85793 matches found
CVE-2026-48907
CVE-2026-48907 CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems Also if...
CVE-2026-0740-mass
CVE-2026-0740 — Mass-Target Exploit Engine Author: 0xNuts Contributor: Cursor Repository: https://github.com/ExDev994/CVE-2026-0740-mass PoC for CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Unauthenticated Arbitrary File Upload which can lead to RCE. Original vulnerability discovered by Sél...
CVE-2021-21972
CVE-2021-21972 CVE-2021-21972 Tested against VMware VCSA 6.7 create ssh keypair ssh-keygen -t rsa -f vcsa.key -N '' create tarbal with ../../../../../home/vsphere-ui/.ssh/authorizedkeys python2 evilarc.py -d 5 -p 'home/vsphere-ui/.ssh' -o unix -f evil.tar authorizedkeys mv evil.tar evil.ova uploa...
CVE-2026-5718
CVE-2026-5718 CVE-2026-5718: Subida de archivos no autenticada a RCE en el plugin DnD Upload CF7 CVE-2026-5718 — Escáner de subida de archivos DnD CF7 a RCE Plugin: Drag and Drop Multiple File Upload for Contact Form 7 Slug del plugin: drag-and-drop-multiple-file-upload-contact-form-7 ID CVE:...
CVE-2026-48939
CVE-2026-48939 — iCagenda Joomla RCE Exploit Pre-Auth Arbitrary File Upload → PHP Code Execution Overview CVE-2026-48939 is a CVSS 10.0 critical vulnerability in the iCagenda events calendar extension for Joomla. The frontend event registration form's file attachment feature enforces access...
CVE-2020-14008
CVE-2020-14008 - ManageEngine Applications Manager RCE Authenticated Remote Code Execution via Arbitrary File Upload in Zoho ManageEngine Applications Manager versions Examples Basic python3 cve-2020-14008.py https://192.168.100.2:8443 admin admin 192.168.100.3 1337 Exploit Flow 1. Login -...
CVE-2025-7441
CVE-2025-7441 StoryChief 1.0.42 - Arbitrary File Upload Vulnerability CVE-2025-7441 - Technical summary Affected component: StoryChief WordPress plugin Vulnerability type: Unauthenticated arbitrary file upload Vulnerable endpoint: /wp-json/storychief/webhook Root cause: The plugin accepts a JSON...
CVE-2026-39770
Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...
CVE-2026-39757
Subscriber Arbitrary File Upload in Taskbot = 6.6 versions...
CVE-2026-39755
Subscriber Arbitrary File Upload in WP Duplicate = 1.1.11 versions...
CVE-2026-39759
Employer / Sales Representative Arbitrary File Upload in Workreap Core = 3.4.5 versions...
CVE-2026-32579
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress = 2.4.9 versions...
CVE-2026-39770 WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...
EUVD-2026-93277
Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...
CVE-2026-39770 WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...
CVE-2026-39770
The Doctreat WordPress theme, version 1.7.0 and below , is vulnerable to an unauthenticated arbitrary file upload (CWE-434). This vulnerability allows an attacker to upload files with dangerous types to the server. The impact is rated as CRITICAL (CVSS 3.1 score of 10.0), potentially leading to h...
CVE-2026-39759
The Workreap Core WordPress plugin versions
CVE-2026-39759 WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability
Employer / Sales Representative Arbitrary File Upload in Workreap Core = 3.4.5 versions...