lab-cve-2025-3515

CVE-2025-3515 Laboratorio WordPress Drag and Drop Multiple File Upload for Contact Form 7 Levanta un entorno vulnerable de WordPress para reproducir y validar CVE-2025-3515 — subida de archivos sin restricciones a través de ddmuuploadfile en el plugin...

CVE-2026-82607

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

CVE-2026-22241

CVE-2026-22241 Entorno de laboratorio para CVE-2026-22241 Descripción de la vulnerabilidad: Vulnerabilidad: Carga sin restricciones de archivos con tipo peligroso. Impacto: Ejecución remota de código RCE. Descripción: Esta falla permite a un atacante con privilegios administrativos cargar un...

Hack-The-Box-Nexus-Findings-Report

🛡️ Hack The Box - Nexus Findings Report 📋 Overview This repository contains a comprehensive penetration test report for the Hack The Box machine Nexus. 🔍 Key Findings Exposed Credentials in Gitea Commit History - Medium Severity Krayin CRM Unrestricted File Upload CVE-2026-38526 - High Severity...

CVE-2026-56290

CVE-2026-56290 - Explotación Masiva de Compagebuilderck ⚠️ Descargo de Responsabilidad Esta herramienta es solo para fines educativos y de pruebas de seguridad autorizadas. El acceso no autorizado a sistemas informáticos es ilegal Use esta herramienta solo en sistemas que posea o tenga permiso...

PT-2026-83851

Name of the Vulnerable Software and Affected Versions WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions prior to 4.4.2 Description An unauthenticated file upload flaw allows the unrestricted upload of files with dangerous types, which could enable the use of malicious files on the syste...

CVE-2025-32579

⚠️ CVE-2025-32579 - RCE crítico a través del plugin Sync Posts WordPress 📦 Afecta: Sync Posts 🧨 Puntuación CVSS: 9.9 CRÍTICA 📁 Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 🧠 Resumen de la vulnerabilidad El plugin Sync Posts de WordPress, creado por SoftClever Limited, es vulnerable a...

CVE-2026-Pending-Django-Summernote-RCE

CVE-2026-XXXXX Pending: django-summernote Arbitrary File Upload RCE This repository contains a Proof of Concept PoC for a Conditional Remote Code Execution RCE vulnerability discovered in django-summernote version 0.8.20.0 and earlier. Vulnerability Details Product : django-summernote Version : =...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Unrestricted File Upload → RCE Critica vulnerabilità di Unrestricted File Upload in Elementor Pro Potenzialmente in grado di portare a Remote Code Execution RCE ⚠️ Panoramica CVE-2026-32475 è una vulnerabilità critica che interessa Elementor Pro , un plugin...

laravel-filemanager-unrestricted-upload

Laravel FileManager Unrestricted File Upload CVE-2025-56399 CWE-434: Uneingeschränkter Upload von Dateien mit gefährlichem Typ CVSS-Score: 8.5 Hoch 📋 Beschreibung Dieses Tool bietet einen Proof of Concept PoC für CVE-2025-56399 , eine kritische Schwachstelle in alexusmai/laravel-file-manager...

CVE-2025-26892

CVE-2025-26892 – Tema WordPress Celestial Aura = 2.2 Caricamento Arbitrario di File Autenticato 📄 Descrizione Una vulnerabilità di Caricamento File Senza Restrizioni è presente nel tema WordPress Celestial Aura sviluppato da dkszone fino alla versione 2.2. Un utente autenticato con privilegi bass...

CVE-2025-66802

CVE-2025-66802 Sourcecodester Covid-19 Contact Tracing System 1.0 – Caricamento illimitato di file che porta all'esecuzione remota di codice Descrizione Sourcecodester Covid-19 Contact Tracing System versione 1.0 contiene una vulnerabilità classificata come Caricamento illimitato di file con tipo...

CVE-2026-81931

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

EUVD-2026-66801

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

EUVD-2026-66408

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automatisierter Exploit für Krayin CRM ≤ 2.2.x. Dieses Skript nutzt eine Schwachstelle für uneingeschränkten Dateiupload im TinyMCE-Endpunkt /admin/tinymce/upload aus, umgeht die MIME-Typ-Validierung durch Vortäuschung von image/jpeg, lädt eine...

CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

PT-2026-82321

Name of the Vulnerable Software and Affected Versions tamguo version 1.5.3 Description An unrestricted file upload issue allows for stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on the target server. The '/uploadFile' and '/imgUpload' endpoints within...