CVE-2025-67887

🛡️ Fix für die „Schwachstelle“ CVE-2025-67887/86 im 1C-Bitrix Translate-Modul 1C-Bitrix Sicherheit Das Informationssicherheits- und Incident-Monitoring-Zentrum von «1C-Bitrix» informiert In Telegram-Kanälen tauchten Informationen über das Vorhandensein einer Schwachstelle im Modul „Übersetzung“...

WordPress ImproveSEO plugin <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability

Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by João Ramos Maciel in WordPress Plugin Improve SEO versions = 2.0.11...

CVE-2026-31816-rshell

Exploit Reverse Shell CVE-2026-31816 Panoramica Questo strumento sfrutta la CVE-2026-31816 per stabilire una connessione reverse shell su un server Budibase di destinazione. Catena di attacco : Bypass dell'autenticazione → Upload del plugin DATASOURCE → Esecuzione di codice lato server → Reverse...

CVE-2026-77018

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77018

The Workeera WordPress plugin (Remote Tech Job Board) before 1.0.6 allows users with a subscriber role to submit unrestricted profile values, which the plugin writes as an unvalidated file into a publicly reachable directory. This mass-assignment flaw enables arbitrary file upload and, consequent...

CVE-2026-77018 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

EUVD-2026-66880

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC Entdeckt von: Lucas Montes NiRoX Schwachstelle: Nicht authentifizierter beliebiger Datei-Upload, der zu Remote Code Execution RCE führt CVE-ID: CVE-2026-1357 CVSS: Kritisch 9.8 Status: In Version 0.9.124 gepatcht Überblick Dieses Repository enthält...

cve-2024-21683-rce

cve-2024-21683-rce CVE-2024-21683 è una grave vulnerabilità di esecuzione remota di codice RCE che colpisce Confluence Server e Data Center di Atlassian. Questa vulnerabilità ha un punteggio CVSS di 8.3, rientrando nella categoria di gravità alta. Un attaccante può sfruttare questa vulnerabilità...

textpattern-exploit-rce

Textpattern = 4.8.3 Remote Code Execution Authentifiziert Textpattern bis einschließlich Version 4.8.3 erlaubt authentifizierten Benutzern, beliebige PHP-Dateien hochzuladen. Dieses Skript automatisiert den Prozess und ermöglicht das Löschen der hochgeladenen Datei. Verwendung root@kitploit:...

ICS-MoxieManager-FileUpload-PoC

ICS-MoxieManager-RCE-CVE-2026-30-03 CVE-2026-30-03 9.8 Critico Possibile RCE Jenzabar ICS + MoxieManager proff https://www.youtube.com/watch?v=lcfUL6Xx3f4&feature=youtu.be CVE CVSS Impatto Affetto CVE-2026-30-03 9.8 Critico Possibile RCE Jenzabar ICS + MoxieManager Una vulnerabilità nel component...

CVE-2026-81485

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro Caricamento File Arbitrario Non Autenticato → RCE Proof-of-concept per CVE-2026-32475 CVSS 9.0: una vulnerabilità di caricamento file arbitrario non autenticato nel plugin WordPress Elementor Pro ≤ 4.2.1 che porta all'esecuzione remota di codice...

CVE-2026-81485

linkedin-ads-mcp (danielpopamd) version 1.0.0 is affected by a path traversal vulnerability in the Media Upload component. The root cause is the fs.readFileSync function in src/tools/campaign-management.ts, where the filePath argument is not properly validated, allowing a remote attacker to read ...

CVE-2026-81485 danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The...

EUVD-2026-66832

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The...

EUVD-2026-66801

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

CVE-2026-75339

cjbi admin3 v3.0.0 suffers from missing permission checks on the /storage/upload storage endpoint. Any logged-in user can upload arbitrary files, while any anonymous attacker can download them, enabling unauthorized file access and potential data exposure. The CVSS v3.1 score is 8.8 (High) (AV:N/...

CVE-2026-75339

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82784

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...