CVE-2024-49653

📜 WordPress Portfolleo Plugin Exploit CVE-2024-49653 🚨 Vulnerability Details Title: WordPress Portfolleo plugin = 1.2 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in James Eggers Portfolleo portfolleo allows uploading a web shell...

CVE-2021-25094

CVE-2021-25094 Tatsu Plugin ZIP File addcustomfont unrestricted upload usage php p.php...

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

CVE-2020-12800

CVE-2020-12800 Script POC para CVE-2020-12800: RCE a través de Carga de Archivos sin Restricciones Plugin vulnerable para pruebas alojado en: https://mega.nz/file/aQUClQKCZYeiTYSrPuRnwwlRavy4cqfEXs34Tkq6KQig2RcOas Laboratorio de Pentester Academy...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...

CVE-2026-23499

CVE-2026-23499: Saleor vulnerable to stored XSS via Unrestricted File Upload Overview...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2026-84063

BurgerEditor versions 3.2.0 through 3.4.0 are affected by an unrestricted file upload flaw allowing a dangerous file type to be uploaded by any authenticated user. Successful exploitation may lead to arbitrary PHP code execution on the server. The CNA-assigned CVSS 4.0 score is 8.5 (HIGH) , with ...

CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE

make it a readme.md to paste into it CVE-2025-69906: Monstra CMS 3.0.4 Arbitrary File Upload to RCE Author : David PS Abraham Date : February 5, 2026 Severity : Critical - Remote Code Execution CVSS 8.8+ CWE : 434 Unrestricted Upload of File with Dangerous Type Vulnerability Description Monstra C...

CVE-2024-56249

🛠️ WordPress Master Toolkit Exploit CVE-2024-56249 🌟 Overview This script exploits an Arbitrary File Upload vulnerability in the WordPress WPMasterToolKit plugin, allowing an attacker to upload a web shell to the server. The vulnerability exists in versions -un -p -fn 📋 Parameters...

CVE-2023-42362

CVE-2023-42362 Author: Abdelrahman Mohamed Mr-n0b3dy Linked-in: https://www.linkedin.com/in/abdelrhman-mohamed-ashraf-7bb43410b/ Vulnerability Name: Unrestricted File Upload that led to ATO Severity: High Product: NCR teller web app Version: 4.4.0 Description:...

CVE-2025-56218

CVE-2025-56218 Unrestricted File Upload Description An attacker may upload an Excel file that contains a malicious script or a phishing URL. The application converts the file to PDF and forwards it to the intended recipient for digital signature. Because hyperlinks in the generated PDF are...

CVE-2026-70376

CVE-2026-70376 — Pluck CMS Site-wide CSRF → RCE Fail-open Referer check + no CSRF tokens + double-extension upload A single admin page-visit deletes content, injects pages, and drops a webshell At a glance · · · · · ·...

CVE-2026-86666

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2026-86666

A unrestricted file upload vulnerability affects aircheng-org iWebShop-5 versions up to 5.15 . The flaw resides in the upload_json/uploadFile function within the controllers/pic.php file, allowing a remote, unauthenticated attacker to upload arbitrary files. The CVSS 3.1 score is 7.3 (HIGH) , ref...

CVE-2026-86666 aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

EUVD-2026-72934

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be...

SmarterMail - Unrestricted File Upload

Mail server contains an unrestricted file upload vulnerability allowing unauthenticated attackers to upload arbitrary files to any location, potentially enabling remote code execution. id: CVE-2025-52691 info: name: SmarterMail - Unrestricted File Upload author: DhiyaneshDK,watchTowr severity:...

DNN - Unrestricted Arbitrary File Upload

DNN formerly DotNetNuke \u003C 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no...