CVE-2026-25732-NiceGUI-3.6.1

लेखक: मोहम्मद इदरीस बन्यामेर संपर्क: इंस्टाग्राम: @banyamersecurity गिटहब: https://github.com/mbanyamer CVE-2026-25732 — NiceGUI में पाथ ट्रैवर्सल FileUpload → मनमाना फ़ाइल लेखन एक्सप्लॉइट शीर्षक: NiceGUI में FileUpload पाथ ट्रैवर्सल जिससे मनमाना फ़ाइल लेखन संभव दिनांक: 2025-06-06 परीक्षण किया गय...

WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution

WordPress Contact Form 7 before 1.3.3.3 allows unrestricted file upload and remote code execution by setting supportedtype to php% and uploading a .php% file. id: CVE-2020-12800 info: name: WordPress Contact Form 7 1.3.3.3 - Remote Code Execution author: dwisiswant0 severity: critical description...

Atom CMS v2.0 - Remote Code Execution

Atom CMS v2.0 was discovered to contain a remote code execution RCE vulnerability via /admin/uploads.php. id: CVE-2022-25487 info: name: Atom CMS v2.0 - Remote Code Execution author: theamanrawat severity: critical description: | Atom CMS v2.0 was discovered to contain a remote code execution RCE...

ShowDoc - Remote Code Execution

The open-source API documentation tool ShowDoc had a remote code execution vulnerability before version 2.8.7 This vulnerability allowed unauthenticated remote attackers to upload .php files because the image upload function was not authenticated and the file extension validation was improper. id...

Joomla! Component GMapFP 3.5 - Arbitrary File Upload

Joomla! Component GMapFP 3.5 is vulnerable to arbitrary file upload vulnerabilities. An attacker can access the upload function of the application without authentication and can upload files because of unrestricted file upload which can be bypassed by changing Content-Type & name file too double...

Simple Employee Records System 1.0 - Unrestricted File Upload

Simple Employee Records System 1.0 contains an arbitrary file upload vulnerability due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or perform remote command execution. id: CVE-2019-20183 info: name: Simple Employee Record...

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

Apache Tomcat Servers - Remote Code Execution

Apache Tomcat servers 7.0.0 to 79 are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to t...

CVE-2023-24998

当未定义 multipartResolver 或注册了 StandardServletMultipartResolver 时 使用 Tomcat 内部包中的 FileUpload 此时 Tomcat 版本必须大于 9.0.71 spring boot 2.7.8 Tomcat 的 maxParameterCountDefault: 10000 设置会被注入到 FileUpload.setFileCountMax 中 不使用 Apache Commons Fileupload 依赖 当将 multipartResolver 注册为 CommonsMultipartResolver 时 必须...

CVE-2020-7699_reproduce

CVE-2020-7699 पुनरुत्पादन Node.js RCE भेद्यता CVE-2020-7699 का पुनरुत्पादन, मेरी प्रयोगशाला का कार्य सेटअप Node.js संस्करण: v14.16.1, कृपया सुनिश्चित करें कि Node.js का संस्करण 14 है अन्य संस्करण शायद काम करेगा, मैंने परीक्षण नहीं किया Python संस्करण: 3.9.5, Python का उपयोग केवल HTTP हमला अनुरोध...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB é uma ferramenta Python criada para explorar a nova vulnerabilidade no WSO2 atribuída como CVE-2022-29464. Detalhes do CVE-2022-29464: Certos produtos WSO2 permitem upload de arquivos irrestrito com consequente execução remota de código. O atacante deve usar um endpoi...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit e writeup. Dettagli CVE-2022-29464 è una vulnerabilità critica su WSO2 scoperta da Orange Tsai. La vulnerabilità è un upload arbitrario di file non autenticato e senza restrizioni che consente a un attaccante non autenticato di ottenere RCE sui serve...

CVE-2026-54256

Winter CMS (v1.2.12 and earlier) contains an Insecure Direct Object Reference (IDOR) in the backend FileUpload form widget. The widget's getFileRecord() resolved a user-supplied file_id POST parameter against the global system_files table without scoping to the widget's own relation or parent rec...

cve-2014-0050

cve-2014-0050 CVE-2014-0050 Esempio di sito vulnerabile Questo progetto ha lo scopo di dimostrare lo sfruttamento di CVE-2014-0050 a scopo educativo. Per maggiori informazioni, vedere:...

CVE-2019-14450

Questo repository non contiene un README...

Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution

Aviatrix Controller 6.x before 6.5-1804.1922 contains a vulnerability that allows unrestricted upload of a file with a dangerous type, which allows an unauthenticated user to execute arbitrary code via directory traversal. id: CVE-2021-40870 info: name: Aviatrix Controller 6.x before 6.5-1804.192...

FortiLogger 4.4.2.2 - Arbitrary File Upload

FortiLogger 4.4.2.2 is affected by arbitrary file upload issues. Attackers can send a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then Assets/temp/hotspot/img/logohotspot.asp. id: CVE-2021-3378 info: name: FortiLogger 4.4.2.2 - Arbitrary File Upload author:...

Elementor Website Builder - Remote Code Execution

The Elementor Website Builder plugin for WordPress versions 3.6.0 to 3.6.2 are vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file. This makes it possible for attackers to modify site data and upload...

WordPress File Manager Plugin - Remote Code Execution

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. id: CVE-2020-25213 Uploaded file will be accessible at:-...

WordPress wpDiscuz <=7.0.4 - Remote Code Execution

WordPress wpDiscuz plugin versions version 7.0 through 7.0.4 are susceptible to remote code execution. This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site's server. id: CVE-2020-24186 info: nam...