CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media

WBCE File Upload XSS - WBCE v1.6.1 Autor: Sergio Descripción: Vulnerabilidad de subida de archivos en WBCE v.1.6.1 que permite a un atacante local subir un archivo PDF con XSS oculto. Vectores de ataque: Una vulnerabilidad en la sanitización de la subida de archivos multimedia permite subir un...

CVE-2026-81780-Hash-Form

CVE-2026-81780-Hash-Form CVE-2026-81780 — Hash Form RCE The Vulnerability Unauthenticated file upload in WordPress Hash Form plugin ≤ 1.4.2. The plugin allows arbitrary file uploads without proper authentication or file type validation, leading to Remote Code Execution RCE. Exploit Chain Step...

cve-2023-41564-research

Resumen de la vulnerabilidad CVE-2023-41564 CVE-2023-415641 es una vulnerabilidad de XSS almacenado presente en el CMS Cockpit = v2.6.3. Al cargar un archivo HTML con extensión .shtml durante la subida de archivos, el JavaScript se ejecuta en el momento en que se abre el archivo subido. 1:...

CVE-2022-32074

CVE-2022-32074 para osTicket | Sistema de Ticketing de Soporte 1. Find the file listing directory, the root of the file download directoryм fileuploads this is an example. 2. Load the following xssPayload.svg and open it Ejemplo:...

chamilo-lms-unauthenticated-big-upload-rce-poc

Chamilo LMS Unauthenticated Big Upload File RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and instal...

CVE-2025-4336

eMagicOne Store Manager para WooCommerce 1: lo: mtu 65536 qdisc noqueue st...

CVE-2022-24449

CVE-2022-24449 Solar Appscreener XXE Descripción sugerida Se encontró un problema en la herramienta SAST Solar AppScreener hasta la versión 3.10.4. Un actor no autorizado podría explotar los hosts afectados donde esté instalada la versión vulnerable, subiendo archivos XML especialmente manipulado...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764

In versions prior to 3.2.4 , Immich (a self-hosted photo and video management solution) is vulnerable to Remote Code Execution (RCE) . An authenticated non-admin user can upload crafted SVG files that bypass the libvips native loader and fall through to ImageMagick coders. By using attacker-contr...

CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

EUVD-2026-92866

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-105762

The open-source LLM app development platform Dify is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /console/api/remote-files/upload endpoint within api/controllers/web/remote_files.py. The vulnerability exists because the application accepts attacker-controlled URLs w...

CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2023-37790

CVE-2023-37790 Autor: KaizenSecurity Descripción: Se descubrió que Jaspersoft Clarity PPM versión 14.3.0.298 contiene una vulnerabilidad de carga de archivos arbitraria a través de la función de carga de foto de perfil. 1. https://nvd.nist.gov/vuln/detail/CVE-2023-37790 2...

CVE-2024-37085

CVE-2024-37085 subida de shell no autenticada que otorga administrador completo en hipervisores esxi unidos a dominio. Descargar ESXIVORTEX Detalles: una omisión de autenticación que conduce a la subida de una shell en el contexto de vpxuser, otorgando permisos administrativos completos en...

CVE-2020-25042-PoC

CVE-2020-25042-PoC Prueba de concepto para CVE-2020-25042, un problema de subida arbitraria de archivos autenticada en Mara CMS 7.5 que puede conducir a la ejecución remota de código. El script inicia sesión con una cuenta válida de administrador/encargado de Mara CMS, sube un payload PHP a travé...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestricted PHP File Upload via TinyMCE Description CVE-2026-38526 is a critical authenticated remote code execution vulnerability affecting Webkul Krayin CRM v2.2.x. The vulnerability exists in the TinyMCE media upload endpoint...