CVE-2026-125912

The WP Ultimate CSV Importer WordPress plugin versions before 9.2 is vulnerable to arbitrary PHP code execution within the shared WordPress context. The root cause is a failure to restrict the destination filename and extension, as well as a lack of validation for the fetched content type during ...

OpenCATS - Command Injection

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard. id: CVE-2026-277...

Invision Community <=5.0.6 Unauthenticated RCE via Template Injection

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by unauthenticated...

Ads Pro Plugin <= 4.89 - Local File Inclusion

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsatemplate' parameter of the bsapreviewcallback function. This makes it possible for unauthenticated attackers to includ...

CVE-2026-117551

Joomla Extension - jdownloads.com - RCE through file upload in jDownloads 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution...

EUVD-2026-124608

Joomla Extension - jdownloads.com - RCE through file upload in jDownloads 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution...

CVE-2026-117551 Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8

Joomla Extension - jdownloads.com - RCE through file upload in jDownloads 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution...

CVE-2026-117551

The jDownloads Joomla extension (versions

CVE-2026-117687

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product...

Exploitation-of-a-Remote-Code-Execution-vulnerability--CVE-2024-7954-

Exploitation of Remote Code Execution Vulnerability CVE-2024-7954 Software Vulnerability Testing Project Submitted by: Shivansh Kuntal Overview This project demonstrates the exploitation of CVE-2024-7954 , a critical Remote Code Execution RCE vulnerability affecting SPIP CMS through its porteplum...

CVE-2026-117687

Movable Type, developed by Six Apart Ltd., contains a code injection vulnerability within its Dynamic Publishing functionality. A flaw in this feature allows an attacker to execute arbitrary PHP code on the affected system by sending a specially crafted request. Affected products include Movable ...

EUVD-2026-124179

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product...

CVE-2026-117687

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product...

CVE-2024-25641

CVE-2024-25641 RCE for Cacti 1.2.26 This repository automates the process of exploiting CVE-2024-25641 on Cacti 1.2.26. When a user is authenticated, An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates"...

CVE-2021-40964

Tiny File Manager = 2.4.6 - Remote Code Execution Authenticated 🚨 About the Exploit This is a Bash-based authenticated Remote Code Execution RCE exploit for Tiny File Manager versions = 2.4.6, vulnerable under CVE-2021-40964. The script leverages: Weak upload validation and webroot disclosure, An...

CVE-2024-25641-CACTI-RCE-1.2.26

CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵 Authenticated RCE Cacti version v1.2.26 Summary An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code ...

CVE-2026-117687: Six Apart Ltd.: Movable Type provided by Six Apart Ltd

Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product...

PT-2026-145896

Name of the Vulnerable Software and Affected Versions jDownloads versions prior to 4.1.8 Description Insufficient validation of frontend thumbnail uploads allows users with upload permissions to place executable files on the server. This flaw enables remote PHP code execution. Recommendations...

CVE-2026-117551: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend…

Joomla Extension - jdownloads.com - RCE through file upload in jDownloads 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution...

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 Fully automated exploit for CVE-2024-25641. When a user is authenticated, Cacti version 1.2.26 is vulnerable to an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import...