CVE-2025-31324-File-Upload

CVE-2025-31324-File-Upload A totally unauthenticated file-upload endpoint in Visual Composer lets anyone drop arbitrary files e.g., a JSP web-shell onto the server. Proof-of-concept tool to check for and exploit the unauthenticated file upload vulnerability CVE-2025-31324 in SAP NetWeaver Visual...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

ShellUpload

ShellUpload kurosava.php kurosava.php is a malicious PHP web shell uploader...

Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal

CVE-2023-1112 - Drag and Drop Multiple File Uploader PRO - Contact Form 7 v5.0.6.1 Path Traversal Info Path Traversal in Drag and Drop Multiple File Uploader PRO - Contact Form 7 version 5.0.6.1 allows unauthenticated remote attacker to upload files anywhere writable on the remote server...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/XSS/ ---------------------...

WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 notify or 2 blog parameter. id: CVE-2013-2287 info: name: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting...

dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. id: CVE-2026-38361 info: name:...

dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dashuploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges. id: CVE-2026-38360 info: name:...

CVE-2025-31324_PoC

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

Onapsis_CVE-2025-31324_Scanner_Tools

Vulnerability and Indicator of Compromise IoC Scanner for CVE-2025-31324 Visual Composer Metadata Uploader Vulnerability CVE-2025-31324 is a critical CVSSv3 10 vulnerability affecting SAP NetWeaver systems, specifically within the Visual Composer Metadata Uploader component. This vulnerability...

CVE-2025-31324

🔴 CVE-2025-31324 — SAP NetWeaver Visual Composer Unauthenticated File Upload Type: Proof of Concept — Vulnerability Research CVE: CVE-2025-31324 CVSS: 10.0 Critical AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Status: Patched — SAP Security Note 3594142 + 3604119 Added to CISA KEV: May 2025 ⚠️ Este PoC...

CVE-2025-31324

CVE-2025-31324 PoC, разработанный для эксплуатации CVE-2025-31324. Использование root@kitploit: usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this...

Burp_CVE-2025-31324

CVE-2025-31324 Extensión de Burp Suite Resumen Esta extensión de Burp Suite basada en Python está diseñada para detectar la presencia de CVE-2025-31324 , una vulnerabilidad crítica en el componente Metadata Uploader de SAP NetWeaver Visual Composer. La vulnerabilidad permite la ejecución remota d...

lab-cve-2016-15042

CVE-2016-15042 – WordPress Frontend File Manager & N‑Media Post Front‑end Form Unauthenticated File Upload PoC Lab Fully reproducible, Dockerized lab to validate and demonstrate CVE-2016-15042: Frontend File Manager nmedia-user-file-uploader v3.7 vulnerable 4.0 N‑Media Post Front‑end Form...

CVE-2025-31324

CVE-2025-31324 Prueba de concepto 0day para SAP NetWeaver creada por ShinyHunters CVE-2025-31324 es una vulnerabilidad crítica de "Subida de archivos sin restricciones" que afecta al SAP NetWeaver Application Server AS Java. Específicamente, reside dentro del componente Visual Composer VCFRAMEWOR...

SAP-CVE-2025-31324

SAP-CVE-2025-31324 POC Una herramienta para detectar y explotar una vulnerabilidad crítica de carga de archivos sin autenticación en SAP NetWeaver Visual Composer. Descripción SAP NetWeaver Visual Composer incluye un componente llamado Metadata Uploader que carece de controles de autorización...

CVE-2026-87796

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-87796 CVE-2026-87796 Multi Uploader for Gravity Forms 1.1.9 — sh1zen The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile...

CVE-2026-87796

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...

CVE-2026-87796

The Multi Uploader for Gravity Forms WordPress plugin is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 1.1.9 . The flaw resides in the move_file function in GFMU_FileUploader.php, where insufficient file type validation during chunked upload handling allo...

CVE-2026-87796 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the movefile function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated...