CVE-2026-2942

ProSolution WP Client — Unauthenticated File Upload & RCE Scanner Plugin: prosolution-wp-client Affected Version: Vulnerability Type: Unauthenticated Arbitrary File Upload → Remote Code Execution Risk Level: 🔴 Critical CVSS 9.8 Requirement: Public page containing prosolfrontend shortcode 📌 About...

flanker

Flanker - email address and MIME parsing for Python .. image:: https://travis-ci.org/mailgun/flanker.svg?branch=master :target: https://travis-ci.org/mailgun/flanker .. image:: https://coveralls.io/repos/github/mailgun/flanker/badge.svg?branch=master :target:...

thunderbird: Uninitialized memory in MIME parsing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

CVE-2025-2005

WordPress FEUP Arbitrary File Upload Exploit CVE-2025-2005 This repository provides a Proof of Concept PoC exploit for the WordPress Front End Users plugin versions up to 3.2.32, which is vulnerable to arbitrary file upload due to missing MIME/file-type validation in its registration form.This...

CVE-2019-9673

CVE-2019-9673: Freenet content filter vulnerability NOTE: I have fully disclosed this bug to the Freenet team and worked with them to verify their patch. The patch is now deployed in the latest version of Freenet. I've recently found a security vulnerability in Freenet that may allow an attacker ...

PoC-CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automated exploit for Krayin CRM ≤ 2.2.x. This script exploits an unrestricted file upload vulnerability in the TinyMCE endpoint /admin/tinymce/upload, bypasses MIME-type validation by spoofing image/jpeg, uploads a PHP webshell, and executes arbitrary...

CVE-2026-103522

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...

pwndrop

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

CVE-2023-38836

CVE-2023-38836 Exploit File Upload vulnerability in BoidCMS v.2.0.0 allows an authenticated attacker to upload a file with dangerous type CWE-434. To exploit, an attacker could add a GIF header to bypass MIME type checks. GIF89a; Usage usage: CVE-2023-38836.py -h -u URL -U USER -P PASSWD -l LHOST...

CVE-2026-45447

🚨 CVE-2026-45447 - Critical OpenSSL Use-After-Free Vulnerability Heap Use-After-Free in PKCS7verify allowing memory corruption, crashes, and potential remote code execution. 📖 Executive Summary CVE-2026-45447 is a critical vulnerability in OpenSSL's PKCS7 verification functionality. The flaw exis...

CVE-2025-54962

🔥 CVE-2025-54962 — Insecure File Upload in OpenPLC Runtime Webserver OpenPLC Runtime ≤ 2024-12-31 — Stored XSS, CSRF 📌 Summary I discovered a vulnerability in the OpenPLC Runtime webserver released version: 2024-12-31 that allows authenticated users to upload arbitrary files e.g., .html, .svg as...

thunderbird: Uninitialized memory in MIME parsing

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2025-8889

Exploit Title: WordPress Compress Then Upload Plugin 1.0.3 Arbitrary File Upload to RCE Date: 2025-07-23 Exploit Author: Muhammed Çelik Vendor Homepage: https://wordpress.com/plugins/compress-then-upload Software Link: https://downloads.wordpress.org/plugin/compress-then-upload.latest-stable.zip...

CVE-2018-11736

CVE-2018-11736 PHP RCE Exploit Pluck CMS Disclaimer ⚠️: This exploit was developed in Rust primarily as an introductory programming learning exercise. Please excuse any lack of technical rigor or non-idiomatic code patterns. Also, this is not my discovery; I relied on official reports to write thi...

CVE-2025-61183

CVE-2025-61183 Stored XSS in User Avatar Upload via Unsafe SVG Handling Overview A Stored Cross-Site Scripting XSS vulnerability was identified in the vaahcms, specifically within the interaction between the file upload logic in MediaController.php and the storeAvatar method in UserBase.php,...

CVE-2026-66730-Infinite-Loop-DoS-in-facil.io-MIME-Parser

Security Advisory: Infinite Loop DoS in facil.io MIME Parser Partial Boundary Assigned CVE ID : CVE-2026-66730 Product: facil.io Affected versions: facil.io = 0.6.0 all 0.6.x, all 0.7.x, master; introduced alongside the MIME parser in 0.6.0 Component: lib/facil/http/http.c,...

CVE-2026-66729-Out-of-Bounds-Read-in-facil.io-MIME-Parser-leads-to-Server-Crash

Security Disclosure: Out-of-Bounds Read in facil.io MIME Parser leads to Server crash Assigned CVE ID CVE-2026-66729 Product: facil.io Affected versions: facil.io = 0.6.0 all 0.6.x, all 0.7.x, master; introduced when the MIME parser was added in 0.6.0 Component:...

CLEANSTART-2026-NF46642 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the victoria-metrics package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...