PT-2026-56414

Name of the Vulnerable Software and Affected Versions Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 Description An unauthenticated arbitrary file upload issue exists within the Advanced Reviews feature. The save attachments function fails to properly validate file extensions...

📄 Pachno 1.0.6 XML Injection / Code Execution / Shell Upload

Authenticated Python exploit tool targeting Pachno version 1.0.6 with claimed XXE, privilege escalation, CSRF payload generation, unrestricted PHP webshell upload, open redirect testing, and a placeholder deserialization / remote code execution chain...

📄 Vtiger CRM 8.3.0 / 8.4.0 Shell Upload

This repository contains a Python proof of concept for CVE-2026-23698, an authenticated remote code execution vulnerability affecting Vtiger CRM. The PoC implements two exploitation techniques: abusing the Module Manager to import a malicious module containing a PHP webshell, and on certain...

CVE-2026-8801: Path Equivalence: 'filename ' (Trailing Space)

Path equivalence: vulnerability in Progress MOVEit Transfer File Upload modules. This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4...

CVE-2026-58654: Unrestricted Upload of File with Dangerous Type

The Grav API plugin getgrav/grav-plugin-api 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint /api/v1/users/user/avatar. The endpoint validates only the client-declared MIME type getClientMediaType beginning with 'image/' and does not inspect the actual file...

Important: docker

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Joro's default proxy mode in versions = 1.1.0 exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reac...

CVE-2026-55778: Unrestricted Upload of File with Dangerous Type

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.11 and 8.6.81, the default fileUpload.fileExtensions blocklist could be bypassed by uploading a file with a non-standard or compound extension and dangerous content type,...

PT-2026-56682

Name of the Vulnerable Software and Affected Versions Joro versions prior to 1.1.1 Description In default proxy mode, the software exposes a local API on 127.0.0.1:9090 that lacks authentication and implements a permissive wildcard CORS policy. Because multipart/form-data is a CORS-safelisted...

📄 Vtiger CRM 8.3.0 Shell Upload

This is a focused authenticated remote code execution proof of concept exploit for Vtiger CRM version 8.3.0. It logs into Vtiger, uploads a .phar PHP webshell through the Documents module, uses /storage/ directory listing to discover the randomized uploaded filename, then executes commands throug...

PT-2026-56574

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.0.8 MOVEit Transfer versions 2025.1.0 through 2025.1.3 Description Progress MOVEit Transfer contains a path equivalence issue within its File Upload modules. This flaw has been targeted by numerous...

PT-2026-56429

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app versions.r2 path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2 path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on...

CVE-2026-14489: Unrestricted Upload of File with Dangerous Type

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on...

PT-2026-56321

Name of the Vulnerable Software and Affected Versions WHMCS Bridge versions prior to 7.0 Description The WHMCS Bridge plugin for WordPress contains a flaw allowing arbitrary file uploads. This occurs because the connect function fails to validate file types. Authenticated attackers with...

CVE-2026-58480: Unrestricted Upload of File with Dangerous Type

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071

The Lingotek Ray Enterprise Translation module provides multilingual site management. The module fails to protect several state-changing administrative routes against Cross Site Request Forgery attacks. An attacker could trick a privileged user into visiting a crafted page that triggers actions...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2026-131 (ALASECS-2026-131)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-131 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN...

Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-112 (ALASNITRO-ENCLAVES-2026-112)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-112 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative...

Joomla Page Builder CK 3.5.10 - Arbitrary File Upload

Exploit Title: Joomla Page Builder CK 3.5.10 - Arbitrary File Upload Google Dork: inurl:compagebuilderck OR "/components/compagebuilderck/assets/pagebuilderck.js" Date: 2026-07-04 Exploit Author: M@rAz Ali Credits: Peyman Siyahi, MR.PERSIA Vendor Homepage: https://www.joomlack.fr/ Software Link:...

Krayin CRM v2.2.x - Authenticated Remote Code Execution

Exploit Title: Krayin CRM v2.2.x - Authenticated Remote Code Execution Date: 07/05/2026 Exploit Author: Diamorphine Vendor Homepage: https://krayincrm.com Software Link: https://github.com/krayin/laravel-crm Version: 2.2.x Tested on: Debian CVE : CVE-2026-38526 import asyncio import httpx from...