CVE-2023-43040

CVE-2023-43040 该仓库包含针对 RADOS Gateway RADOSGW 中发现的 CVE-2023-43040 漏洞的概念验证利用代码。该漏洞允许攻击者向指定访问密钥可访问的任何存储桶上传对象，可能导致未经授权的数据篡改或泄露。 $ pip install -r requirements.txt $ python CVE-2023-43040.py --accesskey 699GVXAYVZ5A3ZRYSCI0 --secretkey UZAHHNF3WzASPKCnDdQ8rCvAKaBvLlkZI2V8n7We --endpoint...

CVE-2025-67887

🛡️ 针对 1C-Битрикс 的 "漏洞" CVE-2025-67887/86 在 перевод 模块中的修复 1С-Битрикс 安全 1С-Битрикс 信息安全与事件监控中心通知 Telegram 频道中出现了一条关于 "Перевод" 模块存在漏洞的消息，据称该漏洞允许未经授权上传档案且不进行安全检查。 我们立即进行了检查，并且 不确认 产品中存在漏洞。只有管理员才能向 "Переводы" 模块上传文件。消息中提到的所需权限与管理员的权限一致。管理员有权修改并在项目上运行任何代码。 因此，该漏洞不存在。 https://t.me/bitrixkiberbez/76...

phpweb

phpweb: carga arbitraria de archivos en el frontend...

CVE-2021-21972

Usage:CVE-2021-21972.py option -u or --url：目标url -t or --type：Payload类型（ssh/webshell -f or --file：要上传的文件（webshell或authorizedkeys） 例如：CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p or --proxy：设置代理 例如：CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p...

CVE-2021-22210

0x01 前言 声明:本项目仅供学习和交流使用，请勿用于非法未授权测试！ 更新记录 10.30 增加了burp代理池 重写了命令行参数 增加了gitlab未授权批量以及单个检测功能 0x02 使用说明 安装 pip3 install - r requirements.txt 使用方法 usage: CVE-2021-22205.py -h -w WAY -u URL -f FILE CVE-2021-22205 optional arguments: -h, --help show this help message and exit -w WAY, --way WAY Exploit...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Instalación no autenticada de plugins arbitrarios Descripción El tema Pubnews para WordPress es vulnerable a la instalación no autorizada de plugins arbitrarios debido a una falta de comprobación de capacidades en la función pubnewsimporterpluginactionfornotice e...

CVE-2025-31324

CVE-2025-31324 这是一个为利用 CVE-2025-31324 而开发的概念验证代码。 用法 usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help message and exit --https use HTTPS?...

Vulnerabilities in GeoNetwork are addressed through OpenGeo

OpenGeo has identified several vulnerabilities in GeoNetwork, a open-source cataloging application, specifically in versions 4.4.5 through 4.4.11, as well as versions preceding 4.4.12 and 4.2.17. The first vulnerability involves a reflected cross-site scripting XSS attack in the public,...

CVE-2026-32639

Winter CMS (a content management system built on Laravel) contained a broken access control flaw in its CMS Theme Editor AJAX handlers (Cms\Controllers\Index). The controller used OR-logic across five permissions to gate section access, but individual handlers like onSave(), onDelete(), and onDel...

CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

CVE-2026-72859

Budibase 3.39.4 before 3.40.0 contains an authorization regression in the S3 attachment upload endpoint. Affected component: the attachments endpoint used to generate S3 PutObject presigned URLs. Root cause: the route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC...

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...

CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-71029

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

CVE-2026-13743

CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This could allow an attacker with physical access to the product to upload arbitrary malicious firmware to the device without authentication...

GHSA-WVHV-QCQF-F3CX goshs has a file-based ACL authorization bypass in goshs state-changing routes

Summary goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload,...

CVE-2025-14944 Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage

The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded toke...

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Summary AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" a. This bypasses the admin-controlled moderation and draft workflows. The setStatus method validates the status code again...

CVE-2026-3533

The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on importpopuptemplates function as well as insufficient file type validation in the uploadfiles function in all versions up to, and including, 4.14.1. This makes it possible for Authenticat...

WordPress plugin KiviCare – Clinic & Patient Management System (EHR) has security vulnerabilities.

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...