CVE-2025-3515

CVE-2025-3515 - WordPress File Upload RCE Usage python3 exploit.py Overview CVE-2025-3515 is a file upload vulnerability in the "Drag and Drop Multiple File Upload for Contact Form 7" WordPress plugin that allows unauthenticated attackers to upload malicious files and achieve remote code executio...

CVE-2021-3166

An issue was discovered on Asus DSL-N14UB1 v.1.1.2.3805. An attacker can upload any file to the Firmware box as long as it is renamed as SettingsProductName.trx eg. SettingsDSL-N14U-B1.trx. Once the file is loaded, shutdown measures on a wide range of services are triggered as if it were a real...

Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal

CVE-2023-1112 - Drag and Drop Multiple File Uploader PRO - Contact Form 7 v5.0.6.1 Path Traversal Info Path Traversal in Drag and Drop Multiple File Uploader PRO - Contact Form 7 version 5.0.6.1 allows unauthenticated remote attacker to upload files anywhere writable on the remote server...

CVE-2026-27540

🌐 Language / Dil 📌 Özet WooCommerce Wholesale Lead Capture WWLC — Kimlik doğrulamasız dosya yükleme → RCE | ---|--- Ürün| WooCommerce Wholesale Lead Capture — wwlc eklentisi Sürüm| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — upload handler korumalı Auth| Unauthenticated Vektör|...

CVE-2021-42171

CVE-2021-42171 File upload to Remote Code Execution on Zenario CMS 9.0.54156 https://minhnq22.medium.com/file-upload-to-rce-on-zenario-9-0-54156-cms-fa05fcc6cf74 Server test Distributor ID: Ubuntu Description: Ubuntu 21.04 Release: 21.04 Codename: hirsute...

CVE-2023-44061

File-upload-Restriction-bypass...

Spring4Shell-POC

Spring4Shell-POC Local reproduction process of Spring4Shell vulnerability Environment Preparation Environment: docker, docker-compose mvn package, generate ./target/ROOT.warshell mvn package Start the serviceshell docker-compose up -d Stop serviceshell docker-compose down Reproduction Process Run...

CVE-2026-13249

CVE-2026-13249 — Honeywell PD45 Unauthenticated File Upload RCE Python 3 PoC for CVE-2026-13249 — Honeywell PD45 Industrial Printer web management interface. Description PoCbit / GitHub CVE-2026-13249 — Firmware F10.19.010040 through before F10.22.030745 exposes an unauthenticated arbitrary file...

CVE-2026-18143

CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbitrary File Upload Python 3 PoC for CVE-2026-18143 in Request a Quote for WooCommerce woocommerce-request-a-quote, Addify / WooCommerce.com. Description PoCbit / GitHub CVE-2026-18143 — Request a Quote for WooCommerce ≤ 2.9.2 allows...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

CVE-2024-29272

CVE-2024-29272 This is a Proof-of-Concept for CVE-2024-29272, an unauthenticated arbritrary file upload vulnerability that leads to remote code execution on versions of VvvebJS -l -p in another terminal: nc -lvnp...

CVE-2022-32119

CVE-2022-32119 - Arox-Unrestricted-File-Upload There are multiple unrestricted file uploads that result in the arbitrary execution of PHP code. Authenticated Vulnerable Pages: localhost/officeadmin/?pid=54&action=add -----------------------------181967832439954202373233921976 Content-Disposition:...

MoveIT-CVE-2023-34362-RCE

CVE-2023-34362: MOVEit Transfer Unauthenticated RCE For a full technical description of the vulnerability and exploitation, please read our AttackerKB Analysis. Usage ruby move.rb ruby move.rb 192.168.86.111 + Starting. target='https://192.168.86.111'. + Retrieved initial session token...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE Usage : python3 exploit.py https://host:9443/ ArbitraryShellName.jsp...

CVE-2024-31351_wordpress_exploit

Wordpress - Copymatic – AI Content Writer & Generator = 1.6 - Unauthenticated Arbitrary File Upload CVE-2024-31351 Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: fro...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2.3.5 Example:...

CVE-2024-36416

CVE-2024-36416 Tool for validating CVE-2024-36416 Usage pip3 install -r requirements.txt python3 sukuna.py --help python3 sukuna.py --url http://./ --validate --payload-test Server-Side Log File Check Verify the server-side file, if the log file \service\example\proxy.log is =25MB, the server is...

CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...

CVE-2026-115481

The baserCMS website development framework is vulnerable in versions 5.0.0-beta1 up to (but not including) 5.3.2 and 5.4.2 . The root cause lies in PermissionGroupsService::build(), which creates a wildcard allow rule for non-admin groups when a plugin's config/permission.php file is missing. Bec...

CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...