Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

Langflow < 1.9.1 - Unauthenticated File Upload

Langflow 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access. id: CVE-2026-55450 info: name: Langflow 1.9.1 - Unauthenticated File Upload author: xtr0n...

Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload

Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress = 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit...

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE. id: CVE-2023-4666 info: name: Form-Maker 1.15.20 - Unauthenticated Arbitrary File Upload author: pussycat0x severity: critical...

Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload

Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56291 info: name: Balbooa Forms 2.4.1 - Unauthenticated Arbitrary File Upload...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 概念実証 解説: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ このPythonスクリプトは、/admin/files-upload/ で認証なしに利用可能なアップロード機能を悪用します。 スクリプトはローカルに bin フォルダと isehourlycron.sh というファイルを作成し、Cisco ISE インストール環境の /opt/CSMS/bin...

CVE-2021-22205

CVE-2021-22205 影響バージョン： Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 使用方法 root@kitploit: python3 CVE-2021-22205.py target "curl \whoami.dnslog" csrf-token の取得： /users/signin から csrf-token を取得し、前述の CVE-2021-22205 POC を使用してアップロードパケットを構築し、認証されていないアップロードリクエストを実行して、最終的に RCE を達成します。 参照:...

Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload

Blueimp jQuery-File-Upload v9.22.0 contains an unauthenticated arbitrary file upload caused by insufficient validation in the upload component, letting remote attackers upload malicious files, exploit requires no authentication. id: CVE-2018-9206 info: name: Blueimp jQuery-File-Upload v9.22.0 -...

Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution

Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack of authentication on file uploads, letting unauthenticated attackers execute arbitrary code by uploading crafted files. id: CVE-2025-34299 info: name: Monsta FTP = 2.11.2 - Unauthenticated Remote Code Execution...

hdwebmobile-photo-video-reviews

HDWebmobile 写真・動画レビュー 顧客が商品レビューに写真や短い動画を添付できるWooCommerceプラグインで、商品ページのレビュー一覧に直接表示されます。 WordPress.org: https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ 初回提出待ち 必要環境: WordPress 6.9+、WooCommerce、PHP 7.4+ ライセンス: GPLv2 以降 このプラグインが存在する理由 競合する「Customer Reviews for...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC CVE-2025-31324 の概念実証: SAP NetWeaver Visual Composer Metadata Uploader における認証なしアップロード このスクリプトは以下を実行します: 1. 脆弱なエンドポイントへのファイルアップロード（アップロードホスト/ポート経由） 2. HTTP GET によるオプションのトリガー（トリガーホスト/ポート経由） 3. 基本的な応答検証/ログ記録 使用例: python3 PoC.py --host sap.example.com --port 50000 --endpoint...

CVE-2025-31324_PoC

CVE-2025-31324PoC CVE-2025-31324 の概念実証: SAP NetWeaver Visual Composer Metadata Uploader における未認証アップロード このスクリプトは以下を実行します: 1. 脆弱なエンドポイントへのファイルアップロード Upload ホスト/ポート経由 2. HTTP GET によるオプションのトリガー実行 Trigger ホスト/ポート経由 3. 基本的なレスポンス検証/ロギング 使用例: python3 PoC.py --host sap.example.com --port 50000 --endpoint...

CVE-2024-29399

CVE-2024-29399 脆弱性の詳細 概要 Savane v3.13 以前では、アップロードされたファイルの検証が欠如しているため、権限昇格が可能になる可能性があります。インストール手順に従って設定された Web サーバーは、クロスサイトスクリプティング XSS に対して脆弱です。誤って設定された Web サーバーでは、これによりリモートコード実行 RCE が発生する可能性があります。 CWE 分類: CWE-434: 危険なタイプのファイルのアップロード制限の欠如 報告者: Ally Petitt 影響を受ける製品 : Savane 影響を受けるバージョン : 3.13 以前...

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-57581

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the...

PT-2026-91281

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the...

CVE-2026-63219

CVE-2026-63219 (CVSS 8.6) is a missing authorization check on the GeoNetwork formatter upload API endpoint, affecting versions prior to 4.4.12 and 4.2.17 . An unauthenticated attacker can upload arbitrary .xsl or .zip files into the server formatter directory, granting unauthorized write access. ...

CVE-2026-82472

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

EUVD-2026-68128

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...