CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which allows unauthenticated attackers to gain RCE on WSO2 servers via uploadi...

CVE-2024-1247-PoC

CVE-2024-1247-PoC Post Saint -un -p -ru Disclaimer This script is for educational and rese...

CVE-2023-26262

Sitecore 10.3 Authenticated file upload vulnerability Author: Thomas Stern Date: 26/01-2023 Summary It is possible via the import languages functionality to upload and arbitrary file. This file could be a webshell that would allow for execution of code on the server. Step to reproduce For testing...

CVE-2022-3992

CVE-2022-3992 Cross-Site Scripting in WonderCMS Description: A cross-site scripting XSS vulnerability in Sanitization Management System v1.0 allows potential attackers to upload arbitrary files via a crafted name into the system logo Fields of the System Info Fields. The cookie has no HttpOnly Fl...

CVE-2021-45010-TinyFileManager-Exploit

CVE-2021-45010 CVE-2021-45010: A Path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager Project’s Tiny File Manager = 2.4.3 allows remote attackers with valid user accounts to upload malicious PHP files to the webroot and achieve code execution o...

CVE-2021-42171

CVE-2021-42171 File upload to Remote Code Execution on Zenario CMS 9.0.54156 https://minhnq22.medium.com/file-upload-to-rce-on-zenario-9-0-54156-cms-fa05fcc6cf74 Server test Distributor ID: Ubuntu Description: Ubuntu 21.04 Release: 21.04 Codename: hirsute...

CVE-2023-37790

CVE-2023-37790 Author: KaizenSecurity Description: Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function. 1. https://nvd.nist.gov/vuln/detail/CVE-2023-37790 2. https://vuldb.com/?id.244831 3...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

CVE-2024-29272

CVE-2024-29272 This is a Proof-of-Concept for CVE-2024-29272, an unauthenticated arbritrary file upload vulnerability that leads to remote code execution on versions of VvvebJS -l -p in another terminal: nc -lvnp...

CVE-2022-29464

Exploit CVE-2022-29464 This repository contains a script to exploit the CVE-2022-29464 vulnerability, which allows file uploads to vulnerable servers. Use it only in authorized environments and for educational purposes. Requirements Python 3.8 or higher Installation Step 1: Clone the repository...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo...

CVE-2023-49052

CVE-2023-49052 - Microweber CMS v2.0.4 - Uploading Malicious Files Description In version 2.0.4 of Microweber CMS where the file upload option is active in created forms, it is possible to send malicious HTML files, even when certain types of validations are applied in this field. This...

chamilo-lms-unauthenticated-big-upload-rce-poc

Chamilo LMS Unauthenticated Big Upload File RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and instal...

CVE-2023-43872-CMSmadesimple-Arbitrary-File-Upload--XSS---File-Manager

CMSmadesimple File Upload - XSS v2.2.18 Author: Sergio Description: File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden XSS. Attack Vectors: A vulnerability in File Manager file upload sanitation allows you to upload a PDF file with hidden...

CVE-2021-3166

An issue was discovered on Asus DSL-N14UB1 v.1.1.2.3805. An attacker can upload any file to the Firmware box as long as it is renamed as SettingsProductName.trx eg. SettingsDSL-N14U-B1.trx. Once the file is loaded, shutdown measures on a wide range of services are triggered as if it were a real...

CVE-2024-29399

CVE-2024-29399 Vulnerability Details Overview In Savane v3.13 and prior, a lack of validation on uploaded files can allow for privilege escalation. Web servers configured according to the installation instructions are vulnerable to Cross-Site Scripting XSS. In misconfigured web servers this can...

CVE-2024-5084

Wordpress Hash Form – Drag & Drop Form Builder = 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution CVE-2024-5084 The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction'...

CVE-2022-32074

CVE-2022-32074 for osTicket | Support Ticketing System 1. Find the file listing directory, the root of the file download directoryм fileuploads this is an example. 2. Load the following xssPayload.svg and open it Example:...

CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media

WBCE File Upload XSS - WBCE v1.6.1 Author: Sergio Description: File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden XSS. Attack Vectors: A vulnerability in Media file upload sanitation allows you to upload a PDF file with hidden XSS. POC: When logging...

CVE-2024-31351_wordpress_exploit

Wordpress - Copymatic – AI Content Writer & Generator = 1.6 - Unauthenticated Arbitrary File Upload CVE-2024-31351 Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: fro...