Lucene search
+L

71056 matches found

Cvelist
Cvelist
added 2026/08/25 3:16 p.m.3 views

CVE-2026-79778 rclone before v1.75.0 Denial of Service via TUS nil-response panic

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...

6CVSS
SaveExploits0References2
CVE
CVE
added 2026/08/25 2:26 p.m.6 views

CVE-2026-16286

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...

9.8CVSS5.4AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/25 2:26 p.m.7 views

CVE-2026-16286 File Upload in TRTEK Software's Software Repository Management

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...

9.8CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/08/25 12:44 p.m.53 views

whoc

whoc A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform! WhoC at Defcon 29 Cloud Village Azurescape - whoc-powered research, the first cross-account container takeover i...

9.3CVSS8.7AI score0.98452EPSS
SaveExploits34References1
BDU FSTEC
BDU FSTEC
added 2026/08/25 11:44 a.m.12 views

The vulnerability of the OpenSky flight planning and operational management system, related to unlimited loading of dangerous file types, allows a perpetrator to execute arbitrary commands.

The vulnerability of the OpenSky flight planning and operational management system lies in its ability to load files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

4.3CVSS6AI score
SaveExploits0Affected Software1
CVE
CVE
added 2026/08/25 11:33 a.m.9 views

CVE-2026-79670

Ech0 before 4.4.3 contains a stored cross-site scripting (XSS) vulnerability in its file upload endpoint . The root cause is that the endpoint validates the Content-Type header using only client-supplied values without performing server-side inspection of the uploaded file. An attacker with admin...

4.8CVSS4.9AI score
SaveExploits0References2
EUVD
EUVD
added 2026/08/25 11:33 a.m.5 views

EUVD-2026-65444

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...

4.8CVSS4.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/25 10:48 a.m.64 views

php_code_analysis

this script will scan your code the script can find 1. checkfileupload issues 2. hostheaderinjection 3. SQl injection 4. insecure deserialization 5. openredirect 6. SSRF 7. XSS 8. LFI 9. commandinjection features 1. fast 2. simple report usage: root@kitploit: python code.py file.php -this will sc...

7.3AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/25 9:53 a.m.29 views

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

8.8AI score
SaveExploits0
CVE
CVE
added 2026/08/25 7:39 a.m.7 views

CVE-2026-16601

CM Map Locations for WordPress (all versions ≤ 2.1.8 ) is vulnerable to limited arbitrary file upload via the cmloc_route_image_upload AJAX action. The uploadMedia function performs incomplete extension filtering without MIME-type checks or upload capability verification before calling move_uploa...

8.8CVSS6.4AI score
SaveExploits0References9
EUVD
EUVD
added 2026/08/25 7:39 a.m.4 views

EUVD-2026-65313

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

8.8CVSS6.3AI score
SaveExploits0References9
Kitploit
Kitploit
added 2026/08/25 7:38 a.m.109 views

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

8.5AI score
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.35 views

WP Mobile Detector <= 3.5 - Unrestricted File Upload

WP Mobile Detector plugin for WordPress = 3.5 contains an unrestricted file upload vulnerability caused by missing file type validation in resize.php, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution. id: CVE-2016-15043 info: name: WP Mobile...

9.8CVSS5.9AI score0.10032EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.11 views

Langflow < 1.9.1 - Unauthenticated File Upload

Langflow 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access. id: CVE-2026-55450 info: name: Langflow 1.9.1 - Unauthenticated File Upload author: xtr0n...

9.3CVSS5.2AI score0.0119EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.20 views

VvvebJs <= 2.0.5 - Cross-Site Scripting

Givanz Vvvebjs = 2.0.5 contains a stored XSS caused by manipulation of the "uploadAllowExtensions" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2026-5615 info: name: VvvebJs = 2.0.5 - Cross-Site Scripting author:...

5.3CVSS4.6AI score0.00773EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.65 views

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

9.8CVSS8.7AI score0.62903EPSS
SaveExploits9References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.8 views

Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload

Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress = 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit...

9.8CVSS5.6AI score0.03639EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.40 views

Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

9.8CVSS9.1AI score0.95478EPSS
SaveExploits7References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.79 views

Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and...

9.8CVSS6.6AI score0.0509EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.55 views

Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution

Melis Technology Melis Platform contains an unrestricted file upload caused by insufficient validation of 'mcsdetailimg' parameter in /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, letting attackers upload malicious files and achieve remote code execution, exploit requires crafted...

9.3CVSS5.6AI score0.02482EPSS
SaveExploits3References3
Rows per page
Query Builder