PageMyadmin_file_upload_getshell

This repository does not have a README...

Chamilo-CVE-2023-4220-Exploit

Chamilo-LMS-CVE-2023-4220-Exploit This is an Exploit for Unrestricted file upload in big file upload functionality in Chamilo-LMS for this location /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24, and Attackers can obtain remote code execution via uploading of web...

spybrowse

BrowseSpy Assurez-vous de modifier les variables FTP dans tout le code ; ces variables contiennent le nom d'utilisateur, le mot de passe et l'adresse IP du serveur FTP qui reçoit les fichiers. Ce code effectuera les opérations suivantes : 1. Se copier dans le répertoire %TMP% et se nommer...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 RCE после аутентификации суперадминистратор Описание уязвимости Crater Invoice уязвим к неограниченной загрузке файлов опасного типа из-за отсутствия надлежащей проверки ввода. Класс проверки Base64Mime можно обойти, встроив действительную...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Правовая оговорка : этот код предоставлен исключительно в образовательных целях и для авторизованного тестирования CTF, bug bounty, частная лаборатория. Автор не несёт ответственности за незаконное использование. Описание Krayin CRM Webkul ≤...

CVE-2022-32114

Strapi v4.1.12 Vulnerability Explanation: An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file Attack Vectors: After uploading a file containing malicious content, when the user opens the link to t...

CVE-2023-37756-CWE-521-lead-to-malicious-plugin-upload-in-the-i-doit-Pro-25-and-below

CVE-2023-37756 – Weak Password Requirement in admin-center lead to malicious plugin upload in the i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to weak password requirement vulnerability in admin-center + malicious plugin upload lead to RCE vulnerability. These vulnerabilities...

CVE-2023-32315-Openfire-Bypass

CVE-2023-32315 0x01 Obtain the returned JSESSIONID and csrftoken, construct a request packet to add a user replace JSESSIONID, csrftoken cd CVE-2023-32315-Openfire-Bypass/scanall go mod tidy go run main.go -u http://openfire.com:9090 0x02 Plugin compilation and installation mvn clean package or...

CVE-2025-57462

CVE-2025-57462 Des: Stored XSS via Malicious File Upload in machpanel 8.0.32. POC: Navigate to https://controlpaneldomain/Client/SubmitTicket.aspx and Upload PDF file that contain XSS scripts in metadata, after submitting the ticket you can execute malicius XSS script by accessing the uplaoded...

CVE-2021-22005

CVE-2021-22005 VMware vCenter Server Arbitrary File Upload Vulnerability Code By: Junsheng @Orange Network Security Lab Orange Network Security Lab https://0range.team/ 0x00 Risk Overview This tool is only for authorized security testing. Unauthorized illegal attacks on sites are prohibited. Read...

spring4shell-CVE-2022-22965

Simple Spring4Shell POC Check if endpoint is vulnerable python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting --check Exploit vulnerable endpoint python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting -f shell.jsp --exploit Execute command on uploaded webshe...

CVE-2024-24809-Proof-of-concept

CVE-2024-24809 Detail Description Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by...

Zimbra-RCE

Zimbra-RCE Удаленное выполнение кода в Zimbra CVE-2019-9670 $ ./zimbra.py -h . . \ /|| \ | \ \ \ / / / | |/ | \ \ \ | / \ / | / / | | Y Y \ \ \ | // \ | | \ | \ / |||| / /| / || /\ / / / / / / / / / usage: zimbra.py -h -u URL -d DTD -n PAYLOADNAME -f PAYLOADFILE Zimbra RCE...

FallingSkies-CVE-2023-35885

CVE-2023-35885 Cloudpanel 0-day Exploit Author: @EagleTube, @Mzulfahmy, @farphalabs Github : https://github.com/datackmy/FallingSkies-CVE-2023-35885/blob/main/ Affected version: v2.0.0 – v2.3.0 Patched version: v2.3.1 Vendor homepage: CloudPanel.io Product: CloudPanel References:...

CVE-2025-44608

CVE-2025-44608 CloudClassroom-PHP Project v1.0 is vulnerable to RCE via SQL Injection. Vendor: https://github.com/mathurvishal/CloudClassroom-PHP-Project Software Link: https://github.com/mathurvishal/CloudClassroom-PHP-Project/archive/refs/heads/master.zip PoC Step 1: Navigate to the affected UR...

CVE-2025-57298

Stored XSS via Unsafe Markdown Rendering in Kotaemon Summary Kotaemon is an open-source RAG Retrieval-Augmented Generation based document QA system that provides a web interface for querying uploaded documents such as PDF, Word, and Excel files. A stored cross-site scripting XSS vulnerability...

fuxploider

fuxploider Fuxploider est un outil de test de pénétration open source qui automatise le processus de détection et d'exploitation des failles de formulaires de téléchargement de fichiers. Cet outil est capable de détecter les types de fichiers autorisés à être téléchargés et de déterminer la...

covert-control

covert-control Contrôlez des systèmes à distance en téléchargeant des fichiers vers Google Drive, OneDrive, YouTube ou Telegram en utilisant Python pour créer les fichiers et les écouteurs. Il permet de créer des fichiers texte, des images, de l'audio ou des vidéos, avec les commandes en clair ou...

CVE-2026-19386

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for...

DELMIA Apriso - Command Injection

An Improper Control of Generation of Code code injection / file upload → RCE vulnerability affecting DELMIA Apriso Release 2020 → Release 2025. When an authenticated user can upload files and the upload handler fails to canonicalize filenames or enforce storage restrictions, an attacker may place...