CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...

CVE-2020-9380

PoC IPTV Smarters Exploit Usage python gld.py -u http://www.pirate-ilegal-tv.com/ -i Vulnerability file includes/ajax-control.php: ?php / @ PHP 5.6 @ Decoder version : 1.0.0.1 @ Release on : 24.03.2018 @ Website : http://EasyToYou.eu / sessionstart; if fileexists"functions.php" includeonce...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2.3.5 Example:...

CVE-2023-6875

What the exploit does Places a token that allows you to view mail. Finds the admin's username; if it can't find it, then sets "admin" as the default. It requests a link to reset the admin's password, which is emailed to the admin. Uses the token placed in the first step and examines the mail logs...

ZIPFileRaider

ZIP File Raider - Extensión de Burp para pruebas de carga útil en archivos ZIP ZIP File Raider es una extensión de Burp Suite para atacar aplicaciones web con funcionalidad de carga de archivos ZIP. Puede inyectar fácilmente cargas útiles payloads del Escáner/Repetidor de Burp en el contenido ZIP...

fortilogger_arbitrary_fileupload

CVE-2021-3378 | FortiLogger - Unauthenticated Arbitrary File Upload Metasploit Date: 30-01-2021 Exploit Author: Berkan Er [email protected] Vendor Homepage: https://www.fortilogger.com/ Software Link: https://www.fortilogger.com/download Version: 4.4.2.2 Tested on: Windows 10 Enterprise x64...

AgentDVR-5.1.6.0-File-Upload-and-Remote-Code-Execution

AgentDVR-5.1.6.0-File-Upload-and-Remote-Code-Execution CVE-2024-22515 arbitrary file upload and CVE-2024-22514 remote code execution for AgentDVR 5.1.6.0 Authenticated Older versions likely affected https://github.com/Orange-418/CVE-2024-22514-Remote-Code-Execution...

CVE-2025-50286

Grav CMS v1.7.48 / Admin Plugin v1.10.48 - Authenticated RCE via Plugin Upload CVE-2025-50286 Grav CMS v1.7.48 with Admin Plugin v1.10.48 is vulnerable to Remote Code Execution RCE via the "Direct Install" plugin upload feature, allowing authenticated administrators to execute arbitrary PHP code ...

CVE-2023-4226

🛠️ Exploitation CVE-2023-4226 for Chamilo LMS 📋 Description Python script that automates the exploitation of CVE-2023-4226 , an unrestricted file upload vulnerability in Chamilo LMS = v1.11.24. Uploads a PHP web shell based on PentesterMonkey and configures .htaccess to achieve a reverse shell...

CVE-2021-21972

CVE-2021-21972 checker VMware vCenter Server CVE-2021-21972 Remote Code Execution Vulnerability This script looks the existence of CVE-2021-21972 based on the following PATH "/ui/vropspluginui/rest/services/uploadova" trough a POST request and looking in response body 500 the words...

CVE-2025-3054-Exploit

CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...

Bypass-File-Upload-on-Koken-CMS

Bypass File Upload on Koken CMS This repo explain how to bypass File Upload Restrictions on Koken CMS - 0.22.24 authenticated About Koken CMS Koken is a free content management system designed for photographers, designers and artists. Website: http://koken.me/ Koken CMS is avaiable on Softaculous...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Works On VMware-VCSA-all-6.7.0-8217866, VMware-VIM-all-6.7.0-8217866 ✔ VMware-VCSA-all-6.5.0-16613358 ✔ For vCenter6.7 U2+ vCenter 6.7U2+ runs the website in memory, so this exploit cannot work for 6.7 u2+. Needs Testing vCenter 6.5 Linux VCSA/WindowsAwaiting Testing...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

CVE-2026-92247

SynaptikCMS File Manager — Authenticated RCE Vulnerability SynaptikCMS File Manager Authenticated Remote Code Execution SynaptikCMS's file manager allows an authenticated attacker to upload a file and subsequently rename it to a PHP file. This upload and rename behavior can be abused to place...

Check-WP-CVE-2020-35489

Check-WP-CVE-2020-35489 CVE-2020-35489 The CVE-2020-35489 is discovered in the WordPress plugin Contact Form 7 5.3.1 and older versions. By exploiting this vulnerability, attackers could simply upload files of any type, bypassing all restrictions placed regarding the allowed upload-able file type...

WooRefer

WooRefer | CVE-2022-4047 - Return Refund and Exchange For WooCommerce Automatic Mass Tool for check and exploiting vulnerability in CVE-2022-4047 - Return Refund and Exchange For WooCommerce install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How T...

ATutor-2.2.4-Language-Exploit

ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Exploit Title: ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Date: 5/24/19 Exploit Author: liquidsky JMcPeters Vendor Homepage: https://atutor.github.io/ Software Link: https://sourceforge.net/projects/atutor/files/latest/download...

GL.iNet-Multiple-Vulnerabilities

GL.iNet Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2023-46454: In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Legal disclaimer : this code is provided for educational purposes and for authorized testing only CTF, bug bounty, private lab. The author is not responsible for any illegal use. Description Krayin CRM Webkul ≤ 2.2.x exposes the...