Lucene search
+L

896 matches found

Kitploit
Kitploit
added 2026/09/03 4:29 p.m.7 views

PhoneMonitor

PhoneMonitor Android 기기용 원격 관리 도구입니다. 앱의 최소 SDK 버전은 API 15이며, 그 특성상 Target API 레벨은 21이 적합합니다. 지침: Android Studio로 PhoneMonitor 폴더를 엽니다. AppSettings.java 파일에서 XXXX 문자열을 해당하는 값으로 바꿉니다. 서명된 APK를 빌드합니다. Webpanel 폴더의 helperfuncs.php 파일에서 데이터베이스 매개변수를 수정합니다. php 파일을 서버에 업로드합니다. 서버에 'phonemonitor'라는 MyS...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/03 2:44 a.m.6 views

CVE-2023-42326

pfSense 2.7.0 コマンドインジェクションエクスプロイト CVE-2023-42326 このPythonスクリプトは、pfSense 2.7.0のコマンドインジェクション脆弱性(CVE-2023-42326)に対する概念実証(PoC)エクスプロイトです。この脆弱性により、認証された攻撃者は interfacesgifedit.php および interfacesgreedit.php コンポーネントを介して任意のコマンドを注入し実行できます。 機能 エクスプロイトモード選択(gif または gre)により、脆弱なコンポーネントを選択します。...

8.8CVSS7.3AI score0.64021EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.15 views

Dolibarr <=22.0.4 - Local File Inclusion

Dolibarr = 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files. id: CVE-2026-34036 info: name:...

6.5CVSS5.9AI score0.01464EPSS
SaveExploits3References3
EUVD
EUVD
added 2026/09/02 2:37 p.m.9 views

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

8.1CVSS5.9AI score0.00528EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/08/30 4:00 p.m.4 views

CVE-2024-4577

CVE-2024-4577 환경 구축 파일 및 PHP파일 --poc-- Invoke-WebRequest -Method POST -Headers @"Content-Type" = "application/x-www-form-urlencoded" -Body "" -Uri "http://localhost/test.php?%ADd+allowurlinclude%3D1+%ADd+autoprepend file%3Dphp://input"...

9.8CVSS6.9AI score0.99987EPSS
SaveExploits68
Kitploit
Kitploit
added 2026/08/29 5:21 p.m.7 views

CVE-2022-48197

CVE-2022-48197 Poiché Yahoo non aggiorna più il progetto secondo questo annuncio: https://yahooeng.tumblr.com/post/96098168666/important-announcement-regarding-yui, ho deciso di divulgare qui le vulnerabilità: L'applicazione presenta numerose vulnerabilità di XSS riflesso praticamente nella maggi...

6.1CVSS6.4AI score0.06608EPSS
SaveExploits3
EUVD
EUVD
added 2026/08/09 6:00 a.m.15 views

EUVD-2026-54879

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

5.7AI score0.00249EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/07 6:00 a.m.11 views

CVE-2026-16263

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

5.6AI score0.00327EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/03 7:16 a.m.25 views

CVE-2026-16250

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

9.8CVSS0.00505EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/03 6:00 a.m.57 views

CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

0.00505EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/03 6:00 a.m.11 views

EUVD-2026-52168

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

6.6AI score0.00754EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/01 9:17 a.m.13 views

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

6.6CVSS0.0069EPSS
SaveExploits0References10
EUVD
EUVD
added 2026/08/01 6:00 a.m.17 views

EUVD-2026-51713

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

5.3AI score0.00347EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/08/01 6:00 a.m.9 views

CVE-2026-13158

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

5.3AI score0.00347EPSS
SaveExploits1References1
CVE
CVE
added 2026/08/01 6:00 a.m.38 views

CVE-2026-13158

The Everest Toolkit WordPress plugin (versions 1.2.3) and implement proper upload handling (e.g., using WordPress wp_handle_upload with strict whitelisting) plus server rules to prevent PHP execution in uploads. If exploiting evidence exists, PoCs or in-wild links are mentioned within connected ...

7.2CVSS5.3AI score0.00347EPSS
SaveExploits1References1
NVD
NVD
added 2026/07/30 8:18 p.m.16 views

CVE-2026-67206

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

8.8CVSS0.014EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/07/30 7:27 p.m.45 views

CVE-2026-67206 Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

8.8CVSS0.014EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment
added 2026/07/30 7:27 p.m.11 views

CVE-2026-67206 Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

8.8CVSS6.4AI score0.014EPSS
SaveExploits1References2
NVD
NVD
added 2026/07/20 1:16 p.m.14 views

CVE-2026-57311

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

5.3CVSS0.00633EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/14 6:11 p.m.13 views

CVE-2026-45072 Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler fileexcerpt Twig filter escapes PHP files through highlightstring but interpolates lines from non-PHP files directly into...

2CVSS6.1AI score
SaveExploits0References7
Rows per page
Query Builder