85729 matches found
CVE-2022-1329
WP Elementor 3.6.0/1/2 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version Version: 3.6.0,...
CVE-2026-56290
CVE-2026-56290 - Compagebuilderck Exploit di Massa ⚠️ Disclaimer Questo strumento è destinato esclusivamente a scopi didattici e di test di sicurezza autorizzati. L'accesso non autorizzato ai sistemi informatici è illegale Utilizza questo strumento solo su sistemi di tua proprietà o per cui hai il...
CVE-2026-13714
Realtyna WPL 5.3.0 - Exploit RCE non autenticato Descrizione Questo exploit prende di mira una vulnerabilità critica nel plugin Realtyna Organic IDX + WPL Real Estate nelle versioni precedenti alla 5.3.0. Il plugin utilizza credenziali hardcoded e consente il caricamento di file non autenticato c...
KrayinCRM-RCE-Exploit-CVE-2026-38526
🔓 Krayin CRM v2.2.x - Exploit di Esecuzione Remota di Codice Autenticata ⚠️ SOLO PER TEST DI SICUREZZA AUTORIZZATI - L'uso non autorizzato è illegale e non etico. 📋 Panoramica Questo strumento di exploit dimostra una vulnerabilità critica di esecuzione remota di codice autenticata RCE scoperta in...
CVE-2026-56291
CVE-2026-56291 — Exploit RCE di massa per Balbooa Forms su Joomla Pre-Auth form.uploadAttachmentFile → Nessun CSRF → Upload PHP Panoramica CVE-2026-56291 è una vulnerabilità critica CVSS 9.8 di caricamento arbitrario di file senza autenticazione nell'estensione Joomla Balbooa Forms combaforms CIS...
CVE-2026-48907
CVE-2026-48907 — Joomla JCE Unauthenticated RCE Lab PSsec Educational security research lab for CVE-2026-48907. Overview CVE-2026-48907 is a critical CVSS 10.0 unauthenticated remote code execution vulnerability in JCE Joomla Content Editor , the most widely installed editor extension for Joomla,...
CVE-2026-20245
🚨 CVE-2026-20245 - Cisco Catalyst SD-WAN Manager Privilege Escalation Authenticated Privilege Escalation via Crafted File Upload A vulnerability affecting Cisco Catalyst SD-WAN Manager that allows authenticated attackers with administrative privileges to execute arbitrary commands as root. 📖...
CVE-2025-69212-PoC
CVE-2025-69212 — OpenSTAManager P7M Command Injection PoC OpenSTAManager = 2.9.8 — OS Command Injection via malicious .p7m filename in ZIP upload. File: src/Util/XML.php:100 — unsanitized $file in exec Vector: /plugins/importFEZIP/actions.php → ZIP → .p7m filename → exec"openssl smime ... -in...
Hack-The-Box-Nexus-Findings-Report
🛡️ Hack The Box - Rapporto sui Riscontri di Nexus 📋 Panoramica Questo repository contiene un rapporto completo di test di penetrazione per la macchina Hack The Box Nexus. 🔍 Riscontri Principali Credenziali esposte nella cronologia dei commit di Gitea - Severità Media Caricamento file non limitato...
CVE-2026-14894
CVE-2026-14894 — Super Forms ≤ 6.3.313 Overview Unauthenticated Arbitrary File Upload → Remote Code Execution in the WordPress plugin Super Forms versions ≤ 6.3.313. The vulnerability resides in the AJAX handler supersubmitform which processes file uploads through a datauristring field without...
By-Poloss..-..CVE-2026-48939
CVE-2026-48939 - Upload di File Non Autenticato in iCagenda che Porta a RCE Panoramica Campo| Valore ---|--- ID CVE| CVE-2026-48939 Punteggio CVSS 4.0| 10.0 Critico Vettore CVSS| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE| CWE-284: Controllo degli Accessi Improprio Versio...
CVE_POC_test
CVEPOCtest Reproduction and POC test code for CVE-2019-13086 vulnerability Original CVE information: https://vulners.com/cve/CVE-2019-13086 Test environment: CSZ CMS architecture + php5.4 + MySQL 5.5 + Apache 2.4 Vulnerability types: SQL injection vulnerability File upload vulnerability Brief...
CVE-2026-15282
CVE-2026-15282 — Instant Appointment Mass RCE Exploit Pre-Auth filegetcontents + fileputcontents → PHP Webshell Overview CVE-2026-15282 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Instant Appointment WordPress plugin ≤ 1.2. The addservicefront AJAX action is...
cve-2020-24572
CVE-2020-24572 Eine Schwachstelle wurde in includes/webconsole.php in RaspAP 2.5 entdeckt. Mit authentifiziertem Zugriff kann ein Angreifer eine fehlkonfigurierte und praktisch uneingeschränkte Webkonsole nutzen, um das zugrunde liegende Betriebssystem, auf dem diese Software läuft, anzugreifen u...
cve-2020-24572
CVE-2020-24572 An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured and virtually unrestricted web console to attack the underlying OS running this software, and execute commands on the system including ones for uploading...
CVE-2026-105762
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...
Security Advisory 0185
Security Advisory 0185 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-101158 CVSSv3.1 Base Score: 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 9.3...
PT-2026-106442
Name of the Vulnerable Software and Affected Versions Doctreat versions prior to 1.7.1 Description An unauthenticated arbitrary file upload issue exists in the Doctreat WordPress theme. This allows an attacker to upload files to the server without requiring authentication. Recommendations Update ...