Krayin CRM 2.2.x Authenticated Shell Upload

Krayin CRM version 2.2.x contains an authenticated arbitrary file upload vulnerability in its TinyMCE upload endpoint that may allow server-side PHP code execution. This proof of concept authenticates to the application and uploads a supplied file. https://packetstorm.news/download/237475...

WordPress Bricksforge 3.1.8.9 Unauthenticated Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability via the temporaryFileUploads parameter. The proof of concept uploads a GIF/PHP polyglot and verifies PHP execution. https://packetstorm.news/download/236057...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload flaw that can result in PHP code execution. The included proof of concept demonstrates the issue with a GIF/PHP marker polyglot. https://packetstorm.news/download/235859...

phpwcms 1.12.3 Shell Upload

phpwcms version 1.12.3 and prior affected releases contain an unauthenticated unrestricted upload issue in public Form content. A proof of concept demonstrates uploading a .phtml marker that executes when the server maps that extension to PHP. https://packetstorm.news/download/235633...

Maian Pal 2.1 Product Image Shell Upload

Maian Pal version 2.1 contains an authenticated unrestricted product image upload that allows an administrator to upload and execute a PHP shell. Included is a proof of concept. https://packetstorm.news/download/235396...

Apache Struts 2 6.3.0.2 Path Traversal / Shell Upload

Apache Struts 2 version 6.3.0.2 contains a path traversal flaw in the legacy file upload interceptor that permits JSP shell upload outside the intended upload directory. This proof of concept demonstrates remote code execution. https://packetstorm.news/download/235382...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability in temporaryFileUploads that can permit PHP code execution. https://packetstorm.news/download/235378...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions 3.1.8.9 and prior contain an unauthenticated arbitrary file upload vulnerability through manipulated temporary upload metadata. The included proof of concept uses an inert GIF canary to validate the arbitrary file-write condition...

Pizzafy 1.0 Shell Upload / SQL Injection

Pizzafy version 1.0 suffers from remote shell upload and remote SQL injection vulnerabilities. Title: pizzafy-1.0-Multiple-SQLi&FU-shell-vulnerabiliries+Exploit Author: nu11secur1ty Date: 10/12/2026 Vendor: https://github.com/clararod9 Software:...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability in the temporaryFileUploads parameter. The proof of concept uploads a GIF/PHP polyglot, writes it with a .php extension, and verifies command execution...

SP Page Builder 6.6.1 Unauthenticated Shell Upload

SP Page Builder versions 1.0.0 through 6.6.1 contain an unauthenticated arbitrary ZIP file upload that can result in remote code execution. https://packetstorm.news/download/235042...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745: Improper Neutralization of Input During Web Page Generation

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745

The software EMLOG-Pro 2.6.29 is affected by a Cross-Site Scripting (XSS) vulnerability. This flaw allows attackers to execute malicious scripts, which can be leveraged to upload a malicious shell to the system. While the vulnerability requires user interaction, it poses a significant risk to the...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2024-11680

ProjectSend CVE-2024-11680 エクスプロイト これは、ProjectSend における CVE-2024-11680 の概念実証エクスプロイトです。この脆弱性は認証不要の設定変更とウェブシェルのアップロードを可能にします。 説明 このエクスプロイトは ProjectSend の複数の脆弱性を利用します: CSRFトークンのバイパスによる設定変更 安全でないクライアント登録設定 無制限のファイルアップロードによるリモートコード実行 必要条件 Python 3.x 必要な Python パッケージ: root@kitploit: pip install request...

jQuery File Upload RCE (CVE-2018-9206)

Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...

apollo-x-ultimate

APOLLO-X ULTIMATE v1 WordPress Exploit Framework - The Dig...

CVE-2026-16286

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...