Exploit-CVE-2024-31777

CVE-2024-31777 | GUnet OpenEclass E-learning platform Unrestricted File Upload PoC 📜 Description This script presents a proof of concept PoC for CVE-2024-31777, a security vulnerability discovered in GUnet OpenEclass E-learning platform with a CVSS of 9.8 which affects the endpoint of...

CVE-2019-5475

CVE-2019-5475 CVE-2019-5475 and CVE-2019-15588 Range: RCE Command Injection Vulnerability 0x00 Background CVE-2019-5475 is an RCE command injection vulnerability in Nexus regarding the built-in plugin Yum Repository. It was first disclosed on hackerone, but because the official first fix was...

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin. id: CVE-2024-10146 info: name: Simple File List 6.1.13...

XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)

XWiki = 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic. id: CVE-2025-51991 info: name: XWiki = 17.3.0 -...

CVE-2022-32199

CVE-2022-32199 ScriptCase python CVE-2022-32199.py -t 127.0.0.1 -u admin -p admin -path windows/win.ini Example of deleting file in the root directory...

CVE-2026-37197

CVE-2026-37197 - Server-Side Request Forgery SSRF in NukeViet CMS v4.5.07 Overview A Server-Side Request Forgery SSRF vulnerability exists in VINADES JSC NukeViet CMS v4.5.07 within the admin remote upload feature. The issue allows an authenticated administrator to trigger server-side HTTP reques...

CVE-2025-47549

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlf...

CVE-2020-29607-POC

Pluck CMS 4.7.13 File Upload RCE Exploit 🚨 Educational Remote Code Execution Exploit 🚨 Author: Ron Jost Hacker5preme Reference: Exploit-DB CVE: CVE-2020-29607 ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explici...

CVE-2026-82651

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2025-32118

🚀 CVE-2025-32118 - Exploit RCE per il Plugin CMP di WordPress 🔍 Titolo: Plugin CMP – Coming Soon & Maintenance di WordPress = 4.1.13 - Esecuzione di codice in remoto RCE 🗓️ Pubblicato: 2025-04-04 🔐 CWE: CWE-434 - Caricamento senza restrizioni di file con tipo pericoloso 📊 CVSS: 9.1 CRITICO —...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Exploit für beliebigen Datei-Upload 📌 Übersicht Dieser Exploit zielt auf eine kritische Schwachstelle CVE-2024-9698 im Plugin Crafthemes Demo Import für WordPress ab. Die Schwachstelle ermöglicht es authentifizierten Administratoren, beliebige Dateien...

CVE-2026-82244

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...

CVE-2026-7229-SQLI

SQL Injection autenticata nel Coaching Management System consente il dump del database Descrizione Esiste una vulnerabilità di SQL Injection nel Coaching Management System in PHP. Il parametro complaintreply nella funzionalità di risposta dell'amministratore non viene adeguatamente sanificato pri...

CVE-2026-73679

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...

PT-2026-71883

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-71252

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-15450

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

EUVD-2026-50272

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...