CVE-2024-50379

CVE-2024-50379 Proof of Concept PoC This repository contains a proof of concept PoC script to exploit CVE-2024-50379 , a vulnerability in Apache Tomcat. The vulnerability is a Time-of-Check Time-of-Use TOCTOU race condition that can lead to remote code execution RCE if the server's configuration...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...

CVE-2021-42669

CVE-2021-42669 CVE-2021-42669 - Remote code execution via unrestricted file upload vulnerability in the Engineers online portal system. Technical description: A unrestricted file upload vulnerability exists in the Engineers Online Portal system. An attacker can leverage this vulnerability in orde...

spip-cve-2023-27372-rce

SPIP CVE-2023-27372 Unauthenticated RCE Exploit Web Shell Upload This Python script exploits CVE-2023-27372, an unauthenticated remote code execution vulnerability in SPIP CMS versions prior to 4.2.1. It leverages a cache poisoning flaw in the password reset mechanism to upload a web shell and...

CVE-2024-53677

CVE-2024-53677: Apache Struts path traversal to RCE vulnerability A critical security vulnerability, identified as CVE-2024-53677 was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution...

CVE-2026-66492

Path Traversal en el destino de carga de archivos PhocaCommander ≤ 6.1.3 — Administrador autenticado escribe archivos fuera de la raíz web RESUMEN El controlador de carga de archivos en PhocaCommander construye la ruta de destino a partir de un parámetro folder codificado en base64 y controlado p...

CVE-2026-Pending-Flask-Uploads-Path-Traversal-PoC

CVE-2026-XXXXX Pendiente: Path Traversal en Flask-Uploads Información de la vulnerabilidad Producto : Flask-Uploads Versión : 0.2.1 y potencialmente versiones anteriores Tipo de vulnerabilidad : Path Traversal Directory Traversal CWE-ID : CWE-22 Severidad : ALTA CVSS 7.5 Impacto : Escritura...

CVE-2026-Pending-Django-Summernote-RCE

CVE-2026-XXXXX Pendiente: django-summernote Carga Arbitraria de Archivos RCE Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad de Ejecución Remota de Código RCE Condicional descubierta en django-summernote versión 0.8.20.0 y anteriores. Detalles de la Vulnerabilidad...

XSS2Shell-CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/scanning utility for authorized WordPress security testing. The project contains a single-target exploitation workflow and a concurrent multi-target scan-only mode. Important: Use this project only on WordPress installations that you own or...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Upload Arbitrário de Arquivo Não Autenticado → RCE PoC para CVE-2026-1357 CVSS 9.8 Crítico, CWE-434: um upload arbitrário de arquivo não autenticado no plugin WPvivid Backup & Migration para WordPress que leva à execução remota de código...

CVE-2026-41651

CVE-2026-41651 In breve: Carica sul target, poi esegui python3 exploit.py...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Unrestricted File Upload → RCE Critica vulnerabilità di Unrestricted File Upload in Elementor Pro Potenzialmente in grado di portare a Remote Code Execution RCE ⚠️ Panoramica CVE-2026-32475 è una vulnerabilità critica che interessa Elementor Pro , un plugin...

CVE-2025-70559

cambia la directory di upload nello script python python3 exploit.py LHOST LPORT...

CVE-2025-32140

🚨 CVE-2025-32140 – WP Remote Thumbnail Exploit Arbitrary File Upload 📝 Beschreibung CVE-2025-32140 ist eine kritische Sicherheitslücke im WP Remote Thumbnail -Plugin für WordPress. Sie ermöglicht es authentifizierten Angreifern mit Beitragsersteller- oder höheren Berechtigungen, beliebige Dateien...

CVE-2026-82472

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

CVE-2024-48591

CVE-2024-48591 Divulgazione della vulnerabilità: XSS in Inflectra SpiraTeam 7.2.00 Descrizione Inflectra SpiraTeam versione 7.2.00 è vulnerabile a Cross-Site Scripting XSS attraverso il caricamento di file SVG appositamente creati, che possono eseguire JavaScript quando visualizzati direttamente...

CVE-2026-5718-Lab

CVE-2026-5718 Laboratório Docker Local Laboratório Docker local apenas local que compara a versão vulnerável e a corrigida para CVE-2026-5718 , que afeta o plugin WordPress Drag and Drop Multiple File Upload for Contact Form 7. Este laboratório demonstra a diferença entre a versão vulnerável...

CVE-2024-56264

CVE-2024-56264 Exploit per WordPress ACF City Selector - Caricamento Arbitrario di File CVE-2024-56264 Panoramica Questa repository contiene un exploit per CVE-2024-56264 , una vulnerabilità di Caricamento Arbitrario di File presente nel plugin WordPress ACF City Selector versioni = 1.14.0. Quest...

cve-2023-4220-poc

CVE-2023-4220 Chamilio exploit PoC Senza vergogna copiato da Direttamente ispirato da: https://starlabs.sg/advisories/23/23-4220/ Utilizzo: root@kitploit: Chamilio CVE-2023-4220 POC Exploit positional arguments: url The Chamilio Url. e.g. http://example.com options: -h, --help show this help...

CVE-2026-82472 Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...