Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution

Melis Technology Melis Platform contains an unrestricted file upload caused by insufficient validation of 'mcsdetailimg' parameter in /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, letting attackers upload malicious files and achieve remote code execution, exploit requires crafted...

Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload

Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to /XSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request. id:...

MikoPBX - Unrestricted File Upload

MikoPBX through 2024.1.114 contains an authenticated unrestricted file upload vulnerability caused by allowing PHP script uploads in PBXCoreREST/Controllers/Files/PostController.php. id: CVE-2025-52207 info: name: MikoPBX - Unrestricted File Upload author: darses severity: critical description: |...

WP Mobile Detector <= 3.5 - Unrestricted File Upload

WP Mobile Detector plugin for WordPress = 3.5 contains an unrestricted file upload vulnerability caused by missing file type validation in resize.php, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution. id: CVE-2016-15043 info: name: WP Mobile...

CVE-2017-16524

CVE-2017-16524 Discovered by Omar Mezrag - 0xFFFFFF Affected Product Samsung Network Video Recorders - Web Viewer 1.0.0.193 on Samsung SRN-1670D Vendor of Product Hanwha / Samsung Security - https://www.hanwhasecurity.com/ Vulnerability type Unrestricted file upload vulnerability Attack Vector...

CVE-2025-32118

🚀 CVE-2025-32118 - WordPress CMP Plugin RCE Exploit 🔍 Title: WordPress CMP – Coming Soon & Maintenance plugin = 4.1.13 - Remote Code Execution RCE 🗓️ Published: 2025-04-04 🔐 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type 📊 CVSS: 9.1 CRITICAL —...

CVE-2026-96515

CVE-2026-96515: authenticated root command execution in Netlink HG323RW An authenticated limited web user can upload a shell script through the Netlink HG323RW diagnostic import handler and have the UID-0 BOA process execute it. Authentication and valid verification/CSRF values are required; this...

monitorr-exploit-toolkit

Monitorr exploit toolkit RCE via unsecure file upload PHP reverse shell, webshell, etc. Administrator account creation via Authorization bypass Technical information leakage : Monitorr version, PHP version, System version & kernel, PHP config, etc. Exploit for CVE-2020-28872 and CVE-2020-28871...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Unrestricted File Upload → RCE Critical Unrestricted File Upload vulnerability in Elementor Pro Potentially leading to Remote Code Execution RCE ⚠️ Overview CVE-2026-32475 is a critical security vulnerability affecting Elementor Pro , a widely deployed WordPress...

CVE-2021-21972

CVE-2021-21972 checker VMware vCenter Server CVE-2021-21972 Remote Code Execution Vulnerability This script looks the existence of CVE-2021-21972 based on the following PATH "/ui/vropspluginui/rest/services/uploadova" trough a POST request and looking in response body 500 the words...

CVE-2024-42992

CVE-2024-42992 Python Pip Pandas v2.2.2 has been found to contain an arbitrary file Pip Pandas all versions - =2.2.2 An arbitrary file read vulnerability exists in the "pandas" library, allowing an attacker to read any file in the file system without restrictions. This vulnerability enables...

Better-CVE-2022-29464

Better CVE-2022-29464 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a...

Unrestricted-File-Upload-on-SiteMagic-CMS-4.4.2

Unrestricted File Upload on SiteMagic CMS 4.4.2 This repo describe how to exploit unrestricted file upload vulnerability on SiteMagic CMS 4.4.2 About SiteMagic CMS 4.4.2 Website: https://sitemagic.org/ Download: https://sitemagic.org/Download.html PoC - Exploiting unrestricted file upload...

CVE-2023-4220_Chamilo_RCE

CVE-2023-4220 Python exploit for Chamilo Unrestricted File Upload Vuln - CVE-2023-4220 The code contained within the repository is meant for educational purposes only. Description: Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in...

CVE-2026-7393-RCE

Pizzafy Ecommerce System 1.0 – Unrestricted File Upload in savemenu Leads to Remote Code Execution Details Field| Value ---|--- Vendor| SourceCodester Vendor URL| https://www.sourcecodester.com Product| Pizzafy Ecommerce System using PHP and MySQL Product URL|...

CVE-2026-76012

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions up to and including 4.4.1 . The flaw resides in the legacy_render function, triggered by broken authorization on the gallery_edit endpoint. Attackers can...

CVE-2026-76012 Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

CVE-2026-76012 Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

CVE-2024-50623

POC - CVE-2024-50623- Cleo Unrestricted file upload and download Overview CVE-2024-50623 is a critical vulnerability identified in Cleo's file transfer software products—Cleo Harmony, Cleo VLTrader, and Cleo LexiCom—versions prior to 5.8.0.21. This flaw allows for unrestricted file uploads and...

CVE-2021-40870

CVE-2021-40870 Exploitation An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. Modules need to Install To run this project...