2561 matches found
CVE-2025-58745 WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)
WeGIA is a Web manager for charitable institutions. The fix for CVE-2025-22133 was not enough to remediate the arbitrary file upload vulnerability. The WeGIA only check MIME types for Excel files at endpoint /html/socio/sistema/controller/controlaxlsx.php, which can be bypassed by using magic byt...
PT-2025-36524
Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.11 Description: WeGIA is a Web manager for charitable institutions. An arbitrary file upload issue exists due to insufficient file type validation. The application only checks MIME types for Excel files at the...
Exploit for CVE-2025-58440
CVE-2025-58440 Remote Code Execution RCE via Polyglot File A...
Linux Distros Unpatched Vulnerability : CVE-2023-28838
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow...
Exploit for Improper Handling of Parameters in Fortinet Fortiweb
๐จ FortiWeb Authentication Bypass โ Remote Code Execution...
CVE-2024-44373
A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.0606 allows an unauthenticated attacker to create a webshell and remote code execution via the path, content parameter to /includes/savefile.php...
CVE-2024-44373
A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.0606 allows an unauthenticated attacker to create a webshell and remote code execution via the path, content parameter to /includes/savefile.php...
CVE-2024-44373
A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.0606 allows an unauthenticated attacker to create a webshell and remote code execution via the path, content parameter to /includes/savefile.php...
CVE-2024-44373
The AllSky open-source camera system (versions v2023.05.01 through v2024.12.06_06 ) is vulnerable to a Path Traversal flaw. An unauthenticated attacker can exploit the path and content parameters at the /includes/save_file.php endpoint to create a webshell and achieve remote code execution . As a...
Allsky Camera ๅฎๅ จๆผๆด
Allsky Camera is an Allsky open source camera system for photographing and monitoring the entire sky. A security vulnerability exists in Allsky Camera version v2023.05.0104, which stems from a path traversal that allows an unauthenticated attacker to create a webshell and execute remote code via...
CVE-2024-44373: Improper Limitation of a Pathname to a Restricted Directory
A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.0606 allows an unauthenticated attacker to create a webshell and remote code execution via the path, content parameter to /includes/savefile.php...
CVE-2024-44373
A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.0606 allows an unauthenticated attacker to create a webshell and remote code execution via the path, content parameter to /includes/savefile.php...
CVE-2025-24775
Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through = 2.9.0...
WordPress plugin Forms ไปฃ็ ้ฎ้ขๆผๆด
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...
CVE-2025-55010 Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event"data" field in the...
Exploit for CVE-2025-5394
๐จ CVE-2025-5394 - Unauthenticated Arbitrary Plugin Upload in A...
Exploit for Code Injection in Ispconfig
CVE-2023-46818 PoC This is a python implemntation of the PoC p...
Exploit for Deserialization of Untrusted Data in Microsoft
ToolShell โ CVEโ2025โ53770 Exploit PoC This package allows: 1...
WordPress plugin Groundhogg ไปฃ็ ้ฎ้ขๆผๆด
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...