SAP-CVE-2025-31324

SAP-CVE-2025-31324 POC A tool to detect and exploit a critical unauthenticated file‐upload vulnerability in SAP NetWeaver Visual Composer. Description SAP NetWeaver Visual Composer includes a component called Metadata Uploader which lacks proper authorization checks, allowing unauthenticated...

CVE-2021-38163

CVE-2021-38163 CVE-2021-38163 - exploit for SAP Netveawer SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of...

CVE-2025-31324

SAP CVE-2025-31324 Analyzer A Python-based security scanner for identifying the CVE-2025-31324 vulnerability in SAP Visual Composer systems, and detecting known Indicators of Compromise IOCs such as malicious .jsp. 🚀 Features Detects vulnerable Visual Composer endpoints Scans for known malicious...

CVE-2025-31324_PoC

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

Onapsis_CVE-2025-31324_Scanner_Tools

Vulnerability and Indicator of Compromise IoC Scanner for CVE-2025-31324 Visual Composer Metadata Uploader Vulnerability CVE-2025-31324 is a critical CVSSv3 10 vulnerability affecting SAP NetWeaver systems, specifically within the Visual Composer Metadata Uploader component. This vulnerability...

CVE-2025-31324-File-Upload

CVE-2025-31324-File-Upload A totally unauthenticated file-upload endpoint in Visual Composer lets anyone drop arbitrary files e.g., a JSP web-shell onto the server. Proof-of-concept tool to check for and exploit the unauthenticated file upload vulnerability CVE-2025-31324 in SAP NetWeaver Visual...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...

CVE-2026-12227-visualcomposer-lfi-poc

CVE-2026-12227 - Visual Composer Unauthenticated LFI via vcv-template Validation Lab Security-research material for reproducing and validating CVE-2026-12227 : an unauthenticated local file inclusion in Visual Composer Website Builder's page-template resolution CVSS 3.1 9.8, plus a verified...

CVE-2026-12227

CVE-2026-12227 — Visual Composer Website Builder Unauthenticated LFI Python 3 PoC for CVE-2026-12227 Wordfence: Local File Inclusion via the vcv-template query parameter in Visual Composer Website Builder visualcomposer on wordpress.org. | ---|--- Platform| WordPress plugin Component| Visual...

CVE-2025-31324

Proof of Concept - CVE-2025-31324 [email protected] Proof of concept exploit for vulnerability CVE-2025-31324 in SAP NetWeaver Visual Composer , which allows arbitrary file upload without authentication via the /developmentserver/metadatauploader endpoint. ⚠️ This code is for educational...

CVE-2025-31324

CVE-2025-31324 A proof of concept developed to exploit CVE-2025-31324. Usage usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help message and...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...

Visual Composer <= 45.16.0 - Unauthenticated LFI

Visual Composer Website Builder for WordPress = 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication. id: CVE-2026-12227 info:...

CVE-2025-31324

🔴 CVE-2025-31324 — SAP NetWeaver Visual Composer Unauthenticated File Upload Type: Proof of Concept — Vulnerability Research CVE: CVE-2025-31324 CVSS: 10.0 Critical AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Status: Patched — SAP Security Note 3594142 + 3604119 Added to CISA KEV: May 2025 ⚠️ This PoC...

CVE-2026-114702

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8...

CVE-2026-114702 WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8...

CVE-2026-114702

The ND Shortcodes For Visual Composer WordPress plugin (versions 7.8 and below ) is vulnerable to Stored Cross-Site Scripting (XSS) . This issue stems from the improper neutralization of input during web page generation , allowing an attacker to inject malicious scripts. While the vulnerability w...

EUVD-2026-108083

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8...