CVE-2021-29447-POC

CVE-2021-29447-POC 概要 このスクリプトは、Wordpressのメディアアップロード機能におけるCVE-2021-29447を悪用し、XXEを介してファイルを抽出するために必要な手順を自動化します。 使用方法 root@kitploit: ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port LOCALPORT --media-payload MEDIAPAYLOAD --dtd-payload DTDPAYLOAD...

EUVD-2026-87290

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

WordPress-RCE-CVE-2019-8942

WordPress Crop Image RCE — CVE-2019-8942 / CVE-2019-8943 認証済みWordPressの画像切り抜き（crop-image）エクスプロイトチェーンをPython3で実装しました。このリポジトリは、手動OSCPスタイルのスクリプトと、リバースシェルハンドラを内蔵した完全自動スクリプトの2つの独立したワークフローで構成されています。 認可されたラボ、CTF、トレーニングプラットフォーム、またはテストの明示的な許可があるシステムでのみ使用してください。 影響を受けるWordPressバージョン...

exploit_cve-2021-29447

exploitcve-2021-29447 教育目的のみです。 このエクスプロイトは、wordpress 5.6.2 と php8 が動作しているサーバーから任意のファイルを取得するための、非常に便利なツールです。参照: https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5 必要なのは、基本的な wp-admin アクセスと、メディアファイルをアップロードできる権限だけです。 このエクスプロイトは、wp-admin を使ってアップロードするための .wav ファイルペイロードを生成します。...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - 認証されていないメディアアップロード 説明 User Profile Builder WordPressプラグイン（バージョン3.11.8未満）は適切な認可を行っておらず、WPの非同期アップロード機能を介して認証されていないユーザーがメディアファイルをアップロードできるようになっています。 使用方法: root@kitploit: usage: CVE-2024-6366.py -h -u URL The User Profile Builder WordPress plugin befo...

CVE-2025-8889

エクスプロイトタイトル: WordPress Compress Then Upload Plugin 1.0.3 任意ファイルアップロードによるRCE 日付: 2025-07-23 エクスプロイト作者: Muhammed Çelik ベンダーホームページ: https://wordpress.com/plugins/compress-then-upload ソフトウェアリンク: https://downloads.wordpress.org/plugin/compress-then-upload.latest-stable.zip バージョン: 1.0.3 テスト環境:...

CVE-2024-6366

バージョン3.11.8未満のUser Profile Builder WordPressプラグインのRCE脆弱性を悪用するMetasploitモジュールを作成するには、メディアファイルのアップロード機能における適切な認可の欠如を利用する必要があります。以下に、そのようなMetasploitモジュールを作成する方法を示します。 Metasploitモジュール 以下のコードをwordpressuserprofilebuilderrce.rbとして、Metasploit Frameworkインストール先のmodules/exploits/unix/webappディレクトリに保存してください。...

CVE-2026-93505

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...

CVE-2026-93505 SveltyCMS SVG Media Upload media-service.server.ts cross site scripting

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...

CVE-2026-93505

SveltyCMS 0.0.6 is affected by a cross-site scripting (XSS) vulnerability in the SVG Media Upload component, specifically within the file src/utils/media/media-service.server.ts. An attacker can initiate the attack remotely with low privileges and user interaction required , resulting in low inte...

CVE-2026-93505 SveltyCMS SVG Media Upload media-service.server.ts cross site scripting

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...

EUVD-2026-82932

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...

CVE-2026-93505: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...

EUVD-2026-77449

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

CVE-2026-90931 LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

CVE-2026-90931 LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

CVE-2026-81565

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

CVE-2026-81565

SP Page Builder (Free and Pro) by joomshaper.com, a Joomla extension, is affected in versions 4.0.0 through 6.9.0 by a Missing Directory Confinement flaw in its media upload functionality. The folder request parameter fully replaced the generated date-based destination folder and was passed to Fo...

CVE-2026-81565 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...