webuploader-0.1.15-Demo

webuploader-v-0.1.15 コンポーネントにファイルアップロードの脆弱性（未認証） 概要：Baidu WebUploaderコンポーネントにファイルアップロードの脆弱性が存在します。この脆弱性は、WebUploaderコンポーネントのアップロードページがファイルタイプまたはファイル拡張子のフィルタリングを厳格に行っていないことに起因します。攻撃者はこの脆弱性を利用して、スクリプトファイルを直接アップロードするか、制限を簡単にバイパスしてアップロードし、システムコマンドを実行してWebサイトのサーバー権限を取得できます。 server/preview.php...

CVE-2026-57827

CVE-2026-57827 Joomla RSFiles 未認証ファイルアップロードCVE-2026-57827検出&悪用スクリプト...

CVE-2021-21972

CVE-2021-21972 VMware vSphere Client 무단 파일 업로드를 통한 원격 코드 실행 RCE vSphere Web ClientHTML5는 본질적으로 vSphere 설치를 관리할 수 있는 관리 인터페이스입니다. vSphere Client는 관리자가 vSphere 서버에 직접 액세스하지 않고도 vSphere의 핵심 기능에 액세스할 수 있게 해줍니다. 관리자는 새 가상 머신을 생성하고 기존 가상 머신 및 해당 리소스를 관리할 수 있습니다. 크로스 플랫폼 웹 애플리케이션으로서 지원되는 다양한 웹 브라우저 버전을 ...

CVE-2023-22518

Эксплойт CVE-2023-22518 Описание Этот репозиторий содержит скрипт эксплойта для CVE-2023-22518. Скрипт позволяет осуществлять несанкционированную загрузку файлов, что потенциально может привести к удаленному выполнению кода или другим уязвимостям безопасности. Предупреждение Этот репозиторий...

CVE-2026-58428

CVE-2026-58428 : Release attachment extension allowlist bypass via the web release edit form in Gitea (variant of CVE-2025-68939). Connected sources confirm the issue and cite a fix in the Gitea 1.27.0 release tag. The initial documents do not specify exact affected versions or root cause details...

PT-2026-55262

Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description An unauthenticated arbitrary file upload issue exists in the com.sksoft.bill.ImageUpload servlet. Unauthenticated attackers can upload arbitrary files by submitting a POST request to the endpoint without...

CVE-2026-38329

Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...

CVE-2026-35573

ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The...

Exploit for Unrestricted Upload of File with Dangerous Type in Webfulcreations Computer_Repair_Shop

CVE-2024-51793 / 0-Click RCE Exploit - Author: Joshua Provost...

CVE-2021-22736

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a denial of service when an unauthorized file is uploaded...

CVE-2019-18320

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could be able to upload arbitrary files without authentication. Please note that an attacker needs to have network access to the...

PT-2025-47787

Name of the Vulnerable Software and Affected Versions S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress versions through 1.7.8 Description The software is susceptible to arbitrary file uploads because of a lack of file type validation within the storeFile...

EUVD-2017-16959

Malware in sbrugna...

EUVD-2020-28647

Malware in sbrugna...

EUVD-2019-5856

Malware in sbrugna...

EUVD-2021-9871

Malicious code in bioql PyPI...

EUVD-2021-9875

Malicious code in bioql PyPI...

EUVD-2024-50755

Malicious code in bioql PyPI...

EUVD-2023-1832

Malicious code in bioql PyPI...

CVE-2025-5394 Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation

The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the aloneimportpackinstallplugin function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers ...