CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-32475 CVSS 9.0 Critical, CWE-434: an unauthenticated arbitrary file upload in the Elementor Pro Forms module that leads to remote code execution. Fixed in Elementor Pro 4.2.2 2026-08-19. Reported b...

CVE-2025-4403

CVE-2025-4403 Exploit Details Published : May 8, 2025 Updated : May 9, 2025 Severity : High CVSS Score: 9.8 CWE : CWE-434 - Unrestricted Upload of File with Dangerous Type Affected Versions : All versions from n/a through 1.1.6 CVSS Vector CVSS Version : 9.8 Vector String :...

CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload

CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload POC of DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite I'm a simple man, I see cvss:10/10 I go in xD I saw this new CVE CVE-2025-64095 DNN Insufficient Access Control - Image Upload allows for Site Content...

CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...

CVE-2021-21978

CVE-2021-21978 CVE-2021-21978 RCE exp Affected versions VMware View Planner Harness 4.X Similar to CVE-2021-21978, this vulnerability allows uploading arbitrary files without authentication, and achieving remote code execution by modifying the built-in py script. It is worth noting that commands...

CVE-2025-56399

Explotación Masiva CVE-2025-56399 CVE-2025-56399 – Ejecución Remota de Código en laravel-file-manager v3.3.1. Explota la configuración incorrecta en Laravel File Manager para subir y verificar un shell PHP mediante carga de archivos sin autenticación. Instalación Descargar repositorio...

CVE-2024-51788

💀 CVE-2024-51788 - WordPress The Novel Design Store Directory Plugin = 4.3.0 - Unauthenticated Arbitrary File Upload 🚨 Overview CVE-2024-51788 is a newly disclosed critical vulnerability affecting the The Novel Design Store Directory WordPress plugin = v4.3.0. This flaw allows unauthenticated...

CVE-2023-4220-Proof-of-concept

CVE-2023-4220-Proof-of-concept Chamilo LMS Unauthenticated Big Upload File that allows remote code execution CODE IS MADE AND USED FOR HACKTHEBOX CTF PERMX Unauthenticated file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS the php...

CVE-2026-5364

CVE-2026-5364 CVE-2026-5364 is a CVSS 8.1 High Unauthenticated Arbitrary File Upload vulnerability in the Drag and Drop File Upload for Contact Form 7 CVE-2026-5364 — CF7 Drag & Drop File Upload RCE Unauthenticated Arbitrary File Upload viasanitizefilename Bypass CVSS 8.1 High | Affected: = 1.1.3...

wordpress-rce-vapt-cve-2020-25213

WordPress RCE Exploitation & Mitigation CVE-2020-25213 📌 Project Overview This project was developed as part of the IE4012 – Offensive Hacking Tactics & Strategies module. It demonstrates a full cybersecurity attack lifecycle in a controlled lab environment, including: Social engineering attack...

By-Poloss..-..CVE-2026-48939

CVE-2026-48939 - iCagenda Unauthenticated File Upload to RCE Overview...

CVE-2026-3891

CVE-2026-3891 — Pix for WooCommerce Unauthenticated File Upload RCE Nonce Leak → certificatecrtpath Upload → Code Execution Overview CVE-2026-3891 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin by linknacional versio...

CVE-2025-7340

🚨 HT Contact Form Widget = 2.2.1 - Unauthenticated Arbitrary File Upload CVE-2025-7340 CVE: CVE-2025-7340 CVSS: 9.8 Critical 📝 Description The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to...

CVE-2025-6440

CVE-2025-6440 — WordPress WooCommerce Dynamic Pricing & Discounts Plugin Overview This repository contains a Python proof-of-concept PoC script for testing an unauthenticated file upload vulnerability affecting the WordPress WooCommerce Dynamic Pricing & Discounts plugin. ⚠️ This project is...

CVE-2025-11170

CVE-2025-11170 WP移行専用プラグイン for CPI = 1.0.2 - Unauthenticated Arbitrary File Upload 🚀 WP移行専用プラグイン for CPI = 1.0.2 - Unauthenticated Arbitrary File Upload 📝 Description The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...

CVE-2026-3844-Lab

CVE-2026-3844 — Breeze Cache Unauthenticated Arbitrary File Upload to RCE Lab Local-only Docker lab for reproducing and comparing CVE-2026-3844 behavior in the WordPress Breeze Cache plugin. This repository demonstrates the vulnerable behavior in Breeze Cache 2.4.4 and compares it with the patche...

CVE-2024-5084-Red-Team

🚀 HashForm Exploit – Lab Demo This repository contains a proof-of-concept exploit for CVE-2024-5084, a vulnerability found in the Hash Form WordPress plugin. It’s meant only for learning, lab testing, and security research. 📌 About the Vulnerability CVE ID: CVE-2024-5084 Issue: Unauthenticated fi...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload Task → No Auth → 3-String Filter Bypass Overview Unauthenticated arbitrary file upload in DJ-Classifieds for Joomla. The imageupload task endpoint processes file uploads without authentication and relies on a 3-string blocklist ?php, eval, that...