Adning Advertising <= 1.5.5 - Arbitrary File Upload Detection

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

Cisco HyperFlex HX Data Platform - Arbitrary File Upload Detection

Cisco HyperFlex HX Data Platform contains an arbitrary file upload vulnerability in the web-based management interface. An attacker can send a specific HTTP request to an affected device, thus enabling upload of files to the affected device with the permissions of the tomcat8 user. !/usr/bin/env...

Cherry Plugin < 1.2.7 - Arbitrary File Retrieval and File Upload Detection

WordPress plugin Cherry 1.2.7 contains an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file. !/usr/bin/env python3 -- coding: utf-8...

WordPress Cherry < 1.2.7 - Unauthenticated Arbitrary File Upload and Download Detection

WordPress plugin Cherry 1.2.7 has a vulnerability which enables an attacker to upload files directly to the server. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress plugin Cherry 1.""" from...

PrestaShop < 1.7.6.6 - Information Exposure via Upload Directory Detection

PrestaShop versions after 1.5.0.0 and before 1.7.6.6 are vulnerable to information exposure through directory listing in the upload directory due to a missing index.php file. !/usr/bin/env python3 -- coding: utf-8 -- """PrestaShop versions after 1.""" from kittysploit import from...

WordPress File Manager Plugin - Remote Code Execution Detection

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress File Manager plugin prior to version 6.""" from kittysploit...

Drupal 7 Elfinder - Unauthenticated Connector Exposure Detection

Identifies Drupal sites with the elfinder library installed, which could be vulnerable to unrestricted file upload through the connector.php file.When this component is detected, the site may be vulnerable to remote code execution attacks via PHP file uploads.This template only detects the presen...

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload Detection

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE. !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not validate signatures when creating them on the server from user input...

PaperCut < 22.1.3 - Path Traversal Detection

PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """PaperCut NG and PaperCut MF before 22.""" from kittysploit import from lib.protocols.http.httpclient import...

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload Detection

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

CX Cloud Unauthenticated Upload - Detect

CX Cloud unauthenticated upload was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CX Cloud unauthenticated upload was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CX Cloud Unauthenticated Upload...

Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

Label Studio < 1.18.0 - Reflected XSS Detection

Label Studio 1.18.0 contains a stored XSS caused by improper sanitization in POST /projects/upload-example/ endpoint, letting attackers inject malicious scripts to hijack sessions and perform unauthorized actions, exploit requires sending crafted requests. !/usr/bin/env python3 -- coding: utf-8 -...

BlueImp jQuery-File-Upload - Arbitrary File Upload Detection

BlueImp jQuery-File-Upload does not require validation to upload files to the server and does not exclude file types, which can lead to a remote code execution vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """BlueImp jQuery-File-Upload does not require validation to upload files to the...

dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks Detection

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. !/usr/bin/env python3 -- coding:...

DNN - Unrestricted Arbitrary File Upload

DNN 10.1.1 allows unauthenticated uploads via HtmlEditorProviders FileUploader.ashx. !/usr/bin/env python3 -- coding: utf-8 -- """DNN - Unrestricted Arbitrary File Upload""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE) Detection

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """cgi-bin/xmlstatus.""" import re from kittysploit import from lib.protocols.http.httpclient...

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution Detection

Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a...

CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

CVE-2026-54593: Improper Restriction of Security Token Assignment

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...