploads::validateFileExtension() only checks the final extension via pathinfo($filename, PATHINFO_EXTENSION); a us...

EUVD-2026-44651

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

CVE-2026-61457 Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

CVE-2026-61457 Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

CVE-2026-61457 Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

CVE-2026-61457: Unrestricted Upload of File with Dangerous Type

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

PT-2026-60148

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFO EXTENSION, so a user with api.media.write permission can...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through filename sanitization in File::sanitizeFileName and MediaUploader::useFilename/filename inference in the upload pipeline. An attacker can upload a file named with a double extension such as shell.php.jpg...

CVE-2026-49972

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFOFILENAME extraction preserves the inn...

CVE-2026-49972

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFOFILENAME extraction preserves the inn...

CVE-2026-49972 Laravel-Mediable < 7.0.0 File Upload RCE via Extension Bypass

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFOFILENAME extraction preserves the inn...

CVE-2026-49972 Laravel-Mediable < 7.0.0 File Upload RCE via Extension Bypass

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFOFILENAME extraction preserves the inn...