240 matches found
CVE-2026-28502
WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution RCE vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive...
Arbitrary File Upload
wwbn/avideo is vulnerable to Arbitrary File Upload. The vulnerability is due to insufficient validation of files during plugin upload and extraction, which allows an attacker to upload a crafted archive containing malicious PHP code and execute it on the server...
CVE-2026-28502 WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution RCE vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive...
CVE-2026-28502
WWBN AVideo contains an authenticated Remote Code Execution (RCE) vulnerability in the plugin upload/import workflow. An administrator could upload a crafted ZIP containing executable server-side files, and due to insufficient validation, the archive contents were extracted directly into a web-ac...
WWBN AVideo 代码问题漏洞
WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 24.0 contained code vulnerabilities. These vulnerabilities stemmed from insufficient validation in the plugin upload/import function, allowing authenticated administrators to...
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
Summary An authenticated Remote Code Execution RCE vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient...
Arbitrary File Upload
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Arbitrary File Upload in the plugin upload/import process. An attacker with administrator access can execute arbitrary server-side code by uploading a specially...
PT-2026-22993
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 24.0 Description AVideo is an open source video platform. A Remote Code Execution RCE issue was identified in the plugin upload/import functionality. An authenticated administrator could upload a specially crafted ZIP...
Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security
CVE-2024-10924 / Auth Bypass 2FA to RCE Exploit - Author: J...
CVE-2021-47758
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables...
EUVD-2026-2775
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables...
CVE-2021-47758 Chikitsa Patient Management System 2.0.2 - Remote Code Execution (RCE) (Authenticated)
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables...
CVE-2021-47758 Chikitsa Patient Management System 2.0.2 - Remote Code Execution (RCE) (Authenticated)
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables...
PT-2026-3034
Name of the Vulnerable Software and Affected Versions Chikitsa Patient Management System version 2.0.2 Description The software contains an authenticated remote code execution issue. Attackers can upload malicious PHP plugins through the module upload functionality. Authenticated attackers can...
📄 WordPress ACF 0.9.1.1 Remote Code Execution
This Metasploit module exploits an unauthenticated remote code execution vulnerability in the Advanced Custom Fields: Extended ACF Extended WordPress plugin versions 0.9.0.5 through 0.9.1.1. The vulnerability exists in the prepareform function of the acfemoduleformfrontrender class, which accepts...
CVE-2023-53868 Coppermine Gallery 1.6.25 Remote Code Execution via Plugin Upload
Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file with system commands to the plugin directory and execute arbitrary code by accessing the...
CVE-2023-53868 Coppermine Gallery 1.6.25 Remote Code Execution via Plugin Upload
Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file with system commands to the plugin directory and execute arbitrary code by accessing the...
CVE-2023-53868
CVE-2023-53868 affects Coppermine Gallery 1.6.25. The Red Hat and other connected sources confirm a remote code execution vulnerability in the plugin manager that lets an authenticated user upload a zipped PHP file containing system commands to the plugin directory and then execute code by access...
📄 WordPress AI Engine 3.1.3 Remote Code Execution
This Metasploit module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin versions less than or equal to 3.1.3. The vulnerability allows an attacker to create an administrator account via the MCP Model Context Protocol endpoint without authentication. The module supports...