CVE-2026-82793

Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product...

CVE-2026-82780

An unrestricted file upload vulnerability (dangerous file type) affects the CONPROSYS TM Series by Consec . A remote authenticated attacker can upload a specially crafted file to achieve arbitrary command execution on the product. The flaw is scored CVSS 3.1: 8.8 (HIGH) — network vector, low comp...

EUVD-2026-77233

Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a specially crafted file is uploaded by a remote authenticated attacker, an arbitrary command may be executed on the product...

CVE-2026-82780

Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a specially crafted file is uploaded by a remote authenticated attacker, an arbitrary command may be executed on the product...

Joomla_CVE_2026_48907

MASTA CVE-2026-48907 Scanner Single-file, self-contained scanner for Joomla! JCE Editor Author: Alma !CAUTION 🚨 DISCLAIMER — READ BEFORE USE THIS IS AN INTRUSIVE SECURITY TESTING TOOL. root@kitploit: THIS TOOL IS FOR AUTHORIZED SECURITY ASSESSMENTS ONLY. Scanning systems you do NOT own or have...

CVE-2025-12674

CVE-2025-12674 KiotViet Sync = 1.8.5 - Unauthenticated Arbitrary File Upload 🐚 KiotViet Sync = 1.8.5 - Unauthenticated Arbitrary File Upload 📝 Description The KiotViet Sync plugin for WordPress versions up to and including 1.8.5 is vulnerable to arbitrary file uploads, due to missing file type...

CVE-2021-46079

CVE-2021-46079 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Html Injection Exploit Author: SANU P.L CVE: CVE-2021-46079 CVSS: 7.2 HIGH References: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injection...

CVE-2018-16370

CVE-2018-16370 In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive.More details see https://github.com/lazyphp/PESCMS-TEAM/issues/2...

CVE-2021-29447-PoC

CVE-2021-29447-PoC 概要 CVE-2021-29447 は、PHP 8.0+ で実行されている WordPress バージョン 5.6～5.7（5.7.1 でパッチ適用済み）に影響する XML External Entity XXE インジェクションの脆弱性です。この脆弱性は、メディアメタデータの解析に使用される getID3 ライブラリに存在します。 WordPress は getID3 を介して WAV ファイルの iXML チャンクを処理します。getID3 は LIBXMLNOENT フラグを指定して simplexmlloadstring...

CVE-2026-5203

CVE-2026-5203 — CMS Made Simple ≤ 2.2.22 RCE Path Traversal + Arbitrary File Upload Summary The UserGuide module's XML import functionality in CMS Made Simple ≤ 2.2.22 fails to sanitize user-supplied filenames, allowing an authenticated administrator to upload arbitrary files e.g. PHP web shells...

CVE-2025-56399

CVE-2025-56399 – Authenticated Remote Code Execution in laravel-file-manager v3.3.1 🧭 Overview An authenticated Remote Code Execution RCE vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. By...

CVE-2023-34854

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function...

WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload

Arbitrary File Upload vulnerability in WordPress Royal Elementor Addons Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version...

geojson2kml - Command Injection

Detects command injection vulnerability by checking if hacked.txt is created and contains the expected content. id: CVE-2020-28429 info: name: geojson2kml - Command Injection author: eeche,chae1xx1os,persona-twotwo,soonghee2 severity: critical description: | Detects command injection vulnerabilit...

Jordy Meow AI Engine - Unrestricted File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine- ChatGPT Chatbot.This issue affects AI Engine- ChatGPT Chatbot- from n/a through 1.9.98. id: CVE-2023-51409 info: name: Jordy Meow AI Engine - Unrestricted File Upload author: pussycat0x severity: critical...

Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution

Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack of authentication on file uploads, letting unauthenticated attackers execute arbitrary code by uploading crafted files. id: CVE-2025-34299 info: name: Monsta FTP = 2.11.2 - Unauthenticated Remote Code Execution...

DELMIA Apriso - Command Injection

An Improper Control of Generation of Code code injection / file upload → RCE vulnerability affecting DELMIA Apriso Release 2020 → Release 2025. When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place...

IncomCMS 2.0 - Arbitrary File Upload

IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server. id: CVE-2020-29597 info: name: IncomCMS 2.0 - Arbitrary File Upload author: princechaddha severity: critical description: |...

Cloudpanel 2 < 2.3.1 - Remote Code Execution

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. id: CVE-2023-35885 info: name: Cloudpanel 2 2.3.1 - Remote Code Execution author: DhiyaneshDk severity: critical description: | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. impact: | Successfu...

LG LED Assistant - Thumbnail Path Traversal File Upload

A path traversal vulnerability exists in the endpoint handler for /api/thumbnail in Common.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed. id: CVE-2024-2863 info: name: LG LED Assistant - Thumbnail...