302 matches found
GHSA-8R6W-3QQ5-4P4R Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...
Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms
No d...
Exploit for OS Command Injection in Devcode Openstamanager
CVE-2025-69212-PoC https://github.com/advisories/GHSA-25fp-8w8...
Exploit for Unrestricted Upload of File with Dangerous Type in Wordpress
WordPress Crop Image RCE — CVE-2019-8942 / CVE-2019-8943 Pyth...
CVE-2026-5546
A flaw has been found in Campcodes Complete Online Learning Management System 1.0. This impacts the function addlesson of the file /application/models/Crudmodel.php. This manipulation causes unrestricted upload. It is possible to initiate the attack remotely. The exploit has been published and ma...
Stored-XSS-SVG-File-Upload-PoC
No d...
Exploit for Origin Validation Error in Solarwinds Dameware_Mini_Remote_Control
DameFlare !Pythonh...
SofaWiki 3.9.2 Shell Upload
This is a proof of concept remote shell upload exploit for SofaWiki version 3.9.2 that leverages an issue originally discovered in 2024...
CVE-2021-22358
There is an insufficient input validation vulnerability in FusionCompute 8.0.0. Due to the input validation is insufficient, an attacker can exploit this vulnerability to upload any files to the device. Successful exploit may cause the service abnormal...
CVE-2020-10386
admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory...
CVE-2025-1165
A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...
CVE-2023-53888
Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload malicious JavaScript files, rename them to PHP, and execute system commands by exploiting the saveE and...
CVE-2025-14530 SourceCodester Real Estate Property Listing App property.php unrestricted upload
A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property.php. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has...
Exploit for CVE-2025-12189
Bread & Butter: Gate content + Capture leads + Collect first-p...
EUVD-2005-4089
Malware in sbrugna...
EUVD-2018-8595
Malware in sbrugna...
EUVD-2019-18943
Malware in sbrugna...
EUVD-2021-22931
Malware in sbrugna...