CVE-2025-32118

🚀 CVE-2025-32118 - Exploit de RCE no Plugin CMP do WordPress 🔍 Título: WordPress CMP – plugin Coming Soon & Maintenance = 4.1.13 - Execução Remota de Código RCE 🗓️ Publicado: 2025-04-04 🔐 CWE: CWE-434 - Upload irrestrito de arquivo com tipo perigoso 📊 CVSS: 9.1 CRÍTICO —...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Exploit di Caricamento Arbitrario di File 📌 Panoramica Questo exploit prende di mira una vulnerabilità critica CVE-2024-9698 nel plugin Crafthemes Demo Import per WordPress. La vulnerabilità consente agli amministratori autenticati di caricare file...

CVE-2022-32199

CVE-2022-32199 ScriptCase python CVE-2022-32199.py -t 127.0.0.1 -u admin -p admin -path windows/win.ini Esempio di eliminazione di un file nella directory root...

CVE-2020-29607-POC

Pluck CMS 4.7.13 Exploit RCE con Upload File 🚨 Exploit Didattico di Esecuzione Remota di Codice 🚨 Autore: Ron Jost Hacker5preme Riferimento: Exploit-DB CVE: CVE-2020-29607 ⚠️ Dichiarazione di esclusione: Questo script è destinato esclusivamente a scopi didattici e di test autorizzati. Non...

Exploit-CVE-2024-31777

CVE-2024-31777 | GUnet OpenEclass E-Learning-Plattform – PoC für unbeschränkten Datei-Upload 📜 Beschreibung Dieses Skript stellt einen Proof of Concept PoC für CVE-2024-31777 dar, eine Sicherheitslücke, die in der GUnet OpenEclass E-Learning-Plattform entdeckt wurde und einen CVSS-Wert von 9,8...

CVE-2019-5475

CVE-2019-5475 Campi di tiro CVE-2019-5475 e CVE-2019-15588: Vulnerabilità di iniezione di comandi RCE 0x00 Sfondo CVE-2019-5475 è una vulnerabilità di iniezione di comandi RCE in Nexus relativa al plugin integrato Yum Repository, originariamente divulgata su hackerone. Tuttavia, poiché la prima...

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin. id: CVE-2024-10146 info: name: Simple File List 6.1.13...

XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)

XWiki = 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic. id: CVE-2025-51991 info: name: XWiki = 17.3.0 -...

CVE-2025-47549

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlf...

CVE-2026-37197

CVE-2026-37197 - Falsificazione di richieste lato server SSRF in NukeViet CMS v4.5.07 Panoramica Esiste una vulnerabilità di Server-Side Request Forgery SSRF in VINADES JSC NukeViet CMS v4.5.07 all'interno della funzione di caricamento remoto dell'amministratore. Il problema consente a un...

CVE-2026-73679

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...

PT-2026-71883

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71252

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-15450

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

EUVD-2026-50272

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

CVE-2026-66028 Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement t...

CVE-2026-48013

CVE-2026-48013 (Shopware) is an SSRF in the media external-link flow. Authenticated admins can cause server-side HEAD requests from the endpoint /api/_action/media/external-link to arbitrary internal IPs, bypassing the existing depth of IP checks used by the parallel uploadFromURL flow. The vulne...

CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...