CVE-2023-43040

CVE-2023-43040 이 저장소에는 RADOS GatewayRADOSGW에서 발견된 CVE-2023-43040 취약점에 대한 개념 증명PoC 익스플로잇이 포함되어 있습니다. 이 취약점은 공격자가 지정된 액세스 키로 접근 가능한 모든 버킷에 객체를 업로드할 수 있게 하여, 무단 데이터 변조 또는 유출로 이어질 수 있습니다. root@kitploit: $ pip install -r requirements.txt $ python CVE-2023-43040.py --accesskey 699GVXAYVZ5A3ZRYSCI0...

CVE-2025-67887

🛡️ Исправление для "уязвимости" CVE-2025-67887/86 в модуле Translate 1C-Битрикс 1С-Битрикс Безопасность Центр информационной безопасности и мониторинга инцидентов компании «1С-Битрикс» информирует В Telegram-каналах появилась информация о наличии уязвимости в модуле "Перевод", якобы позволяющей...

phpweb

phpweb フロントエンド任意ファイルアップロード...

CVE-2021-21972

Usage:CVE-2021-21972.py option -u or --url：целевой URL -t or --type：тип Payload ssh/webshell -f or --file：файл для загрузки webshell или authorizedkeys например：CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p or --proxy：настроить прокси например：CVE-2021-21972.py -u...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - 인증되지 않은 임의 플러그인 설치 설명 WordPress용 Pubnews 테마는 1.0.7 이하 모든 버전에서 pubnewsimporterpluginactionfornotice 함수에 대한 기능 확인이 누락되어 인증되지 않은 임의의 플러그인 설치에 취약합니다. 이 취약점으로 인해 구독자 수준 이상의 접근 권한을 가진 인증된 공격자가 임의의 플러그인을 설치하여 다른 취약점을 악용할 수 있습니다. CWE CWE-434: 위험한 유형의 파일 무제한 업로드 CVSS 점수:...

CVE-2021-22210

0x01 Предисловие Заявление: Данный проект предназначен только для обучения и обмена, не используйте для нелегального неавторизованного тестирования! История обновлений 10.30 Добавлен пул прокси burp Переписаны аргументы командной строки Добавлена функция неавторизованного массового и одиночного...

CVE-2025-31324

CVE-2025-31324 CVE-2025-31324를 악용하기 위해 개발된 개념 증명PoC입니다. 사용법 root@kitploit: usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help message and exi...

CVE-2026-32639

Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...

CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859

Budibase 3.39.4 before 3.40.0 contains an authorization regression in the S3 attachment upload endpoint. Affected component: the attachments endpoint used to generate S3 PutObject presigned URLs. Root cause: the route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC...

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...

CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-71029

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-13743

CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This could allow an attacker with physical access to the product to upload arbitrary malicious firmware to the device without authentication...

GHSA-WVHV-QCQF-F3CX goshs has a file-based ACL authorization bypass in goshs state-changing routes

Summary goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload,...

CVE-2025-14944 Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage

The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded toke...

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Summary AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" a. This bypasses the admin-controlled moderation and draft workflows. The setStatus method validates the status code again...

CVE-2026-3533

The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on importpopuptemplates function as well as insufficient file type validation in the uploadfiles function in all versions up to, and including, 4.14.1. This makes it possible for Authenticat...

WordPress plugin KiviCare – Clinic & Patient Management System (EHR) has security vulnerabilities.

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-24035

Horilla HRMS (Horilla) has an Improper Access Control vulnerability affecting versions 1.4.0 up to but not including 1.5.0. The issue stems from insufficient server-side validation of the employee_id parameter during file uploads, allowing any authenticated employee to upload documents on behalf ...