CVE-2026-17196

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...

CVE-2016-16113-POC

Get RCE - Bludit CMS 漏洞利用工具 | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| 一个自动化利用工具，结合了 CVE-2019-17240 （认证绕过）和 CVE-2019-16113 （任意文件上传），可在易受攻击的 Bludit CMS 安装上实现远程代码执行。 ⚠️ 法律免责声明 仅限授权的安全测试...

CVE-2025-29009-POC

CVE-2025-29009-POC WooCommerce 医疗处方附件插件 = 1.2.3 - 未经身份验证的任意文件上传。 在此观看演示： https://youtu.be/WvW2shDBIFs...

EUVD-2026-94737

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...

CVE-2026-17196

The Super Forms WordPress plugin (versions up to and including 6.3.316 ) is vulnerable to Unrestricted File Type Upload via the upload_files function. The root cause is a lack of file type validation, where the application reads an attacker-controlled extensions string from the _super_elements po...

CVE-2026-17196 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...

CVE-2026-17196 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...

Cisco-ASA-CVE-2025-20333-Scanner

CVE-2025-20333 スキャナー Cisco ASA / FTD VPN Web Server Buffer Overflow CVE-2025-20333 のためのPythonベースの診断スキャナーです。 CVE-2025-20333 は、WebVPNファイルアップロードハンドラにおける重大なヒープベースのバッファオーバーフロー脆弱性であり、正常に悪用されると rootとしてのリモートコード実行（RCE） につながる可能性があります。 概要 このツールは、脆弱なエンドポイント（主にファイルアップロードハンドラ）が到達可能かどうかをチェックすることで、安全で破壊的でないテスト...

Exploit for CVE-2026-61424

CVE-2026-61424 Unauthenticated arbitrary file upload in the D...

CVE-2018-7600

Drupal 7（CVE-2018-7600 / SA-CORE-2018-002） 使用以下命令安装所需库： pip install requests pip install bs4 $ python3 drupa7-CVE-2018-7600.py -h ============================================================================= | DRUPAL 7 = 7.57 REMOTE CODE EXECUTION CVE-2018-7600 | | by pimps |...

CVE-2022-1565

WordPress Plugin WP All Import = 3.6.7 - リモートコード実行 RCE 認証済み 日付: 2023年11月5日 エクスプロイト作者: Việt HÙng https://github.com/phanthibichtram12 ベンダーホームページ: https://www.wpallimport.com/ ソフトウェアリンク: https://wordpress.org/plugins/wp-all-import/advanced/ 下にスクロールしてバージョンを選択 バージョン: = 3.6.7 テスト済み: 3.6.7 テスト環境:...

Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms

CVE-2026-56291 — Unauthenticated Arbitrary File Upload to RCE...

sudowp-dropzone-elementor

SudoWP DropZone for Elementor Contributors: SudoWP, WP Republic Original Authors: WEB-SHOP-HOSTING Tags: elementor, dropzone, upload, security-patch, fork, cve-2024-5153, honeypot Requires at least: 5.6 Tested up to: 6.7 Stable tag: 1.7.17 License: GPLv2 以降 セキュリティに関する注意事項 これは、廃止された「Startklar...

CVE-2026-38526-KrayinCRM

CVE-2026-38526 KrayinCRM Authenticated Arbitrary File Upload leading to Remote Code Execution Technical analysis and controlled reproduction of CVE-2026-38526 in Webkul Krayin CRM 2.2.x. Overview CVE-2026-38526 is an authenticated arbitrary file upload vulnerability affecting Webkul Krayin CRM...

Dahua Smart Park Management - Arbitrary File Upload

Dahua wisdom park integrated management platform is a comprehensive management platform, a park operations,resource allocation, and intelligence services,and other functions, including/emap/devicePointaddImgIco?. id: CVE-2023-3836 info: name: Dahua Smart Park Management - Arbitrary File Upload...

Bonita Web 2021.2 - Authentication/Authorization Bypass

Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL. id:...

Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution

An unrestricted file upload in WordPress Tatsubuilder plugin version = 3.3.11 enables an unauthenticated attacker to perform a remote code execution RCE on the server host due to multiple weaknesses in the font import feature and put 100,000 websites at risk. id: CVE-2021-25094 info: name:...

SugarCRM Unauthenticated - Remote Code Execution

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. id: CVE-2023-22952 info: name: SugarCRM Unauthenticated - Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: high description: |...

Gibbon LMS <= v25.0.01 - File Upload to RCE

Gibbon LMS versions 25.0.1 and earlier are vulnerable to an Arbitrary File Upload that can lead to Remote Code Execution RCE. The issue stems from the rubricsvisualisesaveAjax.php endpoint, which, notably, does not require authentication. Because of this, unauthenticated attackers could potential...

Jordy Meow AI Engine - Unrestricted File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine- ChatGPT Chatbot.This issue affects AI Engine- ChatGPT Chatbot- from n/a through 1.9.98. id: CVE-2023-51409 info: name: Jordy Meow AI Engine - Unrestricted File Upload author: pussycat0x severity: critical...