WSOB

😭 WSOB CVE-2022-29464 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464. CVE-2022-29464 details: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a...

CVE-2026-32475

CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-32475 CVSS 9.0 Critical, CWE-434: an unauthenticated arbitrary file upload in the Elementor Pro Forms module that leads to remote code execution. Fixed in Elementor Pro 4.2.2 2026-08-19. Reported b...

XSS2Shell-CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/scanning utility for authorized WordPress security testing. The project contains a single-target exploitation workflow and a concurrent multi-target scan-only mode. Important: Use this project only on WordPress installations that you own or...

BIT-GHOST-2026-104411 Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

CVE-2026-18143

CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbitrary File Upload Python 3 PoC for CVE-2026-18143 in Request a Quote for WooCommerce woocommerce-request-a-quote, Addify / WooCommerce.com. Description PoCbit / GitHub CVE-2026-18143 — Request a Quote for WooCommerce ≤ 2.9.2 allows...

WordPress-RCE-CVE-2019-8942

WordPress Crop Image RCE — CVE-2019-8942 / CVE-2019-8943 Python3 implementation of the authenticated WordPress crop-image exploitation chain. The repository is organized around two independent workflows: a manual OSCP-style script and a fully automated script with an integrated reverse-shell...

cve-2018-2894

Weblogic Arbitrary File Upload Vulnerability CVE-2018-2894 Recently, everyone has been talking about this vulnerability, and most have noticed the issue at config.do. However, according to https://mp.weixin.qq.com/s/y5JGmM-aNaHcs6P9a-gRQ the information there, begin.do also has a problem. Without...

CVE-2026-94503

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-94503

The PX-lab Zombify WordPress plugin (versions n/a through 1.7.7 ) is vulnerable to an Unrestricted Upload of File with Dangerous Type (CWE-434). This vulnerability allows an attacker to upload a web shell to the web server, potentially leading to unauthorized access and control. No specific remed...

CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

EUVD-2026-95633

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-94503 WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit = 1.2.3 — Admin+ Arbitrary File Upload to Remote Code Execution RCE 📖 Advisory Overview CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and...

POC-bomber

🔥 POC-bomber 🦄 POC bomber is a vulnerability detection/exploitation tool designed to quickly gain permissions on target servers by leveraging a large number of high-impact vulnerability POCs/EXPs This project collects various high-impact vulnerabilities from the internet, such as RCE · arbitrary...

CVE-2016-10204_Webshell

CVE-2016-10204Webshell A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint, leading to upload of a php webshell. Currently, the webshell variable is set for a MySQL payload. This can be replaced with whatever backend you need to target. More information...

CIMCown

CIMCown CVE-2026-20200 Argument Injection in Cisco IMC with RCE Christoph Peil @ NSIDE ATTACK LOGIC 2026 CVE: CVE-2026-20200 CVSS v3.1 CISCO: 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 NSIDE: 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Advisory: NSIDE-SA-2026-003 Blogpost:...

webuploader-0.1.15-Demo

webuploader-v-0.1.15 Component Has an Unauthorized File Upload Vulnerability Introduction: Baidu's WebUploader component has a file upload vulnerability. This vulnerability is caused by the upload page of the WebUploader component not strictly filtering file types or file extensions. Attackers ca...

phpweb

phpweb Frontend Arbitrary File Upload...

WSO2-2021-1260

WSO2-2021-1260: Deletion of Arbitrary files via Path Traversal in Artifact Name in WSO2 ESB Due to the unsanitized user input in the Artifact Upload feature, an arbitrary file deletion attack could be carried out by leveraging path traversal in the "artifactName" parameter. Vendor Disclosure: The...

CVE-2025-15700 AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...