CVE-2022-40471

CVE-2022-40471 – CPMS Authenticated File Upload RCE 📌 Overview CVE-2022-40471 is an authenticated Remote Code Execution vulnerability affecting Clinic's Patient Management System CPMS. The vulnerability exists due to insufficient validation of uploaded files in the user profile image upload...

CVE-2020-7699_reproduce

CVE-2020-7699 Reproduction Reproduction for Node.js RCE vulnerabilityCVE-2020-7699, my lab work Setup Node.js edition: v14.16.1, please make sure that the edition of Node.js is 14Other edition will propably work, I didn't test Python edition：3.9.5, Python is only used to send HTTP attack request,...

CVE-2025-34299

CVE-2025-34299 Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious SFTP server. How does this detection method work? This...

CVE-2026-62129

The Creator LMS WordPress plugin (versions

CVE-2026-62129 WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Creator LMS = 1.2.21 versions...

EUVD-2026-96511

Contributor Arbitrary File Upload in Creator LMS = 1.2.21 versions...

CVE-2026-62024 WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in CodeBard Help Desk = 1.1.2 versions...

CVE-2026-62025 WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Tailored Tools = 3.0.3 versions...

EUVD-2026-96463

Unauthenticated Arbitrary File Upload in Tailored Tools = 3.0.3 versions...

CVE-2026-62024

The CodeBard Help Desk WordPress plugin, versions

EUVD-2026-96462

Subscriber Arbitrary File Upload in CodeBard Help Desk = 1.1.2 versions...

CVE-2026-62025

The Tailored Tools plugin for WordPress (versions

Ashwesker-CVE-2025-52691

🚨 CVE-2025-52691 — Critical SmarterMail Vulnerability Status: 🔥 Critical — Immediate action required CVSS v3.1 Score: 10.0 / 10 Disclosure Date: December 29–30, 2025 🧩 Vulnerability Summary CVE-2025-52691 is a critical, unauthenticated arbitrary file upload vulnerability affecting SmarterTools...

CVE-2025-32140

🚨 CVE-2025-32140 – WP Remote Thumbnail Exploit Arbitrary File Upload 📝 Description CVE-2025-32140 is a critical vulnerability in the WP Remote Thumbnail plugin for WordPress. It enables authenticated attackers with contributor or higher permissions to upload arbitrary files , such as web shells ,...

CVE-2025-66838

CVE-2025-66838 Lack of Rate Limiting - File Upload Description An attacker can rapidly upload a large volume of files to cause denial of service CVSS Score: 6.5 Medium Attack Type Remote Authenticated Affected Versions Versions before 10.0.23.0.3587512 Discovered By: Yazan Abu-Nadi...

CVE-2021-31630

CVE-2021-31630 Modified the PoC CVE-2021-31630 script by Fellipe Oliveira for HTB Usage 'Example usage: exploit.py -u http://target-uri:8080 -l admin -p admin -i 192.168.1.54 -r 4444 -P program.st"'...

CVE-2024-29272

CVE-2024-29272 This is a Proof-of-Concept for CVE-2024-29272, an unauthenticated arbritrary file upload vulnerability that leads to remote code execution on versions of VvvebJS -l -p in another terminal: nc -lvnp...

CVE-2024-48591

CVE-2024-48591 Vulnerability Disclosure: XSS in Inflectra SpiraTeam 7.2.00 Description Inflectra SpiraTeam version 7.2.00 is vulnerable to Cross-Site Scripting XSS through the upload of specially crafted SVG files, which can execute JavaScript when viewed directly. Vulnerability Type Cross-Site...

CVE-2023-4220

Proof of concept exploit for CVE-2023-4220 Affected product : Chamilo = 1.11.24 This CVE abuses an unauthenticated file upload vulnerability in Chamilo 1.11.24 and lower. An attacker has the ability to upload PHP files with no restrictions, leading to RCE. How to use python3 exploit.py -u URL -c...

CVE-2026-49049

CVE-2026-49049 — Helix3 JoomShaper Joomla Unauthenticated AJAX RCE Scanner Mass scanner / verifier for CVE-2026-49049 : unauthenticated AJAX handler in the Helix3 Framework plugin for Joomla v1.0 – 3.1.0 , patched in 3.1.1+. Authorized testing only. Use only on systems you own or have written...