CVE-2025-6220

Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...

CVE-2023-4220

CVE-2023-4220 PoC Chamilo LMS Unauthenticated Big Upload File RCE This repository contains a Proof of Concept PoC for CVE-2023-4220 , a Remote Code Execution RCE vulnerability affecting Chamilo LMS. This vulnerability allows unauthenticated attackers to exploit a large file upload feature, leadin...

Zimbra-RCE

Zimbra-RCE Zimbra RCE CVE-2019-9670 $ ./zimbra.py -h . . \ /|| \ | \ \ \ / / / | |/ | \ \ \ | / \ / | / / | | Y Y \ \ \ | // \ | | \ | \ / |||| / /| / || /\ / / / / / / / / / usage: zimbra.py -h -u URL -d DTD -n PAYLOADNAME -f PAYLOADFILE Zimbra RCE CVE-2019-9670 optional arguments:...

FallingSkies-CVE-2023-35885

CVE-2023-35885 Cloudpanel 0-day Exploit Author: @EagleTube, @Mzulfahmy, @farphalabs Github : https://github.com/datackmy/FallingSkies-CVE-2023-35885/blob/main/ Affected version: v2.0.0 – v2.3.0 Patched version: v2.3.1 Vendor homepage: CloudPanel.io Product: CloudPanel References:...

CVE-2025-44608

CVE-2025-44608 El proyecto CloudClassroom-PHP v1.0 es vulnerable a RCE mediante inyección SQL. Proveedor: https://github.com/mathurvishal/CloudClassroom-PHP-Project Enlace del software: https://github.com/mathurvishal/CloudClassroom-PHP-Project/archive/refs/heads/master.zip PoC Paso 1: Navegue a ...

CVE-2026-3891

CVE-2026-3891 Pix for WooCommerce = 1.5.0 - Subida de archivos arbitraria no autenticada 💣 Pix for WooCommerce = 1.5.0 – Subida de archivos arbitraria no autenticada CVE-2026-3891 👤 Nxploited 🧩 Descripción El plugin Pix for WooCommerce para WordPress es vulnerable a la subida de archivos arbitrar...

shining-mask

Shining Mask Hacks Este repositorio contiene código e instrucciones para crear un controlador personalizado de Bluetooth de Baja Energía BLE para la Shining LED Mask que cambia automáticamente la imagen facial de cualquier máscara dentro del alcance BLE. Este repositorio es un complemento de...

CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup pip3 install -r requirements.txt Run python3 app.py Attacker Connect to server Connect to server ...

CVE-2023-25202

CVE-2023-25202: Insecure file upload mechanism Description CVE-2023-25202 involves an insecure file upload mechanism within the Therefore application, which is overly permissive in the types of files users can upload. The application only blocks uploads of HTML, EXE, and BAK files, leaving it...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE Vulnerabilidad de Cross Site Scripting en Wonder CMS v.3.2.0 hasta v.3.4.2 permite a un atacante remoto ejecutar código arbitrario mediante un script manipulado cargado en el componente installModule. Solo con fines educativos Requiere conocimiento del loginURL, acceso...

CVE-2020-13957

Apache Solr RCE CVE-2020-13957 Demo con Docker Demo en Mac Descripción de NVD CVE-2020-13957 NVD CVE-2020-13957 Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous which could be used for remote code execution to be configured in a...

CVE-2023-41425

CVE-2023-41425 Descripción Vulnerabilidad de Cross Site Scripting en Wonder CMS v.3.2.0 hasta v.3.4.2 permite a un atacante remoto ejecutar código arbitrario mediante un script manipulado cargado en el componente installModule. Funcionamiento El exploit adjunto "exploit.py" realiza las siguientes...

CVE-2021-38163

CVE-2021-38163 CVE-2021-38163 - exploit for SAP Netveawer SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of...

CVE-2025-57298

Stored XSS via Renderizado Inseguro de Markdown en Kotaemon Resumen Kotaemon es un sistema de preguntas y respuestas sobre documentos basado en RAG Generación Aumentada por Recuperación de código abierto que proporciona una interfaz web para consultar documentos subidos como PDF, Word y archivos...

CVE-2025-3515

CVE-2025-3515 - WordPress File Upload RCE Usage python3 exploit.py Overview CVE-2025-3515 is a file upload vulnerability in the "Drag and Drop Multiple File Upload for Contact Form 7" WordPress plugin that allows unauthenticated attackers to upload malicious files and achieve remote code executio...

CVE-2023-47246-EXP

Vulnerability Details 1. fofa: body="sysaid-logo-dark-green.png" || title="SysAid Help Desk Software" || body="Help Desk software by SysAid" 2. Affected versions: SysAid Server23.3.36 Vulnerability Recurrence 1. Execute the script: git clone https://github.com/W01fh4cker/CVE-2023-47246-EXP.git cd...

fuxploider

fuxploider Fuxploider 是一个开源渗透测试工具，可自动检测和利用文件上传表单漏洞。该工具能够检测允许上传的文件类型，并确定哪种技术最适合在目标 Web 服务器上上传 Web Shell 或任何恶意文件。 截图 安装 你至少需要 Python 3.6。 git clone https://github.com/almandin/fuxploider.git cd fuxploider pip3 install -r requirements.txt 如果 pip 有问题（如果你使用 Windows 的话）： python3 -m pip install -r...

fuxploider

fuxploider Fuxploider is an open source penetration testing tool that automates the process of detecting and exploiting file upload forms flaws. This tool is able to detect the file types allowed to be uploaded and is able to detect which technique will work best to upload web shells or any...

covert-control

covert-control 通过将文件上传到 Google Drive、OneDrive、Youtube 或 Telegram 来远程控制系统，使用 Python 创建文件及监听器。支持创建文本文件、图像、音频或视频，命令可使用明文或 AES 加密。 covert-googledrive.py - 将文件上传至 Google Drive 的公共文件夹，控制系统。 covert-onedrive.py - 将文件上传至 OneDrive 的公共文件夹，控制系统。 covert-youtube.py - 将视频上传至 Youtube，控制系统（从 covert-tube 更新）。...