Inject-PHP-to-JPG-Using-Jhead

Inyectar-PHP-en-JPG-usando-Jhead $ pkg install vim o apt-get install vim $ pkg install jhead o apt-get install jhead $ jhead -h para ayuda $ jhead -purejpg tusarchivos.jpg $ jhead -ce tusarchivos.jpg Pulsa ESC y escribe :x para guardar $ jhead tusarchivos.jpg Ejemplo:...

CVE-2023-47129

CVE-2023-47129 - Statamic CMS 版本 " image.jpg 4） 将此文件重命名为 image.php。 5） 在表单页面上，上传创建的 image.php 文件。 6） 现在，要运行此文件，只需访问 https://yoursite.com/assets/image.php 注意：将https://yoursite.com 替换为你的测试安装地址。 参考 GHSA-72hg-5wr5-rmfc...

CVE-2020-29607-POC

Pluck CMS 4.7.13 文件上传 RCE 漏洞利用 🚨 教育性远程代码执行漏洞利用 🚨 作者: Ron Jost Hacker5preme 参考: Exploit-DB CVE: CVE-2020-29607 ⚠️ 免责声明： 此脚本仅用于教育和授权测试 目的。请勿在您不拥有或未经明确许可的系统上使用。作者和贡献者不对因使用本工具造成的任何误用或损害负责。 🎯 这是什么？ 这是一个针对 Pluck CMS 4.7.13 中文件上传限制绕过 漏洞的 Python 3 利用脚本。它允许经过身份验证的管理员用户上传恶意文件（webshell）并在目标服务器上实现远程代码执行。 🕹️ 功能...

CVE-2024-21546

CVE-2024-21546 Python漏洞利用脚本 🔥 描述 该Python漏洞利用脚本针对由UniSharp 创建的存在漏洞的Laravel文件管理器，允许认证用户绕过文件限制并上传恶意文件。当上传的有效负载被触发时，可能导致远程代码执行RCE 。 该漏洞利用执行以下操作： 验证用户提供的laravelsession 通过正则表达式提取CSRF token 上传包含PHP反弹Shell有效负载的假PNG文件 触发上传的文件 ⚠️ 受影响版本 2.9.1及更早版本 ⚙️ 用法 python3 CVE-2024-21546.py 重要：在运行脚本之前启动你的监听器： nc -lvnp 💻...

vuln-chain-lab

文件上传绕过 + 存储型XSS概念验证实验环境 一个刻意设计存在漏洞的Web应用程序，演示文件上传绕过如何与存储型XSS结合，即使在CSP、CORS和CSRF防护措施到位的情况下，也能创建后门管理员账户。 完整博客文章：KurtiseBear博客 这是一个用于防御安全培训的教育性实验环境。请勿将其部署在任何可公开访问的位置。 此演示展示了什么 该应用程序具有实际的安全控制措施： 内容安全策略 ，将脚本来源限制为'self'（但允许'unsafe-inline'和'unsafe-eval'） 未发送CORS头 ，因此浏览器会阻止跨源请求 所有表单提交（消息、文件上传）均包含CSRF令牌...

Bypass-File-Upload-on-Koken-CMS

Evadir la Restricción de Carga de Archivos en Koken CMS Este repositorio explica cómo evadir las restricciones de carga de archivos en Koken CMS - 0.22.24 autenticado Acerca de Koken CMS Koken es un sistema de gestión de contenidos gratuito diseñado para fotógrafos, diseñadores y artistas. Sitio...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell Upload Exploit 描述： 该 Python 脚本利用 Pluck CMS（例如 4.7.13 之前的版本）中的文件上传限制绕过漏洞，上传一个 PHP Webshell。上传成功后，该 shell（名为 "shell.phar"）可用于在目标服务器上执行命令。 脚本执行以下步骤： 1. 从目标获取并格式化会话 Cookie。 2. 使用提供的密码对目标进行身份验证。 3. 通过存在漏洞的文件上传功能上传 PHP Webshell。 4. 上传完成时显示成功消息。 成功时，脚本会打印： "Auth...

CVE-2018-19422

CVE-2018-19422 Exploit Title: File Upload Bypass to RCE Authenticated Google Dork: N/A Date: 17/05/2021 Exploit Author: Drew Alleman Based on an exploit written by: Fellipe Oliveira Vendor Homepage: https://subrion.org/ Software Link: https://github.com/intelliants/subrion Version: SubrionCMS 4.2...

EXPLOIT-CVE-2025-27515

Prueba de Concepto de CVE-2025-27515 Una demostración práctica de CVE-2025-27515 , una vulnerabilidad de omisión de validación de carga de archivos en Laravel Framework ≤ 12.0.0. Resumen de la Vulnerabilidad CVE-2025-27515 es una omisión de validación que permite a los atacantes eludir las...

CVE-2026-78078 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification an...

CVE-2026-78078

Helix Ultimate is a Joomla template by joomshaper.com. In versions prior to 2.2.10 , image uploads were validated only by file extension and basic size parameters, allowing an attacker with privileged access to upload non-image files disguised with raster extensions — a content spoofing bypass. T...

CVE-2026-78079 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-78079

Helix Ultimate is a Joomla template published by joomshaper.com . In versions prior to 2.2.10 , an open redirect vulnerability exists in the return redirect handling: arbitrary Base64-encoded strings were accepted as return parameters without verifying that the resolved target was an internal sit...

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

CVE-2026-18781 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

PT-2026-78989

Name of the Vulnerable Software and Affected Versions IT Residence versions prior to 3.2.2 Description An arbitrary file upload issue exists that allows a subscriber to upload unauthorized files to the system. Recommendations Update to a version newer than 3.2.1...

EUVD-2026-60589

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing...

CVE-2026-61457

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

CVE-2026-48557

Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer. The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo preserving inner .php...

GHSA-3GGM-C5M7-HFV5 Spatie Laravel Media Library contains a file upload restriction bypass

Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer. The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo preserving inner .php...