CVE-2021-21978

CVE-2021-21978 Exploit script with echo back, a simpler way 0. Vulnerability Information The VMware View Planner Web management interface has an entry for uploading log functionality files, which requires no authentication and the log file path written is user-controllable. By overwriting the...

CVE-2022-39952_webshell

Write Behinderwebshell to target using CVE-2022-39952 File Address: https://xx.xx.xx.xx:8443/shell.jsp password:rebeyond Version used: Behinderv3.0 Script improvement from: https://github.com/horizon3ai/CVE-2022-39952...

CVE-2013-3214

CVE-2013-3214 vTiger 5.4.0 Arbitrary File Upload to Remote Code Execution...

CVE-2025-66837

CVE-2025-66837 Malicious File Upload Description A file upload vulnerability in ARIS allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware CVSS Score: 6.8 Medium Attack Type Remote Authenticated Affected Versions Versions before 10.0.23.0.3587512 Discovered By: Yazan...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Stored-Cross-Site-Scripting

CVE-2021-46078 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Stored Cross-Site Scripting Exploit Author: SANU P.L CVE: CVE-2021-46078 CVSS: 4.8 MEDIUM References:...

Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Code-Execution

CVE-2021-46076 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Code Execution Exploit Author: SANU P.L CVE: CVE-2021-46076 CVSS: 8.8 HIGH References: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-code-execution...

CVE-2021-42362

CVE-2021-42362 The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be...

opac-fast-automation

CVE-2025-65862 — Documentation, Analysis, and Automation Tool Research Purposes Only ⚠️ Ethical & Legal Warning All materials in this repository are provided solely for: security research, learning, vulnerability analysis, and testing in environments you own or have explicit permission to test...

smartermail-cve-scanner

SmarterMail CVE-2025-52691 Scanner CVSS 10.0 RCE vulnerability in SmarterMail. Is your mail server vulnerable? Fast, accurate scanner for CVE-2025-52691 - a critical unauthenticated arbitrary file upload vulnerability that enables remote code execution on SmarterMail servers. About CVE-2025-52691...

CVE-2025-63307

CVE-2025-63307 – Authenticated Stored Cross-site Scripting XSS in laravel-file-manager v3.3.1 🧭 Overview An authenticated Stored Cross-site Scripting XSS vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to inject and persist arbitra...

CVE-2025-13595

CIBELES AI = 1.10.8 - Subida de Archivos Arbitraria No Autenticada El plugin de WordPress Cibeles AI en versiones 1.10.8 y anteriores contiene una vulnerabilidad de ejecución remota de código no autenticada en el archivo actualizadorgit.php. Este archivo es accesible directamente a través de HTTP...

CVE-2025-12973

S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator = 1.7.7 - Authenticated Editor+ Arbitrary File Upload The WordPress S2B AI Assistant plugin versions 2.47 and prior contains an arbitrary file upload vulnerability that allows authenticated WordPress users with Editor role or...

CVE-2025-57460

CVE-2025-57460 Des: File upload vulnerability in machsol machpanel 8.0.32 allows attacker gain a webshell. POC: Navigate to https://controlpaneldomain/Client/SubmitTicket.aspx and Upload ASPx webshell then submit the ticket, finally open the file to execute shell and execute commands such as...

CVE-2025-70559

change Upload directory in python script python3 exploit.py LHOST LPORT...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o The AI Bud plugin exposes a REST API endpoint /wp-json/ai-buddy/v1/wp/attachments that allows uploading files to the WordPress media library. The endpoint’s file logic contains file renaming functionality that triggers after file...

CVE-2025-13374

Kalrav AI Agent = 2.3.3 - Carga de archivos arbitraria no autenticada a través de la acción AJAX kalravuploadfile El plugin Kalrav AI Agent de WordPress versión 2.3.3 y anteriores contiene una vulnerabilidad de carga de archivos arbitraria que permite a usuarios no autenticados subir archivos PHP...

CVE-2023-40028

CVE-2023-40028: Ghost arbitrary file read Proof of concept for CVE-2023-40028, an authenticated arbitrary file-read vulnerability in Ghost's content import feature. A crafted ZIP archive creates a symlink under content/images, allowing the script to request a file from the Ghost host. Ghost...

CVE-2019-11231-PoC

GetSimpleCMS CVE-2019-11231 RCE Exploit Unauthenticated Remote Code Execution exploit for GetSimpleCMS ≤ 3.3.15 Vulnerability GetSimpleCMS exposes sensitive files publicly /data/other/authorization.xml, /data/users/ allowing attackers to: 1. Leak API keys and usernames 2. Forge authentication...

CVE-2025-13597

AI Feeds = 1.0.11 - Unauthenticated Arbitrary File Upload The AI Feeds WordPress plugin versions 1.0.11 and below contain an unauthenticated remote code execution vulnerability in the actualizadorgit.php file. This file is directly accessible via HTTP without any authentication or authorization...

CVE-2026-85097

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...