EUVD-2026-96052

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe...

CVE-2026-89301

The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable in all versions up to and including 4.7.13 due to insufficient file path validation in the process function. This flaw allows unauthenticated attackers to perform limited file deletion of arbitrary safe files on the server via...

CVE-2026-89301 rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe...

CVE-2026-94589

The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7submit function. This is due to missing file extension, MIME type, and size validation in the...

PoC-CVE-2025-12097

CVE-2025-12097 Description NI modification of Appweb server contains a directory traversal vulnerability that allows an attacker to read arbitrary files on the server. URI path /.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/windows/win.ini will be converted to: pathInfo cchar...

CVE-2015-5531-POC

CVE-2015-5531-POC Contexto de la vulnerabilidad Elasticsearch es un motor de búsqueda RESTful distribuido y de código abierto basado en Lucene, desarrollado por la empresa neerlandesa Elasticsearch. Se utiliza principalmente en entornos de computación en la nube y permite indexar datos mediante...

CVE-2023-22809-sudoedit-privesc

CVE-2023-22809 escalada de privilegios sudo Versiones de sudo afectadas: 1.8.0 a 1.9.12p1 Este script automatiza la explotación de la vulnerabilidad CVE-2023-22809 para obtener un shell de root. El script verifica si el usuario actual tiene acceso para ejecutar el comando sudoedit o sudo -e para...

CVE-2024-9466

CVE-2024-9466 CVE-2024-9466 Proof of Concept PoC Description This script checks for the CVE-2024-9466 vulnerability by appending /home/userSpace/devices/debug.txt to a list of target URLs or IP addresses. It determines if the target is vulnerable based on the HTTP response status code and whether...

CVE-2024-21262

REGISTROS Solo para reproducción de CVEs. Recursos relacionados: LINK GITHUB1 GITHUB2 ISSUE Verificar Entornos Descargar docker-24.0.6.tgz desde https://download.docker.com/linux/static/stable/x8664/. sudo mkdir -p /usr/local/docker-24.0.6 sudo tar -xzf docker-24.0.6.tgz -C /usr/local/docker-24.0...

CVE-2023-46870

CVE-2023-46870 Las versiones 3.0.0, 3.1.0, 4.0.0, 4.1.0 y 4.1.1 del Nordic Semiconductor nRF Sniffer for Bluetooth LE tienen permisos de archivo incorrectos establecidos, lo que permite a adversarios realizar escalada de privilegios y ejecución de código modificando scripts bash y python. Palabra...

Bypass-File-Upload-on-Koken-CMS

Bypass File Upload on Koken CMS This repo explain how to bypass File Upload Restrictions on Koken CMS - 0.22.24 authenticated About Koken CMS Koken is a free content management system designed for photographers, designers and artists. Website: http://koken.me/ Koken CMS is avaiable on Softaculous...

full-poc-CVE-2025_21298

Revisión de la vulnerabilidad CVE-2025-21298 CVE-2025-21298 es una vulnerabilidad crítica en la tecnología OLE Object Linking and Embedding utilizada en Microsoft Windows. Afecta específicamente a la función UtOlePresStmToContentsStm en la biblioteca ole32.dll. Esta función se encarga de converti...

EUVD-2026-96041

The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7submit function. This is due to missing file extension, MIME type, and size validation in the...

CVE-2026-94589

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) WordPress plugin is vulnerable to unauthenticated arbitrary file upload in versions up to and including 3.4.5 . The flaw exists in the extcf7_submit function due to insufficient validation of file extensions, MIM...

CVE-2026-94589 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload

The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7submit function. This is due to missing file extension, MIME type, and size validation in the...

CVE-2026-13157

CVE-2026-13157 Theme Demo Import false during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary...

CVE-2025-34171

CVE-2025-34171: Unauthenticated File and Debug Data Exposure in CasaOS Vulnerability Overview Field| Value ---|--- CVE ID| CVE-2025-34171 Affects| CasaOS ≤ 0.4.15 Fixed in| No Patch Available Severity| Medium CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE| CWE-862:...

CVE-2025-50154

CVE-2025-50154, CVE-2025-59214 Divulgazione di hash NTLMv2-SSP Zero Click in Windows File Explorer Di Ruben Enkaoua e Cymulate Primo Blog: Zero Click, Un NTLM: Bypass della Patch di Sicurezza Microsoft CVE-2025-50154 Secondo Blog: Patchato Due Volte, Ancora Bypassato: Nuova Perdita NTLM Bypass...

Cups-RCE-Exploit

CUPS RCE Exploit - CVE-2024-47176 Chain What It Is A fully functional proof-of-concept exploit targeting the CUPS Common Unix Printing System remote code execution vulnerability chain discovered in September 2024. This chain consists of four CVEs — CVE-2024-47176, CVE-2024-47076, CVE-2024-47175,...

Jenkins-CVE-2024-23897

Jenkins CVE-2024-23897 PoC Una prueba de concepto PoC para CVE-2024-23897, una vulnerabilidad de lectura arbitraria de archivos en la interfaz de línea de comandos CLI integrada de Jenkins. Permite a atacantes no autenticados con permiso Overall/Read leer archivos arbitrarios en el sistema de...