CVE-2026-57827

CVE-2026-57827 Script di rilevamento & sfruttamento di CVE-2026-57827 per il caricamento non autorizzato di file in Joomla RSFiles...

webuploader-0.1.15-Demo

webuploader-v-0.1.15-Komponente weist eine Datei-Upload-Schwachstelle auf ohne Autorisierung Einführung: Die Baidu-WebUploader-Komponente weist eine Datei-Upload-Schwachstelle auf. Diese Schwachstelle entsteht dadurch, dass die Upload-Seite der WebUploader-Komponente Dateitypen oder...

CVE-2021-21972

CVE-2021-21972 VMware vSphere Client Unerlaubter Datei-Upload zu Remote Code Execution RCE Der vSphere Web Client HTML5 ist im Wesentlichen eine administrative Oberfläche, die die Verwaltung einer vSphere-Installation ermöglicht. Der vSphere Client bietet einem Administrator Zugriff auf die...

CVE-2023-22518

CVE-2023-22518 Exploit Descrizione Questo repository contiene uno script di exploit per CVE-2023-22518. Lo script consente il caricamento di file non autorizzato, che potrebbe portare all'esecuzione di codice remoto o ad altre vulnerabilità di sicurezza. Disclaimer Questo repository è solo a scop...

CVE-2026-58428

CVE-2026-58428 : Release attachment extension allowlist bypass via the web release edit form in Gitea (variant of CVE-2025-68939). Connected sources confirm the issue and cite a fix in the Gitea 1.27.0 release tag. The initial documents do not specify exact affected versions or root cause details...

PT-2026-55262

Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description An unauthenticated arbitrary file upload issue exists in the com.sksoft.bill.ImageUpload servlet. Unauthenticated attackers can upload arbitrary files by submitting a POST request to the endpoint without...

CVE-2026-38329

Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...

CVE-2026-35573

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The...

Exploit for Unrestricted Upload of File with Dangerous Type in Webfulcreations Computer_Repair_Shop

CVE-2024-51793 / 0-Click RCE Exploit - Author: Joshua Provost...

CVE-2021-22736

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a denial of service when an unauthorized file is uploaded...

CVE-2019-18320

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to upload arbitrary files without authentication. Please note that an attacker needs to have network access to the...

PT-2025-47787

Name of the Vulnerable Software and Affected Versions S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress versions through 1.7.8 Description The software is susceptible to arbitrary file uploads because of a lack of file type validation within the storeFile...

EUVD-2017-16959

Malware in sbrugna...

EUVD-2020-28647

Malware in sbrugna...

EUVD-2019-5856

Malware in sbrugna...

EUVD-2021-9875

Malicious code in bioql PyPI...

EUVD-2024-50755

Malicious code in bioql PyPI...

EUVD-2021-9871

Malicious code in bioql PyPI...

EUVD-2023-1832

Malicious code in bioql PyPI...

CVE-2025-5394 Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation

The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the aloneimportpackinstallplugin function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers ...