85814 matches found
EUVD-2026-96092
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype, which writes attacker-supplied remote file content to the public uploads...
CVE-2026-83526
The FV Player 8 plugin for WordPress (versions
CVE-2026-83526 FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype, which writes attacker-supplied remote file content to the public uploads...
CVE-2018-19422
CVE-2018-19422 Exploit Title: File Upload Bypass to RCE Authenticated Google Dork: N/A Date: 17/05/2021 Exploit Author: Drew Alleman Based on an exploit written by: Fellipe Oliveira Vendor Homepage: https://subrion.org/ Software Link: https://github.com/intelliants/subrion Version: SubrionCMS 4.2...
CVE-2026-94589
The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7submit function. This is due to missing file extension, MIME type, and size validation in the...
CVE-2025-65675
CVE-2025-65675 Stored Cross site scripting XSS vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India. Affected Product: ClassroomIO Affected Version: 0.1.13...
EUVD-2026-96041
The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7submit function. This is due to missing file extension, MIME type, and size validation in the...
CVE-2026-94589 Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7submit function. This is due to missing file extension, MIME type, and size validation in the...
CVE-2026-94589
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) WordPress plugin is vulnerable to unauthenticated arbitrary file upload in versions up to and including 3.4.5 . The flaw exists in the extcf7_submit function due to insufficient validation of file extensions, MIM...
CVE-2026-13157
CVE-2026-13157 Theme Demo Import false during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary...
CVE-2025-28915
CVE-2025-28915 - WordPress ThemeEgg ToolKit Arbitrary File Upload Exploit 📌 Description An Unrestricted File Upload vulnerability in the ThemeEgg ToolKit plugin for WordPress versions ≤ 1.2.9 allows authenticated attackers to upload web shells to the server. This can lead to remote code execution...
CVE-2016-3088
CVE-2016-3088 Statement A Python-based Exploit Script for CVE-2016-3088. This is my first script, so there may be something doesn't quite fit. But it seems go right when I tested. Discription This script can eliminate the need to capture packets during the penetration of CVE-2016-3088, so we can...
Cisco VPN Routers - Unauthenticated Arbitrary File Upload
A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...
Apache httpd <=2.4.29 - Arbitrary File Upload
Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in , which could match '$' to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of...
Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. id: CVE-2024-7399 info: name: Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution author:...
Cloudpanel 2 < 2.3.1 - Remote Code Execution
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. id: CVE-2023-35885 info: name: Cloudpanel 2 2.3.1 - Remote Code Execution author: DhiyaneshDk severity: critical description: | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. impact: | Successfu...
CVE-2024-49668
🚨 CVE-2024-49668: WordPress Verbalize WP Plugin Arbitrary File Upload Vulnerability 📋 Overview CVE-2024-49668 is a critical vulnerability in the WordPress Verbalize WP plugin versions 1.0 and below. This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shell...
CVE-2024-25600-mass
mass upload shell for cve python3 exploit.py -l yourlist.txt path shell https://examplewebsite.com/asd.php...
CVE-2019-11447
CVE-2019-11447 - PoC Exploits CuteNews 2.1.2 via poor file upload checks used when uploading an avatar image leading to RCE. Installation Clone the repository and install the requirements. pip install -r requirements.txt Usage In order to upload an avatar you will require a CuteNews user account,...