CVE-2020-12800

CVE-2020-12800 Script POC para CVE-2020-12800: RCE a través de Carga de Archivos sin Restricciones Plugin vulnerable para pruebas alojado en: https://mega.nz/file/aQUClQKCZYeiTYSrPuRnwwlRavy4cqfEXs34Tkq6KQig2RcOas Laboratorio de Pentester Academy...

CVE-2025-60655

CVE-2025-60655 - Ejecución Remota de Código RCE mediante Subida sin Restricciones | ---|--- Investigadores| DotAdrien Severidad| 9.8 CRÍTICO CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Software...

-CVE-2015-10137-WordPress-N-Media-Website-Contact-Form-with-File-Upload-1.3.4

WordPress N-Media Website Contact Form with File Uploader Análisis de la vulnerabilidad de carga de archivos 1. Análisis del código de la vulnerabilidad Archivo del plugin: classes/plugin.class.php, método: uploadfile root@kitploit: function uploadfile // ... if ! empty $FILES $tempFile = $FILES...

CVE-2025-67325

🚨 Ejecución remota de código no autenticada RCE mediante carga de archivos 📌 Resumen Proyecto: QloApps Repositorio: https://github.com/Qloapps/QloApps Versiónes afectadas: = 1.7.0 Clase de vulnerabilidad: Ejecución remota de código no autenticada Gravedad: Crítica CVSS v3.1: Crítica 9.8...

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2023-42362

CVE-2023-42362 Autor: Abdelrahman Mohamed Mr-n0b3dy Linked-in: https://www.linkedin.com/in/abdelrhman-mohamed-ashraf-7bb43410b/ Nombre de la vulnerabilidad: Carga de archivos sin restricciones que condujo a ATO Gravedad: Alta Producto: Aplicación web NCR Teller Versión: 4.4.0 Descripción:...

CVE-2024-49653

📜 Exploit del plugin Portfolleo de WordPress CVE-2024-49653 🚨 Detalles de la vulnerabilidad Título: Plugin Portfolleo de WordPress = 1.2 - Vulnerabilidad de subida arbitraria de archivos Descripción: Vulnerabilidad de subida sin restricciones de archivos con tipo peligroso en James Eggers...

CVE-2021-25094

CVE-2021-25094 Tatsu Plugin ZIP File addcustomfont unrestricted upload usage php p.php...

CVE-2026-23499

CVE-2026-23499: Saleor vulnerable a XSS almacenado mediante carga de archivos sin restricciones Resumen...

CVE-2025-56218

CVE-2025-56218 Unrestricted File Upload Description An attacker may upload an Excel file that contains a malicious script or a phishing URL. The application converts the file to PDF and forwards it to the intended recipient for digital signature. Because hyperlinks in the generated PDF are...

CVE-2024-56249

🛠️ WordPress Master Toolkit Exploit CVE-2024-56249 🌟 Resumen Este script explota una vulnerabilidad de subida arbitraria de archivos en el plugin WPMasterToolKit de WordPress, permitiendo a un atacante subir un web shell al servidor. La vulnerabilidad existe en versiones -un -p -fn 📋 Parámetros...

CVE-2026-96513

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-96513 Neethuharii CafeManagement AddProductCode.php unrestricted upload

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-96513

A security flaw in Neethuharii CafeManagement allows for unrestricted upload due to improper processing of the AddProductCode.php file. By manipulating the image argument, an attacker can perform this action remotely. Public exploits for this vulnerability are available. Because the product uses ...

EUVD-2026-84987

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

EUVD-2026-84978

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

CVE-2026-95830

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

CVE-2026-95830 theRealSain Pixtream post_upload.php unrestricted upload

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

CVE-2026-95830

A security flaw in theRealSain Pixtream (up to commit 866afd4f0cea812b918780fb74b67dccf8c4d6a0) allows for an unrestricted upload via remote manipulation of the media argument in the /post_upload.php file. This vulnerability can be exploited remotely, and a public exploit is currently available f...