CVE-2021-45010-TinyFileManager-Exploit

CVE-2021-45010 CVE-2021-45010: Eine Path-Traversal-Schwachstelle in der Datei-Upload-Funktionalität in tinyfilemanager.php im Tiny File Manager Project’s Tiny File Manager = 2.4.3 ermöglicht es entfernten Angreifern mit gültigen Benutzerkonten, schädliche PHP-Dateien in das Webroot hochzuladen un...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache = 2.4.4 Caricamento Arbitrario di File Non Autenticato fino a RCE Panoramica...

CVE-2026-77018

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-36340

CVE-2026-36340 Vulnerabilità di Remote Code Execution RCE in Krayin CRM v2.1.5 Vulnerabilità di Remote Code Execution RCE in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critica Prodotto interessato: Krayin CRM v2.1.5 Tipo di vulnerabilità: Remote Code Execution RCE Autenticazione richiesta: S...

CVE-2026-77018

The Workeera WordPress plugin (Remote Tech Job Board) before 1.0.6 allows users with a subscriber role to submit unrestricted profile values, which the plugin writes as an unvalidated file into a publicly reachable directory. This mass-assignment flaw enables arbitrary file upload and, consequent...

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

EUVD-2026-66880

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC Entdeckt von: Lucas Montes NiRoX Schwachstelle: Nicht authentifizierter beliebiger Datei-Upload, der zu Remote Code Execution RCE führt CVE-ID: CVE-2026-1357 CVSS: Kritisch 9.8 Status: In Version 0.9.124 gepatcht Überblick Dieses Repository enthält...

CVE-2026-0740

ninja.py Uno script sperimentale/strumento che sfrutta gli endpoint di upload file per il plugin Ninja Forms su siti WordPress. Invia richieste in sequenza ai target elencati in list.txt e scrive gli upload riusciti nel file shell.txt. Requisiti Python 3 requests solitamente installato insieme a...

textpattern-exploit-rce

Textpattern = 4.8.3 Remote Code Execution Authentifiziert Textpattern bis einschließlich Version 4.8.3 erlaubt authentifizierten Benutzern, beliebige PHP-Dateien hochzuladen. Dieses Skript automatisiert den Prozess und ermöglicht das Löschen der hochgeladenen Datei. Verwendung root@kitploit:...

ICS-MoxieManager-FileUpload-PoC

ICS-MoxieManager-RCE-CVE-2026-30-03 CVE-2026-30-03 9.8 Critico Possibile RCE Jenzabar ICS + MoxieManager proff https://www.youtube.com/watch?v=lcfUL6Xx3f4&feature=youtu.be CVE CVSS Impatto Affetto CVE-2026-30-03 9.8 Critico Possibile RCE Jenzabar ICS + MoxieManager Una vulnerabilità nel component...

Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated-POC

Atom-CMS-2.0---Caricamento-File-Esecuzione-Remota-Di-Codice-Non-Autenticato- Esecuzione remota di codice RCE Autore Exploit: Ashish Koli Shikari Homepage del fornitore: https://thedigitalcraft.com/ Link del software: https://github.com/thedigicraft/Atom.CMS Versione: 2.0 CVE: CVE-2022-25487 A...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro Caricamento File Arbitrario Non Autenticato → RCE Proof-of-concept per CVE-2026-32475 CVSS 9.0: una vulnerabilità di caricamento file arbitrario non autenticato nel plugin WordPress Elementor Pro ≤ 4.2.1 che porta all'esecuzione remota di codice...

CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - رفع ملفات تعسفي غير مصادق عليه ⚠️ إخلاء مسؤولية root@kitploit: هذه الأداة مقدمة لأغراض تعليمية وبحوث أمنية فقط. الوصول غير المصرح به إلى أنظمة الكمبيوتر غير قانوني. استخدم هذه الأداة فقط على الأنظمة التي تملكها أو لديك إذن صريح لاختبارها. لا يتحمل المؤلف أي...

struts_cve-2024-53677

Prova de Conceito Configurar ambiente de teste root@kitploit: » git clone [email protected]:0xPThree/strutscve-2024-53677.git » cd strutscve-2024-53677 » sudo docker build --ulimit nofile=122880:122880 -m 3G -t struts-6.3.0.1 . » sudo docker run -p 8081:8080 --ulimit nofile=122880:122880 -m ...

CVE-2020-29607-Pluck-CMS-4.7.13-Authenticated-File-Upload-RCE-PoC

CVE-2020-29607 — Pluck CMS Esecuzione remota di codice autenticata in Pluck CMS precedente alla versione 4.7.13. Il file manager dell'amministratore admin.php?action=files non convalida le estensioni dei file, consentendo il caricamento di file .phar che Apache esegue come PHP. Il caricamento di...

EUVD-2026-66801

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-75339

cjbi admin3 v3.0.0 suffers from missing permission checks on the /storage/upload storage endpoint. Any logged-in user can upload arbitrary files, while any anonymous attacker can download them, enabling unauthorized file access and potential data exposure. The CVSS v3.1 score is 8.8 (High) (AV:N/...

CVE-2026-75339

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82784

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...