CVE-2026-105123

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123: Unrestricted Upload of File with Dangerous Type

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peter Tang in WordPress Plugin Advanced Post Manager versions = 4.5.5...

CVE-2026-102261

CVE-2026-102261 This project contains a non-destructive checker to confirm whether an authorized instance of Camaleon CMS enforces the authorization introduced in version 2.9.3. Scope The issue affects POST /admin/media/crop in Camaleon CMS up to 2.9.2. A user with :manage, :media, but without...

CVE-2025-54782

Uso básico: 2. Uso bash python posttest.py urls.txt 3. Comando personalizado: 4. Comando bash python posttest.py urls.txt -c "whoami" python posttest.py urls.txt -c "ls -la /tmp" python posttest.py urls.txt -c "cat /etc/passwd" 5. Especificar el número de hilos: bash python posttest.py urls.txt...

Block-Spring4Shell

Bloqueador del Proyecto Spring4Shell CVE-2022-22965 Manejador del Servidor Firewall - Este proyecto es un servidor firewall de prueba de concepto POC diseñado para detectar y bloquear ataques que explotan la vulnerabilidad CVE-2022-22965, comúnmente conocida como Spring4Shell. El servidor...

CVE-2025-49113

CVE-2025-49113 Roundcube ≤ 1.6.10 RCE post-autenticación mediante deserialización de objetos PHP...

CVE-2025-55182

CVE-2025-55182 Proof of concept exploit for CVE-2025-55182. When successful, it will emulate a shell on the remote target over HTTP-POST requests. Works with both HTTP and HTTPS, but skips any certificate checks. Only supports directory changes with absolute paths. How to use 1. Set up the...

CVE-2019-14223

CVE-2019-14223: Redirección Abierta en Alfresco Share La aplicación Alfresco Share es vulnerable a un ataque de Redirección Abierta mediante una solicitud POST manipulada. Mediante la manipulación del parámetro “failure” un atacante puede redirigir a una víctima a un sitio web malicioso a través ...

CVE-2023-43040

CVE-2023-43040 Este repositorio contiene un exploit de prueba de concepto para la vulnerabilidad CVE-2023-43040 encontrada en RADOS Gateway RADOSGW. Esta vulnerabilidad permite a los atacantes subir objetos a cualquier bucket accesible por la clave de acceso especificada, lo que potencialmente...

CVE-2025-57310

CVE-2025-57310 Una vulnerabilidad de Cross-Site Request Forgery CSRF en Salmen2/Simple-Faucet-Script v1.07 a través de una solicitud POST manipulada a admin.php?p=ads&c=1 que permite a los atacantes ejecutar código arbitrario. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Puntuación Base...

CVE-2013-4322_PoC

CVE-2013-4322PoC Un simple script Python PoC que demuestra la vulnerabilidad de transmisión lenta por POST con codificación chunked...

Heroinn

Heroinn Una implementación de framework C2/post-explotación multiplataforma en Rust. Este proyecto es solo para fines de investigación y estudio, y cualquier comportamiento ilegal que utilice este proyecto no tiene nada que ver con este proyecto. Características GUI Shell PTY interactiva...

cve-2022-1040

Entorno En el entorno de Python 3.10 It's strongly recommended to use the virtual environment pip3 install baseproxy python3.10 will raise an AttributeError if the version of pyOpenSSLdownloaded with baseproxy is too low. Reinstalling the latest version will fix it. pip3 uninstall pyOpenSSL pip3...

WordPress Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Smash Balloon Social Post Feed versions = 4.13.0...