drupalgeddon2-CVE-2018-7600

Drupal - Drupalgeddon2 CVE 2018-7600 $ python3 drupalgeddon.py -h + drupalgeddon2 CVE-2018-7600 exploit by Rafael Caria usage: drupalgeddon.py -h --url URL --command COMMAND --function FUNCTION --test --proxy PROXY ! This script exploits CVE-2018-7600 a Drupal property injection in the Forms API...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- Response: HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"application/msword", "tmpname":"nftmp-14FpD-test.png.doc", "erro...

CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Unauthenticated Arbitrary File Upload. Description : The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to missing file type validation and missing capability checks in the...

CVE-2025-22652

CVE-2025-22652 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Payment Forms for Paystack Vulnerable version = 4.0.1 Component slug payment-forms-for-paystack Component link https://wordpress.org/plugins/payment-forms-for-paystack/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class...

CVE-2026-0740

CVE-2026-0740 🧩 Overview CVE-2026-0740 is an unauthenticated arbitrary file upload vulnerability affecting: Ninja Forms File Uploads ≤ 3.3.26 WordPress plugin This flaw allows attackers to upload arbitrary files to the server without authentication, potentially leading to remote code execution RC...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...

Elementor-Pro-Unauthenticated-Arbitrary-File-Upload-to-RCE

Exploit Author: Abdualhadi Khalifa https://x.com/absholi7ly Version: Elementor Pro = 4.2.1 Tested on: WordPress + Elementor Pro 4.2.1 Windows / Laragon / Apache CVE: CVE-2026-32475 Credits: Vulnerability discovered by Tin Pham TF1T via Patchstack Bug Bounty Program Category: WebApps Description:...

CVE-2026-1056-POC

CVE-2026-1056-POC Snow Monkey Forms - Unauthenticated Arbitrary File Deletion PoC This repository contains a Proof of Concept PoC for a critical vulnerability in the Snow Monkey Forms WordPress plugin versions send; // Direct execution flow to send // CSRF check is only performed for other method...

Xenotix-xBOT

Xenotix-xBOT Xenotix xBOT is a proof of concept cross platform Linux, Windows, Mac bot written in Python that abuse certain Google Services to implement Command & Control Center for the botnet. The Google Apps Data API, Google Forms and Google Spreadsheet is abused to implement C2 for a bot...

CVE-2026-126458

OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizationsfull.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set...

CVE-2026-124218

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removefiles function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST A...

CVE-2026-0740

ninja.py An experimental/tool script that uses file upload endpoints for the Ninja Forms plugin on WordPress sites. It sends requests sequentially to targets in list.txt and writes successful uploads to the shell.txt file. Requirements Python 3 requests usually installed together with urllib3 pip...

CVE-2026-126434

OpenEMR versions prior to 8.5.0 are vulnerable to a missing authorization flaw in interface/forms/procedure_order/common.php. This vulnerability allows authenticated accounts that lack specific patients/lab permissions to access and manipulate procedure orders belonging to other patients. Specifi...

EUVD-2026-124995

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removefiles function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2026-124218 Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removefiles function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2026-124218

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 1.6.2 . The root cause is insufficient file path validation within the remove_files function. This vulnerability is specifically reac...

EUVD-2026-124979

The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbformscheckformsubmissions function. This is due to missing server-side file extension validation in...

CVE-2026-125055

The Chatterbug Forms WordPress plugin is vulnerable to Arbitrary File Upload in all versions up to and including 1.0.2 . The root cause is a lack of server-side file extension validation within the cbforms_check_form_submissions() function. When no field restrictions are configured, the allowed-t...