CVE-2026-85163

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and...

Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal

CVE-2023-1112 - Drag and Drop Multiple File Uploader PRO - Contact Form 7 v5.0.6.1 Recorrido de rutas Información El Recorrido de rutas en Drag and Drop Multiple File Uploader PRO - Contact Form 7 versión 5.0.6.1 permite a un atacante remoto no autenticado subir archivos a cualquier lugar...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader = 1.3.2 - Cross-Site Scripting Almacenado No Autenticado El plugin no impide que se suban archivos HTML a través de su formulario, lo que permite a un usuario no autenticado subir un archivo HTML malicioso que contenga JavaScript, por ejemplo, que se ejecutará...

CVE-2026-38361

CVE-2026-38361: Múltiples vulnerabilidades de DoS no autenticadas en dash-uploader...

WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 notify or 2 blog parameter. id: CVE-2013-2287 info: name: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting...

dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. id: CVE-2026-38361 info: name:...

dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dashuploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges. id: CVE-2026-38360 info: name:...

ShellUpload

ShellUpload kurosava.php kurosava.php es un cargador malicioso de shell web PHP...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

CVE-2026-38360

CVE-2026-38360: Path Traversal in dash-uploader...

Onapsis_CVE-2025-31324_Scanner_Tools

Escáner de Vulnerabilidad e Indicador de Compromiso IoC para CVE-2025-31324 Vulnerabilidad de Carga de Metadatos de Visual Composer CVE-2025-31324 es una vulnerabilidad crítica CVSSv3 10 que afecta a los sistemas SAP NetWeaver, específicamente dentro del componente Visual Composer Metadata...

CVE-2025-31324

CVE-2025-31324 A proof of concept developed to exploit CVE-2025-31324. Usage root@kitploit: usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this hel...

CVE-2025-31324-File-Upload

CVE-2025-31324-File-Upload Un endpoint de carga de archivos totalmente no autenticado en Visual Composer permite a cualquiera subir archivos arbitrarios por ejemplo, un web-shell JSP al servidor. Herramienta de prueba de concepto para verificar y explotar la vulnerabilidad de carga de archivos no...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite 拡張機能 概要 このPythonベースのBurp Suite拡張機能は、SAP NetWeaver Visual ComposerのMetadata Uploaderコンポーネントにおける重大な脆弱性 CVE-2025-31324 の存在を検出するために設計されています。この脆弱性は、認可チェックの欠如により、ファイルアップロードを介した認証なしのリモートコード実行を許容します。拡張機能は、/developmentserver/metadatauploader...

lab-cve-2016-15042

CVE-2016-15042 – WordPress Frontend File Manager & N‑Media Post Front‑end Form Unauthenticated File Upload PoC Lab Fully reproducible, Dockerized lab to validate and demonstrate CVE-2016-15042: Frontend File Manager nmedia-user-file-uploader v3.7 vulnerable 4.0 N‑Media Post Front‑end Form...

CVE-2025-31324_PoC

CVE-2025-31324PoC Prueba de concepto para CVE-2025-31324: Carga no autenticada en SAP NetWeaver Visual Composer Metadata Uploader Este script realiza: 1. Carga de archivo al endpoint vulnerable a través del host/puerto de carga 2. Activación opcional mediante HTTP GET a través del host/puerto de...

SAP-CVE-2025-31324

SAP-CVE-2025-31324 POC Ein Tool zur Erkennung und Ausnutzung einer kritischen, nicht authentifizierten Datei-Upload-Schwachstelle in SAP NetWeaver Visual Composer. Beschreibung SAP NetWeaver Visual Composer enthält eine Komponente namens Metadata Uploader, der die ordnungsgemäßen...

CVE-2025-31324

CVE-2025-31324 Proof-of-Concept 0day per SAP NetWeaver creato da ShinyHunters CVE-2025-31324 è una vulnerabilità critica di "Caricamento di file senza restrizioni" che colpisce il server applicativo SAP NetWeaver AS Java. In particolare, risiede nel componente Visual Composer VCFRAMEWORK. La fall...

WordPress Image Uploader for Welcart plugin <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability

Authenticated Author+ SQL Injection via Attachment 'posttitle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Image Uploader for Welcart versions = 1.4.6...

CVE-2026-16080

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...