81762 matches found
CVE-2026-12793
CVE-2026-12793 — JetFormBuilder ≤ 3.6.2 Неаутентифицированное повышение привилегий → загрузка плагина → RCE. Уязвимые версии Уязвимые: = 3.6.3 Быстрое использование Проверка одной цели python poc.py -u https://target.example --mode check Полный эксплойт требуется существующая учётная запись с...
CVE-2025-3616
Metasploit-модуль: Greenshift WordPress Plugin Arbitrary File Upload CVE-2025-3616 Этот репозиторий содержит Metasploit-модуль для эксплуатации CVE-2025-3616 — уязвимости произвольной загрузки файлов в плагине Greenshift для WordPress версии с 11.4 по 11.4.5. Эксплойт позволяет аутентифицированны...
CVE-2025-52691
CVE-2025-52691 SmarterMail Téléchargement Arbitraire de Fichier Non Authentifié Conduisant à une Exécution de Code à Distance Aperçu Téléchargement arbitraire de fichier critique non authentifié permettant une exécution de code à distance. Champ| Valeur ---|--- Produit| SmarterMail Affecté| Build...
EUVD-2026-89469
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...
CVE-2026-102842 gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...
EUVD-2026-89543
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...
CVE-2026-102842
A vulnerability exists in the KCFinder File Manager component of gedelumbung HospitalManagement (up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8). The root cause is located in the app_user_login_model.php::cekUserLogin function within the application/models/app_user_login_model.php file, wh...
CVE-2026-102842 gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...
PT-2026-103328
Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla CCK versions prior to 8.3.16 Description An unauthenticated remote code execution issue exists in the site/uploader.php endpoint, which is accessible via the getContent task. The system fails to perform authentication or Access...
PT-2026-103614
Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 and 0.8.0 Description A directory traversal issue exists in the python file upload function within the endpoint packages/dbgpt-app/src/dbgpt app/openapi/api v1/python upload api.py:42. This allows a remote attacker to wri...
CVE-2026-51866
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...
EUVD-2026-90416
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...
PT-2026-103615
Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 through 0.8.0 Description A code injection issue exists where a skill uploaded via the '/api/v1/skills/upload' endpoint can subsequently be executed through the '/api/v1/chat/react-agent' flow. Recommendations At the...
CVE-2026-51866
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...
CVE-2026-51866
Versions 0.7.5 through 0.8.0 of DB-GPT are vulnerable to a code injection issue (CWE-94). An attacker can upload a malicious skill via the /api/v1/skills/upload endpoint, which can subsequently be executed during the /api/v1/chat/react-agent flow. The impact includes potential compromise of confi...
AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786121727)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786121727 advisory. - Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred including exceeding limits during the...
CVE-2022-44268-
CVE-2022-44268- Для практики HTB Как это использовать python3 poc.py generate -o test.png -r /etc/passwd Загрузите файл test.png и скачайте python3 poc.py parse -i out.png...
CVE-2025-63830
📂 CKFinder 1.4.3 – Script intersite stocké XSS via téléchargement SVG malveillant Identifiant CVE : CVE-2025-63830 🧭 Aperçu Une vulnérabilité de script intersite stocké XSS a été identifiée dans CKFinder v1.4.3. Le problème réside dans la fonctionnalité de téléchargement de fichiers , qui ne...
RCE-Simplephpblog-biggiedroid
CVE-2025-15495 - Téléchargement Arbitraire de Fichier Conduisant à une Exécution de Code à Distance RCE Produit BiggiDroid – Simple PHP Blog CMS Page produit : https://biggidroid.com/product/simple-php-blog/ Type de vulnérabilité Téléchargement arbitraire de fichier Téléchargement de fichier sans...
