WordPress Workreap - Remote Code Execution

WordPress Workreap theme is susceptible to remote code execution. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to th...

WP Time Capsule Plugin - Remote Code Execution

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticat...

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

SimpleHelp <= 5.5.7 - Arbitrary File Upload

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. This template is a...

PT-2026-107851

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.10 Description An unauthenticated arbitrary file upload issue exists due to insufficient validation of the attacker-controlled URL field within the temporaryFileUploads parameter during form submission. An...

PT-2026-107808

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload files function. This is due to missing file type validation in the upload files function, which reads and applies an...

PT-2026-108182

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An unauthenticated attacker can exploit a path traversal issue within the GIM file-upload functionality to write arbitrary files to the Collector. Path traversal is a technique that allows ...

exploit-CVE-2018-15139

OpenEMR CVE-2018-15139 漏洞利用程序 OpenEMR --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder Filename of the shell to be uploaded Username of the admin Password of the admin --debug Display arguments -h, --help Show this screen Examples: exploit.rb...

CVE-2022-1329

WordPress插件 - Elementor 3.6.0 3.6.1 3.6.2 远程代码执行 日期: 2023年4月16日 漏洞利用作者: Việt Hùng https://github.com/phanthibichtram12 供应商主页: https://elementor.com/ 软件链接: https://wordpress.org/plugins/elementor/advanced/ 向下滚动选择版本 版本: 3.6.0, 3.6.1, 3.62 测试环境: WordPress 5.9.3 不依赖操作系统，因为此漏洞利用不提供有效载荷 CVE :...

Worpress-CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 自动Shell上传 WordPress Royal Elementor 1.3.78 Shell上传 访问 https://phankz.com...

CVE-2026-92247

SynaptikCMS 文件管理器 — 认证后远程代码执行 漏洞 SynaptikCMS 文件管理器认证后远程代码执行 SynaptikCMS 的文件管理器允许已认证的攻击者上传文件，随后将其重命名为 PHP 文件。这种上传和重命名行为可被滥用来将可执行的 PHP 代码放置到 Web 可访问的位置，从而导致在 Web 服务器上下文中执行远程代码。 研究员： D1n3sh 受影响组件 /admin/file-manager.php 存在漏洞的功能涉及文件上传和文件重命名操作。 漏洞类型 不受限制的文件上传 文件扩展名 / 重命名验证绕过 认证后远程代码执行 攻击要求...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x 认证后 RCE ⚠️ 法律声明 ：此代码仅供教育目的 和授权测试使用（CTF、漏洞赏金、私人实验室）。 作者不对非法使用负责。 描述 Krayin CRM Webkul ≤ 2.2.x 暴露了 /admin/tinymce/upload 端点， 允许已认证用户（即使是低权限用户） 上传文件而不进行扩展名验证。该文件随后 从 storage/ 目录提供服务，从而实现 PHP 代码的任意执行。 类型 ：任意文件上传 → RCE CVSS ：9.9（严重） 需要认证 ：是（任何有效账户） 安装 git clone...

vuln-chain-lab

ファイルアップロードバイパス + ストアドXSS PoC Lab CSP、CORS、CSRFの保護が有効な状態でも、ファイルアップロードのバイパスとストアドXSSを連鎖させてバックドア管理者アカウントを作成する方法を示す、意図的に脆弱性を持たせたWebアプリケーション。 完全なブログ記事: KurtiseBear Blog これは防御的なセキュリティトレーニングのための教育用ラボです。公開アクセス可能な場所にデプロイしないでください。 このラボが示すもの このアプリケーションには実際のセキュリティ対策が実装されています: コンテンツセキュリティポリシー CSP により、スクリプトソースを...

EUVD-2026-93507

Payload external upload trust validation issue...

GHSA-PJ5H-5Q6C-3PFX Payload external upload trust validation issue

Impact Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient. You are affected if: - You have enabled...

NPM: Payload external upload trust validation issue

NPM: Payload external upload trust validation issue vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

Payload external upload trust validation issue

Impact Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient. You are affected if: - You have enabled...

Payload: Bypassed sanitization of user uploaded SVGs

Impact A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript XSS after a user downloads it and opens it. You are affected if: - You have a collection configured to upload and allow SVG files which can then be downloaded by users. Patches The...

Payload: Incomplete validation during the upload file lifecycle

Impact Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: - You use Payload upload collections with local file storage. - Untrust...