CVE-2025-31324-File-Upload

CVE-2025-31324-File-Upload A totally unauthenticated file-upload endpoint in Visual Composer lets anyone drop arbitrary files e.g., a JSP web-shell onto the server. Proof-of-concept tool to check for and exploit the unauthenticated file upload vulnerability CVE-2025-31324 in SAP NetWeaver Visual...

JoomlaCVE20168869

Exploit for Joomla 3.4.4 - 3.6.4 CVE-2016-8869 and CVE-2016-8870 with File Upload web shell This is PHP port, original python source code provided by @link https://github.com/XiphosResearch/exploits/tree/master/Joomraa Usage: php exploit.php --username hacker -p password -e [email protected]...

PageBuilderCK-CVE-2026-56290-Exploit

Page Builder CK — fonts.save RCE Probe CVE-2026-56290 BlackHat Team proof-of-concept scanner for the Joomla Page Builder CK fonts.save vulnerability. POC CVE-2026-56290 Author: @mrzblackhat Team: BlackHat Team Credits: Peyman Siyahi · MR.PERSIA Overview This tool probes Joomla sites running the...

PHP-Shell-Detector

Web Shell Detector Web Shell Detector – is a php script that helps you find and identify php/cgiperl/asp/aspx shells. Web Shell Detector has a “web shells” signature database that helps to identify “web shell” up to 99%. By using the latest javascript and css technologies, web shell detector has ...

CVE-2026-22241

CVE-2026-22241 Lab Environment for CVE-2026-22241 Vulnerability Description: Vulnerability: Unrestricted Upload of File with Dangerous Type. Impact: Remote Code Execution RCE. Description: This flaw allows an attacker with administrative privileges to upload a malicious PHP file Web Shell, leadin...

CVE-2023-24249-PoC

CVE-2023-24249 PoC CVE-2023-24249 is an arbitrary file upload vulnerability in laravel-admin v1.8.19. This proof of concept exploits the vulnerability to upload a web shell. The exploit was written to use against the HackTheBox easy machine Usage. Example python3 CVE-2023-24249.py + Web shell...

CVE-2025-8625

CVE-2025-8625 — PoC Overview This repository contains the source files for an article on Xakep.ru. The repository contains demonstration materials intended exclusively for security research, education, and testing in isolated laboratory environments. The repository is not intended for use against...

WebShells

WebShells WebShell studying...

Phpweb-Getshell-py

Phpweb-Getshell-py Phpweb=2.0.35 Usage tutorial, please refer to www.0-sec.org...

CVE-2025-28915

CVE-2025-28915 - WordPress ThemeEgg ToolKit Arbitrary File Upload Exploit 📌 Description An Unrestricted File Upload vulnerability in the ThemeEgg ToolKit plugin for WordPress versions ≤ 1.2.9 allows authenticated attackers to upload web shells to the server. This can lead to remote code execution...

CVE-2023-50164-PoC

CVE-2023-50164 Apache Struts path traversal to RCE vulnerability - Proof of Concept This PoC has been made to test an RCE Remote Code Execution by exploiting the Apache Struts2 vulnerability. Build the image and run a container: $ DOCKERBUILDKIT=1 docker build . -t struts2-rce-poc && docker run...

CVE-2024-56249

🛠️ WordPress Master Toolkit Exploit CVE-2024-56249 🌟 Overview This script exploits an Arbitrary File Upload vulnerability in the WordPress WPMasterToolKit plugin, allowing an attacker to upload a web shell to the server. The vulnerability exists in versions -un -p -fn 📋 Parameters -u / --url:...

CVE-2025-32118

🚀 CVE-2025-32118 - WordPress CMP Plugin RCE Exploit 🔍 Title: WordPress CMP – Coming Soon & Maintenance plugin = 4.1.13 - Remote Code Execution RCE 🗓️ Published: 2025-04-04 🔐 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type 📊 CVSS: 9.1 CRITICAL —...

CVE-2025-7847-POC

CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...

CVE-2025-46157

CVE-2025-46157 CVE-2025-46157 – Timetrax V1 2025 Remote Code Execution and Privilege Escalation Summary A critical vulnerability was discovered in Timetrax V1 2025 that allows authenticated users to bypass file upload restrictions and achieve remote code execution RCE. The issue exists in the Lea...

zip-shotgun

ZIP Shotgun Utility script to test zip file upload functionality and possible extraction of zip files for vulnerabilities aka Zip Slip. Idea for this script comes from this post on Silent Signal Techblog - Compressed File Upload And Command Execution and from OWASP - Test Upload of Malicious File...

CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

CVE-2024-51788

💀 CVE-2024-51788 - WordPress The Novel Design Store Directory Plugin = 4.3.0 - Unauthenticated Arbitrary File Upload 🚨 Overview CVE-2024-51788 is a newly disclosed critical vulnerability affecting the The Novel Design Store Directory WordPress plugin = v4.3.0. This flaw allows unauthenticated...

ABPTTS

A Black Path Toward The Sun TCP tunneling over HTTP for web application servers https://www.blackhat.com/us-16/arsenal.htmla-black-path-toward-the-sun Ben Lincoln, NCC Group, 2016 ABPTTS uses a Python client script and a web application server page/package1 to tunnel TCP traffic over an HTTP/HTTP...

CVE-2025-32579

⚠️ CVE-2025-32579 - Critical RCE via Sync Posts Plugin WordPress 📦 Affects: Sync Posts 🧨 CVSS Score: 9.9 CRITICAL 📁 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 🧠 Vulnerability Overview The Sync Posts WordPress plugin by SoftClever Limited is vulnerable to an Unrestricted File Upload...