88 matches found
CVE-2021-22210
0x01 前言 声明:本项目仅供学习和交流使用，请勿用于非法未授权测试！ 更新记录 10.30 增加了burp代理池 重写了命令行参数 增加了gitlab未授权批量以及单个检测功能 0x02 使用说明 安装 root@kitploit: pip3 install - r requirements.txt 使用方法 root@kitploit: usage: CVE-2021-22205.py -h -w WAY -u URL -f FILE CVE-2021-22205 optional arguments: -h, --help show this help message and...
CVE-2024-10578
CVE-2024-10578: Pubnews = 1.0.7 - 未经认证的任意插件安装 描述 Pubnews WordPress 主题在所有版本（包括 1.0.7）中，由于 pubnewsimporterpluginactionfornotice 函数缺少权限检查，导致存在未经授权的任意插件安装漏洞。此漏洞允许拥有订阅者级别及以上的已认证攻击者安装任意插件，进而可利用这些插件来利用其他漏洞。 CWE CWE-434: 危险类型文件的不受限制上传 CVSS 评分: 8.8 高危 版本: 3.1 向量字符串:...
CVE-2025-31324
CVE-2025-31324 这是一个为利用 CVE-2025-31324 而开发的概念验证代码。 用法 root@kitploit: usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help message and exit --htt...
CVE-2023-43040
CVE-2023-43040 This repository contains a proof-of-concept exploit for the CVE-2023-43040 vulnerability found in RADOS Gateway RADOSGW. This vulnerability allows attackers to upload objects to any bucket accessible by the specified access key, potentially leading to unauthorized data manipulation...
CVE-2025-67887
🛡️ 1С-БитриксのTranslateモジュールにおける「脆弱性」CVE-2025-67887/86の修正 1С-Битриックスセキュリティ 1С-Битриックス社の情報セキュリティセンターおよびインシデント監視センターからのお知らせ Telegramチャンネルにおいて、「翻訳」モジュールに脆弱性が存在し、セキュリティチェックなしでアーカイブを不正にアップロードできる可能性があるとの情報が流れました。...
CVE-2021-21972
Usage:CVE-2021-21972.py option -u or --url：目标url -t or --type：Payload类型（ssh/webshell -f or --file：要上传的文件（webshell或authorizedkeys） 例如：CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p or --proxy：设置代理 例如：CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p...
CVE-2026-32639
Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...
CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL
Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...
CVE-2026-72859
Budibase 3.39.4 before 3.40.0 contains an authorization regression in the S3 attachment upload endpoint. Affected component: the attachments endpoint used to generate S3 PutObject presigned URLs. Root cause: the route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC...
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...
CVE-2026-18962
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...
PT-2026-71029
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...
CVE-2026-13743
CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This could allow an attacker with physical access to the product to upload arbitrary malicious firmware to the device without authentication...
GHSA-WVHV-QCQF-F3CX goshs has a file-based ACL authorization bypass in goshs state-changing routes
Summary goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload,...
CVE-2025-14944 Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded toke...
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
Summary AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" a. This bypasses the admin-controlled moderation and draft workflows. The setStatus method validates the status code again...
CVE-2026-3533
The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on importpopuptemplates function as well as insufficient file type validation in the uploadfiles function in all versions up to, and including, 4.14.1. This makes it possible for Authenticat...
WordPress plugin KiviCare – Clinic & Patient Management System (EHR) has security vulnerabilities.
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
CVE-2026-24035
Horilla HRMS (Horilla) has an Improper Access Control vulnerability affecting versions 1.4.0 up to but not including 1.5.0. The issue stems from insufficient server-side validation of the employee_id parameter during file uploads, allowing any authenticated employee to upload documents on behalf ...