CVE-2025-49113

CVE-2025-49113 – Roundcube Remote Code Execution RCE PoC Этот репозиторий содержит эксплойт Proof-of-Concept PoC для CVE-2025-49113 , критической уязвимости удалённого выполнения кода в Roundcube Webmail версий до 1.5.10 и 1.6.11. Уязвимость возникает из-за небезопасной десериализации PHP-объекто...

VvvebJs <= 2.0.5 - Cross-Site Scripting

Givanz Vvvebjs = 2.0.5 contains a stored XSS caused by manipulation of the "uploadAllowExtensions" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input. id: CVE-2026-5615 info: name: VvvebJs = 2.0.5 - Cross-Site Scripting author:...

exploit-CVE-2025-49113

Dépôt PoC CVE-2025-49113 Aperçu de CVE-2025-49113 CVE-2025-49113 est une vulnérabilité critique affectant les versions de Roundcube Webmail antérieures à 1.5.10 et 1.6.11. Découverte en 2025, cette faille permet l'exécution de code à distance RCE via une désérialisation d'objets PHP dans le point...

roundcube-cve-2025-49113-lab

ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ: Только для образовательных целей Лаборатория Roundcube Webmail RCE – CVE-2025-49113 Этот репозиторий документирует мою пошаговую эксплуатацию Roundcube Webmail CVE-2025-49113 в контролируемой лабораторной среде для получения секрета, хранящегося в /secret.txt. ⚠️ Отказ от...

CVE-2025-46078

버그 작성자: yggcwhat 영향을 받는 버전: Huocms 공급업체: https://huocms.com/ 소스 코드 주소: https://gitee.com/digital-flag/huocms 취약점 파일: Upload.php 영향을 받는 버전: HuoCMS - controller backend AttachmentController.php: sliceUploadAndSave app service upload Upload.php: tmpMove 이 취약점은 백엔드 문제로, 토큰을 사용하여 백엔드에 로그인한 후 호출해야 합니다...

CVE-2025-49113

Script Python pour CVE-2025-49113 Utilisation : python exploit.py https://ubuntu.com/security/CVE-2025-49113 Description : Roundcube Webmail avant 1.5.10 et 1.6.x avant 1.6.11 permet l'exécution de code à distance par des utilisateurs authentifiés car le paramètre from dans une URL n'est pas vali...

PT-2026-97116

Name of the Vulnerable Software and Affected Versions theRealSain Pixtream versions up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0 Description A security flaw exists in the processing of the '/post upload.php' endpoint. Manipulation of the media argument allows for unrestricted file upload, which...

Exploit for CVE-2026-45140

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-71415: Missing Authorization

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

CVE-2026-5096: Server-Side Request Forgery (SSRF)

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

EUVD-2026-46135

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

CVE-2026-16327

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

CVE-2026-16327: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

CVE-2026-16327

The CVE-2026-16327 entry concerns D-Link DNS-320 firmware 1.0.2 where the /web/web_file/upload.php upload handling is vulnerable. Manipulating the File argument enables unrestricted file upload, with the attack executable remotely. The exploit has been publicly disclosed. No further remediation d...

CVE-2026-16327 D-Link DNS-320 upload.php unrestricted upload

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

CVE-2018-25335

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to...

CVE-2018-25335 WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to...

CVE-2018-25335: Missing Authentication for Critical Function

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to...

PT-2026-41561

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to...

CVE-2025-41029: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'...