https://poc.intelseclab.com/tags/arbitrary-file-upload/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-39401-wpams-arbitrary-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-39401-wpams-arbitrary-file-upload-rce/Critical severity (CVSS 10) — web · CVE-2025-39401. Status: Weaponized. Affects: WPAMS (WordPress Apartment/Property Management System) plugin by mojoomla. Tags: wordpress, wpams, mojoomla, arbitrary-file-upload, webshell, rce, unauthenticated, python, multithreaded, cwe-434.webCriticalwordpresswpamsmojoomlaarbitrary-file-uploadwebshellrceunauthenticatedpythonmultithreadedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12057-waveplayer-webshell-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12057-waveplayer-webshell-upload/Critical severity (CVSS 9.8) — web · CVE-2025-12057. Status: Weaponized. Affects: WavePlayer (WordPress plugin). Tags: wordpress, waveplayer, arbitrary-file-upload, unauthenticated, rce, webshell, ajax, nonce, php, python.webCriticalwordpresswaveplayerarbitrary-file-uploadunauthenticatedrcewebshellajaxnoncephppythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Critical severity (CVSS 9.8) — web · CVE-2025-7441. Status: PoC. Affects: StoryChief WordPress plugin. Tags: storychief, wordpress, wordpress-plugin, arbitrary-file-upload, ssrf, remote-code-execution, unauthenticated, webhook, hmac, cwe-434, python.webCriticalstorychiefwordpresswordpress-pluginarbitrary-file-uploadssrfremote-code-executionunauthenticatedwebhookhmaccwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-48148-storekeeper-woocommerce-webshell-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-48148-storekeeper-woocommerce-webshell-upload/Critical severity (CVSS 9.8) — web · CVE-2025-48148. Status: Weaponized. Affects: StoreKeeper for WooCommerce (WordPress plugin). Tags: wordpress, woocommerce, storekeeper, arbitrary-file-upload, unauthenticated, webshell, rce, cwe-434, python.webCriticalwordpresswoocommercestorekeeperarbitrary-file-uploadunauthenticatedwebshellrcecwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4632-magicinfo-path-traversal-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4632-magicinfo-path-traversal-rce/Critical severity (CVSS 9.8) — web · CVE-2025-4632. Status: Weaponized. Affects: Samsung MagicINFO 9 Server (digital signage content management server), SWUpdateFileUploader servlet. Tags: samsung, magicinfo, path-traversal, arbitrary-file-upload, unauthenticated-rce, jsp-webshell, cwe-22, cwe-434, python.webCriticalsamsungmagicinfopath-traversalarbitrary-file-uploadunauthenticated-rcejsp-webshellcwe-22cwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12674-kiotviet-sync-file-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-12674-kiotviet-sync-file-upload/Critical severity (CVSS 9.8) — web · CVE-2025-12674. Status: Weaponized. Affects: KiotViet Sync (WordPress plugin). Tags: wordpress, kiotviet-sync, arbitrary-file-upload, unauthenticated, rce, rest-api, webshell, python.webCriticalwordpresskiotviet-syncarbitrary-file-uploadunauthenticatedrcerest-apiwebshellpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49071-flozen-theme-arbitrary-file-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49071-flozen-theme-arbitrary-file-upload/Critical severity (CVSS 9.8) — web · CVE-2025-49071. Status: Weaponized. Affects: Flozen Theme for WordPress. Tags: wordpress, flozen-theme, arbitrary-file-upload, unauthenticated, webshell, zip-upload, rce, cwe-434, python.webCriticalwordpressflozen-themearbitrary-file-uploadunauthenticatedwebshellzip-uploadrcecwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1357-wpvivid-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1357-wpvivid-file-upload-rce/Critical severity — web · CVE-2026-1357. Status: Weaponized. Affects: WPvivid Backup & Migration WordPress plugin. Tags: wordpress, wpvivid, arbitrary-file-upload, rce, unauthenticated, cryptography, path-traversal.webCriticalwordpresswpvividarbitrary-file-uploadrceunauthenticatedcryptographypath-traversalhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1555-webstack-wp-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1555-webstack-wp-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-1555. Status: Weaponized. Affects: WebStack theme for WordPress. Tags: wordpress, webstack-theme, arbitrary-file-upload, unauthenticated-rce, webshell, ajax, cwe-434.webCriticalwordpresswebstack-themearbitrary-file-uploadunauthenticated-rcewebshellajaxcwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21627-joomla-nrframework-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21627-joomla-nrframework-rce/Critical severity (CVSS 9.5) — web · CVE-2026-21627. Status: Weaponized. Affects: plg_system_nrframework (Tassos/Novarain Framework) Joomla plugin, bundled with Convert Forms, Engage Box, Google Structured Data, and other Tassos.gr extensions. Tags: joomla, nrframework, file-inclusion, unauthenticated, arbitrary-file-upload, arbitrary-file-delete, php, cms.webCriticaljoomlanrframeworkfile-inclusionunauthenticatedarbitrary-file-uploadarbitrary-file-deletephpcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1657-eventprime-wp-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1657-eventprime-wp-file-upload/Medium severity — web · CVE-2026-1657. Status: PoC. Affects: EventPrime (WordPress plugin). Tags: wordpress, eventprime, arbitrary-file-upload, unauthenticated, ajax, media-library, cwe-434.webMediumwordpresseventprimearbitrary-file-uploadunauthenticatedajaxmedia-librarycwe-434