CVE-2019-11447-POC

sadnews CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept POC by CRFSlick, discovered by AkkuS An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...

PT-2026-109794

Name of the Vulnerable Software and Affected Versions CodeBard Help Desk versions prior to 1.1.3 Description An unrestricted upload of files with dangerous types allows users with subscriber privileges to perform arbitrary file uploads. Recommendations Update CodeBard Help Desk to a version newer...

PT-2026-109843

Name of the Vulnerable Software and Affected Versions Creator LMS versions prior to 1.2.22 Description An unrestricted upload of files with dangerous types allows contributors to perform arbitrary file uploads. Recommendations Update Creator LMS to version 1.2.22 or later...

PT-2026-109477

Name of the Vulnerable Software and Affected Versions Extensions For CF7 versions prior to 3.4.6 Description An arbitrary file upload flaw exists in the extcf7 submit function. The issue stems from missing file extension, MIME type, and size validation within the validation filter of the signatur...

FreePBX-CVE-2025-57819-CVE-2025-61678

FreePBX-CVE-2025-57819-CVE-2025-61678 Chains CVE-2025-57819 stacked query SQL injection and CVE-2025-61678 authenticated file upload in FreePBX Endpoint Manager to achieve Remote Code Execution RCE. For educational use only. References:...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-frameworkclass MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q This exploit requires Metasploit to have a FQDN and the...

CVE-2025-6058

⚡ WPBookit = 1.0.4 - Unauthenticated Arbitrary File Upload 📝 Description The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the imageuploadhandle function, which is hooked via the addbookingtype route in all versions up to, and...

zip-shotgun

ZIP Shotgun Script utility per testare la funzionalità di upload di file zip e la possibile estrazione di file zip per vulnerabilità alias Zip Slip. L'idea per questo script proviene da questo post su Silent Signal Techblog - Compressed File Upload And Command Execution e da OWASP - Test Upload o...

CVE-2024-51788

💀 CVE-2024-51788 - WordPress The Novel Design Store Directory Plugin = 4.3.0 - Unauthenticated Arbitrary File Upload 🚨 Overview CVE-2024-51788 is a newly disclosed critical vulnerability affecting the The Novel Design Store Directory WordPress plugin = v4.3.0. This flaw allows unauthenticated...

CVE-2020-25790

CVE-2020-25790 Typesetter CMS File Upload Vulnerability Environment Pull Method docker pull mtwf/typesettercve-2020-25790:5.1 docker run -it -d -p 80:80 mtwf/typesettercve-2020-25790:5.1 /bin/bash -c "service apache2 start;/bin/bash" Typesetter account password is admin:admin Vulnerability...

CVE-2023-45878-POC

CVE-2023-45878-POC CVE-2023-45878 poc for gibbon LMS on xampp windows. Upload a webshell called shell.php for command injection. For reverse shell uploads a powershell reverse shell ps1 script called shell.ps1 which is uploaded to the target machine using the shell.php. Requirments Python3 Reques...

CVE-2021-21014

PoC Limited CVE-2021-21014 Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Affected version: = Magento 2.4.1 User...

CVE-2015-4133

CVE-2015-4133 usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery WordPress plugin = 3.1.3 CVE-2015-4133 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 positional arguments: YEAR wp-content/uploads sub directory MONTH wp-content/uploads sub...

EUVD-2026-78647

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification...

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

GHSA-4VH2-39RQ-RQ8J Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

struts-uploader-vulnerability

CVE-2024-53677 — How the Exploit Works and How to Run It Vulnerability summary The flaw is in how Struts' FileUploadInterceptor hands off the uploaded filename to the action class. Normally the interceptor sanitizes the filename, but Struts also lets any multipart parameter be processed as an OGN...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 Proof of concept Writeup: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ The python script abuses the upload function that is availible unauthenticated at /admin/files-upload/ The script locally creates a bin folder and a file named...

Rasa-cve-exp

Rasa-cve-exp CVE-2021-42556 server-1.py Just run it directly python server-1.py Arbitrary File Upload PUT /model "modelserver":"url":"http://192.168.244.128:5000/stage1","waittimebetweenpulls":0 Effect as follows: CVE-2021-41127 server-1.py Default model name: evilimportmodel.tar.gz Malicious mod...