188 matches found
CVE-2026-1657
CVE-2026-1657: Caricamento File Arbitrario Non Autenticato nel Plugin EventPrime Disclaimer: Questo repository è stato creato solo a scopo educativo e per divulgazione etica. La vulnerabilità è stata segnalata responsabilmente al fornitore ed è stata corretta. Non utilizzare queste informazioni p...
CVE-2024-49668
🚨 CVE-2024-49668: WordPress Verbalize WP Plugin Sicherheitslücke für willkürlichen Datei-Upload 📋 Übersicht CVE-2024-49668 ist eine kritische Sicherheitslücke im WordPress Verbalize WP Plugin, Version 1.0 und darunter. Diese Sicherheitslücke ermöglicht es nicht authentifizierten Angreifern,...
CVE-2024-49653
📜 Exploit del plugin WordPress Portfolleo CVE-2024-49653 🚨 Dettagli della vulnerabilità Titolo: Plugin WordPress Portfolleo = 1.2 - Vulnerabilità di upload arbitrario di file Descrizione: Vulnerabilità di upload senza restrizioni di file con tipo pericoloso in James Eggers Portfolleo portfolleo...
CVE-2026-32475
CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Upload Arbitrario di File Non Autenticato → RCE PoC per CVE-2026-32475 CVSS 9.0 Critico, CWE-434: un upload arbitrario di file non autenticato nel modulo Forms di Elementor Pro che porta all'esecuzione remota di codice. Corretto in Elementor Pro 4.2.2...
Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload
Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress = 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit...
ShowDoc - Remote Code Execution
The open-source API documentation tool ShowDoc had a remote code execution vulnerability before version 2.8.7 This vulnerability allowed unauthenticated remote attackers to upload .php files because the image upload function was not authenticated and the file extension validation was improper. id...
RSFiles! for Joomla - Arbitrary File Upload
RSFiles! comrsfiles for Joomla 1.17.12 allows unauthenticated arbitrary file upload via the rsfiles.upload task. The write method performs no authentication, CSRF token, or file extension checks, allowing upload of executable PHP files to the web-accessible downloads/ directory. id: CVE-2026-5782...
Vanna - SQL injection
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...
Check-WP-CVE-2020-35489
Check-WP-CVE-2020-35489 CVE-2020-35489 La CVE-2020-35489 è stata scoperta nel plugin WordPress Contact Form 7 5.3.1 e nelle versioni precedenti. Sfruttando questa vulnerabilità, gli aggressori possono caricare file di qualsiasi tipo, aggirando tutte le restrizioni relative ai tipi di file...
CVE-2025-66802
CVE-2025-66802 Sourcecodester Covid-19 Contact Tracing System 1.0 – Caricamento illimitato di file che porta all'esecuzione remota di codice Descrizione Sourcecodester Covid-19 Contact Tracing System versione 1.0 contiene una vulnerabilità classificata come Caricamento illimitato di file con tipo...
WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE
The Super Backup & Clone - Migrate for WordPress plugin indeed-wp-superbackup is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to and including 2.3.3. Unauthenticated attackers can...
CVE-2026-Pending-Django-Summernote-RCE
CVE-2026-XXXXX Ausstehend: django-summernote Beliebiger Datei-Upload RCE Dieses Repository enthält einen Proof of Concept PoC für eine bedingte Remote Code Execution RCE -Schwachstelle, die in django-summernote Version 0.8.20.0 und früher entdeckt wurde. Details zur Schwachstelle Produkt :...
CVE-2020-13671-old
CVE-2020-13671 RCE per Datei-Upload — Drupal Core Software: Drupal Core 8.7.5 Betroffen: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 Hoch CWE: CWE-434 — Uneingeschränkter Upload einer Datei mit gefährlichem Typ CISA KEV: Ja — Bekannte ausgenutzte Schwachstelle Advisory:...
CVE-2026-49827
WebErpMesv2 (Resource Management and Manufacturing Execution System) versions 1.19 and prior are affected. A vulnerability in the HR Expense scan_file upload allows self-registered users to upload arbitrary PHP files, enabling Remote Code Execution. The issue is exacerbated by open registration (...
CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...
CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...
CVE-2025-1070
CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded...
CVE-2025-55061 Priority - CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-434 Unrestricted Upload of File with Dangerous Type...
