Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Remote Code Execution RCE Exploit Description This script exploits a Remote Code Execution RCE vulnerability in Pluck CMS v4.7.18. The vulnerability allows a malicious user to upload a malicious PHP file to the server and execute it, gaining remote command...

CVE-2022-1329

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution Ngày: 16 tháng 4 năm 2023 Khai thác Tác giả: Việt Hùng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://elementor.com/ Link phần mềm: https://wordpress.org/plugins/elementor/advanced/ kéo xuống chọn phiên...

CVE-2023-4220

Chamilo LMS Unauthenticated Remote Code Execution Exploit CVE-2023-4220 Overview This repository contains a Bash script that exploits an unauthenticated remote code execution RCE vulnerability in Chamilo LMS via arbitrary file write. The vulnerability is identified as CVE-2023-4220. This exploit...

CVE-2024-39210

CVE ID CVE-2024-39210 PRODUCT Best house rental management system VERSION =1.0 PROBLEM TYPE Incorrect Access Control Description Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability allows...

CVE-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail A Path Traversal vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "plugins" parameters do not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2026-113673

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...

EUVD-2026-109216

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...

PT-2026-122507

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...

HTB_Nibbles

HTBNibbles In this repository you will find the technical report of Nibbles, the exploit pwned.py to abuse the CVE-2015-6967 and an autopwn tool autopwn.py in case you want to resolve the machine in HackTheBox. Pwned.py tool: This file will help you to exploit CVE-2015-6967. If you want to run th...

CVE-2022-4047

CVE-2022-4047 Return Refund and Exchange For WooCommerce 4.0.9 - Unauthenticated Arbitrary File Upload Usage @@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@@@ @@@@@@ @@@@@@ @@@ @@@@@@@@ @@@ @@@@@@@@ @@@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@@@ @@@@@@@@@@ @@@@@@@@ @@@@@@@@ @@@@ @@@@@@@@@@ @@@@ @@@@@@@@ !@@ @@! @@@ @...

CVE-2026-114622

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm::execute subsequently applies rawurldecode to fullpath before writin...

CVE-2026-114622 baserCMS: Encoded path traversal bypass in the theme file API

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm::execute subsequently applies rawurldecode to fullpath before writin...

CVE-2026-114622 baserCMS: Encoded path traversal bypass in the theme file API

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm::execute subsequently applies rawurldecode to fullpath before writin...

CVE-2026-114622

The website development framework baserCMS contains an encoded path traversal bypass in the optional BcThemeFile plugin 's Admin API, affecting versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2. The root cause is an incorrect behavior order where ThemeFilesService::update() and getFullpath() val...

EUVD-2026-108993

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm::execute subsequently applies rawurldecode to fullpath before writin...

CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...

CVE-2026-115481

The baserCMS website development framework is vulnerable in versions 5.0.0-beta1 up to (but not including) 5.3.2 and 5.4.2 . The root cause lies in PermissionGroupsService::build(), which creates a wildcard allow rule for non-admin groups when a plugin's config/permission.php file is missing. Bec...

CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...

CVE-2026-115481 baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...

PT-2026-122101

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm:: execute subsequently applies rawurldecode to fullpath before...