73042 matches found
CVE-2020-13671
CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...
CVE-2026-48908
🚨 CVE-2026-48908 — Full Server Compromise via Arbitrary File Upload Critical Unauthenticated File Upload → Remote Code Execution RCE A critical vulnerability in SP Page Builder allows unauthenticated attackers to upload arbitrary files and achieve Remote Code Execution RCE , potentially leading t...
CVE-2026-90857
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unrestricted upload. The attack may be...
CVE-2025-7847-POC
CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...
CVE-2017-12615
CVE-2017-12615 - Apache Tomcat Remote Code Execution RCE CVE-2017-12615 is a Remote Code Execution RCE vulnerability affecting Apache Tomcat 7.0.0 through 7.0.79 running on Microsoft Windows when HTTP PUT requests are enabled. The vulnerability exists because Tomcat incorrectly handles uploaded J...
CVE-2026-90857
SourceCodester College Notes Gallery Management System 1.0 is affected by an unrestricted file upload vulnerability in the Profile Upload component. The vulnerable endpoint is /dashboard/userprofile.php, where manipulation of the image argument allows an attacker to upload arbitrary files. The at...
EUVD-2026-78260
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unrestricted upload. The attack may be...
CVE-2026-90857 SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload
A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile.php of the component Profile Upload. Performing a manipulation of the argument image results in unrestricted upload. The attack may be...
CVE-2020-13671-old
CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...
CVE-2022-1329
WP Elementor 3.6.0/1/2 Remote Code Execution root@kitploit: Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version...
CVE-2026-56290
CVE-2026-56290 - Compagebuilderck 批量利用工具 ⚠️ 免责声明 本工具仅供教育和授权安全测试使用。 未经授权访问计算机系统是违法的 请仅在你拥有或明确允许测试的系统上使用此工具 作者不对因使用本工具造成的任何误用或损害负责 使用本工具即表示你同意遵守所有适用法律和法规 更多免责声明可查看 Jenderal92 封面上的声明。你可点击 这里 !!! 查阅 📋 描述 CVE-2026-56290 是一个针对 Compagebuilderck Joomla 组件的批量利用工具。此漏洞允许远程攻击者通过无限制文件上传机制上传任意 PHP...
CVE-2026-13714
root@kitploit: Realtyna WPL 5.3.0 - Unauthenticated RCE Exploit Description This exploit targets a critical vulnerability in Realtyna Organic IDX + WPL Real Estate plugin versions prior to 5.3.0. The plugin uses hardcoded credentials and allows unauthenticated file upload leading to Remote Code...
KrayinCRM-RCE-Exploit-CVE-2026-38526
🔓 Krayin CRM v2.2.x - Authenticated Remote Code Execution Exploit ⚠️ FOR AUTHORIZED SECURITY TESTING ONLY - Unauthorized use is illegal and unethical. 📋 Overview This exploit tool demonstrates a critical authenticated remote code execution RCE vulnerability discovered in Krayin CRM version 2.2.x...
CVE-2026-56291
CVE-2026-56291 — Balbooa Forms Joomla Mass RCE Exploit Pre-Auth form.uploadAttachmentFile → No CSRF → PHP Upload Overview CVE-2026-56291 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Balbooa Forms combaforms Joomla extension 2.4.1. The form.uploadAttachmentFile...
CVE-2026-48907
CVE-2026-48907 — Joomla JCE Unauthenticated RCE Lab PSsec Educational security research lab for CVE-2026-48907. Overview CVE-2026-48907 is a critical CVSS 10.0 unauthenticated remote code execution vulnerability in JCE Joomla Content Editor , the most widely installed editor extension for Joomla,...
CVE-2026-20245
🚨 CVE-2026-20245 - Cisco Catalyst SD-WAN Manager Privilege Escalation Authenticated Privilege Escalation via Crafted File Upload A vulnerability affecting Cisco Catalyst SD-WAN Manager that allows authenticated attackers with administrative privileges to execute arbitrary commands as root. 📖...
CVE-2025-69212-PoC
CVE-2025-69212 — OpenSTAManager P7M Command Injection PoC OpenSTAManager = 2.9.8 — OS Command Injection via malicious .p7m filename in ZIP upload. File: src/Util/XML.php:100 — unsanitized $file in exec Vector: /plugins/importFEZIP/actions.php → ZIP → .p7m filename → exec"openssl smime ... -in...
Hack-The-Box-Nexus-Findings-Report
🛡️ Hack The Box - Nexus Findings Report 📋 Overview This repository contains a comprehensive penetration test report for the Hack The Box machine Nexus. 🔍 Key Findings Exposed Credentials in Gitea Commit History - Medium Severity Krayin CRM Unrestricted File Upload CVE-2026-38526 - High Severity...
CVE-2026-14894
CVE-2026-14894 — Super Forms ≤ 6.3.313 Overview Unauthenticated Arbitrary File Upload → Remote Code Execution in the WordPress plugin Super Forms versions ≤ 6.3.313. The vulnerability resides in the AJAX handler supersubmitform which processes file uploads through a field without validating the...