CVE-2018-19422

CVE-2018-19422 root@kitploit: Exploit Title: File Upload Bypass to RCE Authenticated Google Dork: N/A Date: 17/05/2021 Exploit Author: Drew Alleman Based on an exploit written by: Fellipe Oliveira Vendor Homepage: https://subrion.org/ Software Link: https://github.com/intelliants/subrion Version:...

Upload_Bypass

UploadBypass v3 О программе Upload Bypass — это простой инструмент, предназначенный для помощи пентестерам и баг-хантерам в тестировании механизмов загрузки файлов. Он использует различные техники bug bounty, чтобы упростить процесс выявления и эксплуатации уязвимостей, обеспечивая тщательную...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla 컴포넌트 인증 없는 파일 업로드 RCE 분할 컨트롤러 업로드 우회 → 직접 쓰기 태스크 → /downloads/shell.php → RCE 개요 CVE-2026-57827 은 Joomla용으로 널리 사용되는 파일 관리 및 다운로드 컴포넌트인 RSFiles!comrsfiles 버전 1.17.12에서 발생하는 치명적 심각도CVSS 9.8의 인증 없는 임의 파일 업로드 취약점입니다. 이 취약점은 분할 컨트롤러 설계 결함을 악용합니다. RSFiles!는 업로드를 두 개의...

EXPLOIT-CVE-2025-27515

CVE-2025-27515 Доказательство концепции Практическая демонстрация CVE-2025-27515 , уязвимости обхода проверки загрузки файлов в Laravel Framework ≤ 12.0.0. Обзор уязвимости CVE-2025-27515 — это обход проверки, позволяющий атакующим обойти ограничения на загрузку файлов, когда приложения Laravel...

CVE-2024-21546

CVE-2024-21546 Эксплойт на Python 🔥 Описание Этот скрипт эксплойта на Python нацелен на уязвимый Laravel Filemanager, созданный UniSharp , который позволяет аутентифицированным пользователям обходить ограничения на файлы и загружать вредоносные файлы. Это может привести к удаленному выполнению ко...

Bypass-File-Upload-on-Koken-CMS

Koken CMS 파일 업로드 우회 이 저장소는 Koken CMS - 0.22.24인증됨에서 파일 업로드 제한을 우회하는 방법을 설명합니다. Koken CMS 정보 Koken은 사진 작가, 디자이너 및 아티스트를 위해 설계된 무료 콘텐츠 관리 시스템입니다. 웹사이트: http://koken.me/ Koken CMS는 Softaculous에서도 사용할 수 있습니다: https://www.softaculous.com/apps/cms/Koken 파일 업로드 제한 우회PoC Koken CMS 업로드 제한은 허용된 파일 확장자...

Inject-PHP-to-JPG-Using-Jhead

Jhead를 사용하여 JPG에 PHP 주입하기 $ pkg install vim or apt-get install vim $ pkg install jhead or apt-get install jhead $ jhead -h 도움말 보기 $ jhead -purejpg yourfiles.jpg $ jhead -ce yourfiles.jpg ESC를 누른 후 :x를 입력하여 저장하세요 $ jhead yourfiles.jpg 예시 : site.com/youfiles.php?cmd=Command Here...

CVE-2020-29607-POC

Pluck CMS 4.7.13 Эксплойт RCE через загрузку файлов 🚨 Учебный эксплойт удаленного выполнения кода 🚨 Автор: Ron Jost Hacker5preme Ссылка: Exploit-DB CVE: CVE-2020-29607 ⚠️ Отказ от ответственности: Этот скрипт предназначен только для образовательного и авторизованного тестирования. Не используйте...

vuln-chain-lab

File Upload Bypass + Stored XSS PoC Lab Намеренно уязвимое веб-приложение, демонстрирующее, как обход загрузки файлов сочетается с хранимой XSS для создания бэкдор-учетных записей администратора, даже при наличии CSP, CORS и CSRF-защиты. Полная статья в блоге: KurtiseBear Blog Это образовательный...

CVE-2023-47129

CVE-2023-47129 - Statamic CMS 버전 " image.jpg 4 이 파일의 이름을 image.php로 변경합니다. 5 양식 페이지에서 생성한 image.php 파일을 업로드합니다. 6 이제 이 파일을 실행하려면 https://yoursite.com/assets/image.php에 접속하면 됩니다. 참고:https://yoursite.com을 테스트 설치 주소로 바꾸세요. 참조 GHSA-72hg-5wr5-rmfc...

tomcat-cve-2017-12617

Tomcat CVE-2017-12617 エクスプロイト/PoC Apache Tomcat 9.0.1 Beta / 8.5.23 / 8.0.47 / 7.0.8 - JSP アップロードバイパス / リモートコード実行 Python3 用 元のスクリプトを Python 3 と互換性を持たせるために、いくつか調整を加えただけです！ 何か問題や不具合があれば、遠慮なく [email protected] までメールしてください。ご希望であれば、直接私に連絡してもらっても構いません。 メールアドレスについてとやかく言わないでください。使い捨て用として使っているので 使い方...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell アップロードエクスプロイト 説明: このPythonスクリプトは、Pluck CMS（例：4.7.13より前のバージョン）のファイルアップロード制限バイパス脆弱性を悪用して、PHPウェブシェルをアップロードします。アップロード後、シェル（"shell.phar"という名前）を使用して、ターゲットサーバー上でコマンドを実行できます。 このスクリプトは以下の手順を実行します： 1. ターゲットからセッションクッキーを取得してフォーマットします。 2. 指定されたパスワードを使用してターゲットに認証します。 3...

CVE-2026-78078 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification an...

CVE-2026-78078

Helix Ultimate is a Joomla template by joomshaper.com. In versions prior to 2.2.10 , image uploads were validated only by file extension and basic size parameters, allowing an attacker with privileged access to upload non-image files disguised with raster extensions — a content spoofing bypass. T...

CVE-2026-78079 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-78079 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-78079

Helix Ultimate is a Joomla template published by joomshaper.com . In versions prior to 2.2.10 , an open redirect vulnerability exists in the return redirect handling: arbitrary Base64-encoded strings were accepted as return parameters without verifying that the resolved target was an internal sit...

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

CVE-2026-18781 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

GHSA-8HW4-7QJR-3WXG Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...