CVE-2026-82901 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

Ashwesker-CVE-2025-52691

🚨 CVE-2025-52691 — Vulnerabilidad crítica de SmarterMail Estado: 🔥 Crítico — Se requiere acción inmediata Puntuación CVSS v3.1: 10.0 / 10 Fecha de divulgación: 29–30 de diciembre de 2025 🧩 Resumen de la vulnerabilidad CVE-2025-52691 es una vulnerabilidad crítica de carga arbitraria de archivos si...

CVE-2025-32140

🚨 CVE-2025-32140 – WP Remote Thumbnail Exploit Arbitrary File Upload 📝 Description CVE-2025-32140 is a critical vulnerability in the WP Remote Thumbnail plugin for WordPress. It enables authenticated attackers with contributor or higher permissions to upload arbitrary files , such as web shells ,...

CVE-2024-31114

CVE-2024-31114 - Exploit RCE de Shortcode Addons de WordPress Shortcode Addons = 3.2.5 – Subida arbitraria de archivos autenticada Admin+ CVE ID: CVE-2024-31114 Puntuación CVSS: 9.1 Crítica 🛠️ Descripción de la vulnerabilidad El complemento Shortcode Addons – con Visual Composer, Divi, Beaver...

CVE-2021-38163

CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability Description CVE-2021-38163 is a security vulnerability in SAP NetWeaver Application Server AS Java that allows an authenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution RCE...

CVE-2025-49071

CVE-2025-49071 Flozen 1.5.1 - Unauthenticated Arbitrary File Upload Description : Flozen Theme 1.5.1 - Unauthenticated Arbitrary File Upload Description The Flozen Theme for WordPress versions up to and including 1.5.1 is vulnerable to unauthenticated arbitrary file upload, due to missing...

CVE-2025-32682

🐚 CVE-2025-32682 - Subida Arbitraria de Archivos en MapSVG Lite = 8.5.34 📌 Detalles del Plugin Nombre: MapSVG Lite Versión Afectada: = 8.5.34 Tipo de Vulnerabilidad: Subida Arbitraria de Archivos ID de CVE: CVE-2025-32682 Fecha de Publicación: 15 de abril de 2025 Puntuación CVSS: 9.9 Crítica 💥...

CVE-2024-6132

CVE-2024-6132 Pexels: Fotos de stock gratuitas = 1.2.2 - Carga arbitraria de archivos autenticada Contribuidor+ Uso root@kitploit: usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | B...

file-away-exploit

Exploit de File-Away CVE-2025-2539 y CVE-2025-2512 📌 Propósito Este repositorio contiene los detalles de las vulnerabilidades y los scripts descubiertos en File-Away, un plugin de WordPress utilizado para la gestión de archivos. Este plugin contiene dos vulnerabilidades que pueden conducir a la...

CVE-2025-1304

🚨 Tema NewsBlogger de WordPress = 0.2.5.1 - Subida Arbitraria de Archivos CVE-2025-1304 Puntuación CVSS: 8.8 Alta Tipo de vulnerabilidad: Subida Arbitraria de Archivos Componente: Tema de WordPress ID de CVE: CVE-2025-1304 🔥 Resumen de la vulnerabilidad El tema NewsBlogger de WordPress versiones ...

CVE-2025-57176

CVE-2025-57176 CVE-2025-57176 - Siklu EtherHaul Series - Unauthenticated Arbitrary File Upload Affected Versions: Firmware 7.4.0 - 10.7.3 likely all versions since 7.4.0...

CVE-2024-54262

CVE-2024-54262 Import Export For WooCommerce = 1.5 - Authenticated Subscriber+ Arbitrary File Upload Description The Import Export For WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.5. This makes...

CVE-2024-32700

CVE-2024-32700 Subida de archivos arbitraria no autenticada en Kognetiks Chatbot plugin de WordPress...

CVE-2023-24249-PoC

CVE-2023-24249 PoC CVE-2023-24249 is an arbitrary file upload vulnerability in laravel-admin v1.8.19. This proof of concept exploits the vulnerability to upload a web shell. The exploit was written to use against the HackTheBox easy machine Usage. Example root@kitploit: python3 CVE-2023-24249.py ...

CVE-2019-2618

PoC root@kitploit: POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux i686; rv:20.0 Gecko/20100101 Firefox/20.0 Accept: text/html, image/gif, image/jpeg, /; q=.2 Connection: keep-alive username: weblogic password: weblogic...

WeblogicScan

WeblogicScan Weblogic一键漏洞检测工具，V1.5 root@kitploit: 软件作者：TideRabbitMask 免责声明：Pia!ｏ ‵-′ノ”ノ﹏py3升级造成） Not End： 话说大家一直好奇其它同类型工具增加的CVE-2020- 为什么一直没有在这里出现。 其实相关的漏洞利用链以及最新的EXP我都有自己去复现或自己去写，手头也差不多是全的， 但是如何把他们去靠谱的自动化集成一直是个问题，很多公开利用链是依赖ldap或没有回显可供正则的。 : 至于1.4高度封装与框架重新设计的目的，V1.5批量版本近期更新，敬请期待。 V 1.5 更新日志:...

CVE-2026-75865

CVE-2026-75865 — WPLP Cookie Consent gdpr-cookie-consent ≤ 4.4.1 Proof-of-concept and technical write-up for CVE-2026-75865 , an unauthenticated arbitrary file upload leading to remote code execution in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent...

CVE-2025-26319

CVE-2025-26319 1. Subida básica de archivos python flowiseexploit.py -u http://target:3000 -f localfile.txt -d /path/on/server/file.txt 2. Subir archivo de configuración Modificar configuración de clave API python flowiseexploit.py -u http://target:3000 -f newapi.json -d /root/.flowise/api.json 3...

CVE-2024-50482

CVE-2024-50482 Woocommerce Product Design = 1.0.0 - Subida de archivos arbitrarios no autenticada Descripción: El plugin Woocommerce Product Design para WordPress es vulnerable a la subida de archivos arbitrarios debido a la falta de validación del tipo de archivo en todas las versiones hasta la...

CVE-2026-18143

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...