CVE-2021-22210

0x01 Preface Disclaimer: This project is for learning and communication purposes only. Do not use it for illegal unauthorized testing! Update Log 10.30 Added burp proxy pool Rewrote command-line arguments Added GitLab unauthorized batch and single detection functionality 0x02 Usage Instructions...

CVE-2023-43040

CVE-2023-43040 This repository contains a proof-of-concept exploit for the CVE-2023-43040 vulnerability found in RADOS Gateway RADOSGW. This vulnerability allows attackers to upload objects to any bucket accessible by the specified access key, potentially leading to unauthorized data manipulation...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Unauthenticated Arbitrary Plugin Installation Description The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnewsimporterpluginactionfornotice function in all versions up to, and...

CVE-2025-31324

CVE-2025-31324 A proof of concept developed to exploit CVE-2025-31324. Usage usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help message and...

CVE-2025-67887

🛡️ Parche para la "vulnerabilidad" CVE-2025-67887/86 en el módulo Translate de 1C-Bitrix 1C-Bitrix Seguridad Centro de Seguridad de la Información y Monitoreo de Incidentes de la empresa «1C-Bitrix» informa En canales de Telegram apareció información sobre una vulnerabilidad en el módulo...

phpweb

phpweb Frontend Arbitrary File Upload...

CVE-2021-21972

Usage:CVE-2021-21972.py option -u or --url: Target URL -t or --type: Payload type ssh/webshell -f or --file: File to upload webshell or authorizedkeys Example: CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p or --proxy: Set proxy Example: CVE-2021-21972.py -u https://127.0.0.1 ...

Vulnerabilities in GeoNetwork are addressed through OpenGeo

OpenGeo has identified several vulnerabilities in GeoNetwork, a open-source cataloging application, specifically in versions 4.4.5 through 4.4.11, as well as versions preceding 4.4.12 and 4.2.17. The first vulnerability involves a reflected cross-site scripting XSS attack in the public,...

CVE-2026-32639

Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...

CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859

Budibase 3.39.4 before 3.40.0 contains an authorization regression in the S3 attachment upload endpoint. Affected component: the attachments endpoint used to generate S3 PutObject presigned URLs. Root cause: the route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC...

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...

CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-71029

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-75930

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller CmsControllersIndex used OR-logic across its five permissions cms.manage pages, cms.manage partials, cms.manage layouts, cms.manage content, cms.manage...

CVE-2026-13743

CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This could allow an attacker with physical access to the product to upload arbitrary malicious firmware to the device without authentication...

GHSA-WVHV-QCQF-F3CX goshs has a file-based ACL authorization bypass in goshs state-changing routes

Summary goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload,...

CVE-2025-14944 Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage

The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded toke...

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Summary AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" a. This bypasses the admin-controlled moderation and draft workflows. The setStatus method validates the status code again...

CVE-2026-3533

The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on importpopuptemplates function as well as insufficient file type validation in the uploadfiles function in all versions up to, and including, 4.14.1. This makes it possible for Authenticat...