85921 matches found
Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Code-Execution
CVE-2021-46076 Exploit Title: Vehicle Service Management System - 'Multiple' File upload Leads to Code Execution Exploit Author: SANU P.L CVE: CVE-2021-46076 CVSS: 8.8 HIGH References: https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-code-execution...
CVE-2021-42362
CVE-2021-42362 The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be...
opac-fast-automation
CVE-2025-65862 — Documentation, Analysis, and Automation Tool Research Purposes Only ⚠️ Ethical & Legal Warning All materials in this repository are provided solely for: security research, learning, vulnerability analysis, and testing in environments you own or have explicit permission to test...
smartermail-cve-scanner
SmarterMail CVE-2025-52691 Scanner CVSS 10.0 RCE vulnerability in SmarterMail. Is your mail server vulnerable? Fast, accurate scanner for CVE-2025-52691 - a critical unauthenticated arbitrary file upload vulnerability that enables remote code execution on SmarterMail servers. About CVE-2025-52691...
CVE-2025-63307
CVE-2025-63307 – Authenticated Stored Cross-site Scripting XSS in laravel-file-manager v3.3.1 🧭 Overview An authenticated Stored Cross-site Scripting XSS vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to inject and persist arbitra...
CVE-2023-40028
CVE-2023-40028: Ghost arbitrary file read Proof of concept for CVE-2023-40028, an authenticated arbitrary file-read vulnerability in Ghost's content import feature. A crafted ZIP archive creates a symlink under content/images, allowing the script to request a file from the Ghost host. Ghost...
CVE-2026-85097
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...
CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...
EUVD-2026-94793
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...
CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...
CVE-2026-85097
The Bricksforge plugin for WordPress (versions up to and including 3.1.8.9 ) is vulnerable to unauthenticated arbitrary file upload . The root cause is insufficient validation of the attacker-controlled URL field within the 'temporaryFileUploads' parameter during form submission. An unauthenticat...
CVE-2023-3722
CVE-2023-3722 Python POC for CVE-2023-3722 Avaya Aura Device Services Unrestricted File Upload RCE. This script will use a PUT request to upload a php file with an eight-digit randomly generated filename. Then it will make a GET request to retrieve this file and parse the output to get the comman...
CVE-2026-17196
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...
Exposure Of Sensitive Information
Payload CMS is vulnerable to Exposure of Sensitive Information. The vulnerability is due to improper validation of redirect destinations during authenticated external URL-based upload retrieval, which allows an attacker to redirect requests to an untrusted destination and capture authentication...
CVE-2026-17196 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...
EUVD-2026-94737
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...
CVE-2026-17196
The Super Forms WordPress plugin (versions up to and including 6.3.316 ) is vulnerable to Unrestricted File Type Upload via the upload_files function. The root cause is a lack of file type validation, where the application reads an attacker-controlled extensions string from the _super_elements po...
CVE-2026-17196 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...
