Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

WordPress File Manager <= 7.2.1 - Directory Traversal

File Manager and File Manager Pro plugins for WordPress versions up to 7.2.1 and 8.3.4 contain a directory traversal caused by the 'target' parameter in mkfilefoldermanageractioncallbackshortcode, letting attackers read arbitrary files and upload files outside designated directories, exploit...

MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated-POC

Atom-CMS-2.0---文件上传-远程代码执行-未认证- 远程代码执行（RCE） 漏洞利用作者：Ashish Koli Shikari 厂商主页：https://thedigitalcraft.com/ 软件链接：https://github.com/thedigicraft/Atom.CMS 版本：2.0 CVE：CVE-2022-25487 关于此漏洞： 此脚本将 webshell.php 上传到 Atom CMS。应用会将该文件以唯一编号存储在 uploads 目录中，从而允许我们访问 Webshell。 用法 : python3 exploit.py 示例：python3...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 未认证任意文件上传。 描述： 用于 WordPress 的 Ninja Forms - File Uploads 插件存在未认证任意文件上传漏洞，原因是在所有版本（包括 3.3.26）的 'NFFUAJAXControllersUploads::handleupload' 函数中缺少文件类型验证和权限检查。 此漏洞允许未认证的攻击者： 为任意 fieldid 生成有效的 nonce。 使用白名单绕过技术上传任意文件。 强制服务器端将白名单扩展名（.pdf）重命名为 PHP 扩展名。 上传...

ADTrapper

ADTrapper - Active Directory セキュリティ分析プラットフォーム プロフェッショナル向け Active Directory セキュリティ分析と脅威検出プラットフォーム Windows 認証ログを、高度な脅威検出とインタラクティブな可視化により、実用的なセキュリティインサイトに変換します 概要 ADTrapper は、サイバーセキュリティ専門家が Windows Active Directory...

CVE-2020-10977

GitLab v12.4.0-12.8.1 RCE 完全基于 https://github.com/dotPY-hax/gitlabRCE，但该工具对我来说无法正常工作，且其 HTML 解析部分显得繁琐，因此我用 JS 重写了它。 使用方法 按常规方式启动一个反向 Shell 监听器，然后运行此脚本： root@kitploit: TARGETURI="https://target" TARGETEMAILDOMAIN="laboratory.htb" \ TARGETUSER="test" TARGETPASSWORD="Test pass 123" ...

CVE-2024-11680_PoC_Exploit

CVE-2024-11680 PoC漏洞利用 此仓库包含针对CVE-2024-11680的PoC（概念验证）漏洞利用代码，该漏洞影响ProjectSend r1605及更早版本。该漏洞利用因权限配置不当导致的认证缺陷。 功能特点 利用不当认证修改应用程序标题，以此确认漏洞存在。 启用不安全选项（客户端注册、自动批准和文件上传）。 注册新用户以演示权限配置不当问题。 测试完成后自动恢复原始应用程序标题。 使用方法 前提条件 1. 一个运行r1605或更早版本的ProjectSend 的有效目标。 2. curl：该脚本使用curl发送HTTP请求。...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- Response: root@kitploit: HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"application/msword", "tmpname":"nftmp-14FpD-test.png.doc", "error":0, "size":19...

CVE-2024-1209

CVE-2024-1209 LearnDashにおける課題経由の機密情報漏洩。認証されていない訪問者はアップロードされた課題を閲覧・ダウンロードできます。 脆弱性: CVE-2024-1209 課題経由の機密情報漏洩 CVSS: 5.3 Medium ソフトウェア: LearnDash sfwd-lms 影響を受けるバージョン: = 4.10.1 パッチ適用済みバージョン: 4.10.2 部分的に, 4.10.3 完全に 開発者: LearnDash 研究者: Karl Emil Nikka, Nikka Systems 公開日: 2024-02-05 最終更新日: 2024-02-05...

CVE-2024-22515-File-Upload-Vulnerability

CVE-2024-22515: Agent DVR におけるファイルアップロードの脆弱性 Information 説明 iSpyConnect.com Agent DVR 5.1.6.0 では、サウンドファイルのアップロードにおけるファイルタイプの検証が不足しています。これにより、認証されたユーザーがファイルを開くダイアログですべてのファイルを選択するだけで、アップロードオーディオコンポーネントを通じて任意のファイルタイプをアップロードできるようになります。 追加情報...

CVE-2024-50379-POC

CVE-2024-50379-POC このリポジトリには、CVE-2024-50379 を悪用する Python スクリプトが含まれています。この脆弱性を利用すると、攻撃者は脆弱なサーバーに JSP シェルをアップロードし、リモートで任意のコマンドを実行できます。このエクスプロイトは、対象サーバーの /uploads ディレクトリが保護されていない、または存在しない場合に特に有用です。 概要 CVE-2024-50379 は、ファイルアップロードを適切に処理しないサーバーに影響を与える脆弱性であり、攻撃者が JSP...

Astra Linux – Vulnerability in Tomcat9

Path Equivalence: The use of ‘file.Name’ an internal dot notation can lead to Remote Code Execution, information disclosure, or the addition of malicious content to uploaded files via the write-enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-...

CVE-2026-88932

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

CVE-2026-88932

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0 , when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, leaving orphaned files on disk. A remote un...

CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...