189 matches found
CVE-2025-66802
CVE-2025-66802 Sourcecodester Covid-19 Contact Tracing System 1.0 – Carga de archivos sin restricciones que conduce a la ejecución remota de código Descripción Sourcecodester Covid-19 Contact Tracing System versión 1.0 contiene una vulnerabilidad clasificada como Carga sin restricciones de archiv...
ShowDoc - Remote Code Execution
The open-source API documentation tool ShowDoc had a remote code execution vulnerability before version 2.8.7 This vulnerability allowed unauthenticated remote attackers to upload .php files because the image upload function was not authenticated and the file extension validation was improper. id...
WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE
The Super Backup & Clone - Migrate for WordPress plugin indeed-wp-superbackup is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to and including 2.3.3. Unauthenticated attackers can...
Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload
Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress = 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit...
RSFiles! for Joomla - Arbitrary File Upload
RSFiles! comrsfiles for Joomla 1.17.12 allows unauthenticated arbitrary file upload via the rsfiles.upload task. The write method performs no authentication, CSRF token, or file extension checks, allowing upload of executable PHP files to the web-accessible downloads/ directory. id: CVE-2026-5782...
Vanna - SQL injection
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
Check-WP-CVE-2020-35489
Check-WP-CVE-2020-35489 CVE-2020-35489 La CVE-2020-35489 se descubrió en el plugin de WordPress Contact Form 7 5.3.1 y versiones anteriores. Al explotar esta vulnerabilidad, los atacantes podían simplemente subir archivos de cualquier tipo, omitiendo todas las restricciones establecidas sobre los...
CVE-2026-1357
CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...
CVE-2026-Pending-Django-Summernote-RCE
CVE-2026-XXXXX Pendiente: django-summernote Carga Arbitraria de Archivos RCE Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad de Ejecución Remota de Código RCE Condicional descubierta en django-summernote versión 0.8.20.0 y anteriores. Detalles de la Vulnerabilidad...
CVE-2024-49653
📜 Exploit del plugin Portfolleo de WordPress CVE-2024-49653 🚨 Detalles de la vulnerabilidad Título: Plugin Portfolleo de WordPress = 1.2 - Vulnerabilidad de subida arbitraria de archivos Descripción: Vulnerabilidad de subida sin restricciones de archivos con tipo peligroso en James Eggers...
CVE-2024-49668
🚨 CVE-2024-49668: Vulnerabilidad de subida arbitraria de archivos en el plugin Verbalize WP de WordPress 📋 Resumen CVE-2024-49668 es una vulnerabilidad crítica en las versiones 1.0 y anteriores del plugin Verbalize WP de WordPress. Esta vulnerabilidad permite a atacantes no autenticados subir...
CVE-2026-32475
CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-32475 CVSS 9.0 Critical, CWE-434: an unauthenticated arbitrary file upload in the Elementor Pro Forms module that leads to remote code execution. Fixed in Elementor Pro 4.2.2 2026-08-19. Reported b...
CVE-2026-1657
CVE-2026-1657: Carga Arbitraria de Archivos sin Autenticación en el Plugin EventPrime Aviso de exención de responsabilidad: Este repositorio se crea con fines educativos y divulgación ética exclusivamente. La vulnerabilidad ha sido reportada responsablemente al proveedor y ha sido parcheada. No...
CVE-2020-13671-old
CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...
CVE-2026-49827
WebErpMesv2 (Resource Management and Manufacturing Execution System) versions 1.19 and prior are affected. A vulnerability in the HR Expense scan_file upload allows self-registered users to upload arbitrary PHP files, enabling Remote Code Execution. The issue is exacerbated by open registration (...
CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...
CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...
CVE-2025-1070
CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded...
