https://poc.intelseclab.com/tags/cwe-434/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56291-joomla-balbooa-forms-file-upload-rce/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56291-joomla-balbooa-forms-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-56291. Status: Weaponized. Affects: Balbooa Forms (com_baforms) — third-party Joomla! extension by balbooa.com. Tags: joomla, balbooa-forms, file-upload, webshell, unauthenticated, rce, kev, actively-exploited, cwe-434.webCriticaljoomlabalbooa-formsfile-uploadwebshellunauthenticatedrcekevactively-exploitedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-48939. Status: Weaponized (public PoC available, actively exploited in the wild, in CISA KEV since 2026-07-10). Affects: iCagenda — events/calendar extension (component) for Joomla. Tags: joomla, icagenda, file-upload, rce, cwe-434, unauthenticated, remote, kev, cms, php, access-control-bypass.webCriticaljoomlaicagendafile-uploadrcecwe-434unauthenticatedremotekevcmsphpaccess-control-bypasshttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11170-cpi-plugin-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11170-cpi-plugin-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-11170. Status: Weaponized. Affects: WP移行専用プラグイン for CPI (cpi-wp-migration, a CPI/site-migration import plugin for WordPress). Tags: wordpress, cpi-wp-migration, unauthenticated-file-upload, rce, admin-ajax, cwe-434, python.webCriticalwordpresscpi-wp-migrationunauthenticated-file-uploadrceadmin-ajaxcwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-39401-wpams-arbitrary-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-39401-wpams-arbitrary-file-upload-rce/Critical severity (CVSS 10) — web · CVE-2025-39401. Status: Weaponized. Affects: WPAMS (WordPress Apartment/Property Management System) plugin by mojoomla. Tags: wordpress, wpams, mojoomla, arbitrary-file-upload, webshell, rce, unauthenticated, python, multithreaded, cwe-434.webCriticalwordpresswpamsmojoomlaarbitrary-file-uploadwebshellrceunauthenticatedpythonmultithreadedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-6440. Status: Weaponized. Affects: WordPress WooCommerce Dynamic Pricing & Discounts plugin (wc-designer-pro). Tags: wordpress, woocommerce, wc-designer-pro, dynamic-pricing, file-upload, rce, unauthenticated, wp-ajax, cwe-434, nuclei.webCriticalwordpresswoocommercewc-designer-prodynamic-pricingfile-uploadrceunauthenticatedwp-ajaxcwe-434nucleihttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-29009-woocommerce-medical-prescription-file-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-29009-woocommerce-medical-prescription-file-upload/Critical severity (CVSS 10) — web · CVE-2025-29009. Status: Weaponized. Affects: Webkul "Medical Prescription Attachment Plugin for WooCommerce" (WordPress plugin). Tags: wordpress, woocommerce, medical-prescription-attachment, unrestricted-file-upload, webshell, cwe-434, unauthenticated, python.webCriticalwordpresswoocommercemedical-prescription-attachmentunrestricted-file-uploadwebshellcwe-434unauthenticatedpythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-7441-storychief-webhook-rce/Critical severity (CVSS 9.8) — web · CVE-2025-7441. Status: PoC. Affects: StoryChief WordPress plugin. Tags: storychief, wordpress, wordpress-plugin, arbitrary-file-upload, ssrf, remote-code-execution, unauthenticated, webhook, hmac, cwe-434, python.webCriticalstorychiefwordpresswordpress-pluginarbitrary-file-uploadssrfremote-code-executionunauthenticatedwebhookhmaccwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-48148-storekeeper-woocommerce-webshell-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-48148-storekeeper-woocommerce-webshell-upload/Critical severity (CVSS 9.8) — web · CVE-2025-48148. Status: Weaponized. Affects: StoreKeeper for WooCommerce (WordPress plugin). Tags: wordpress, woocommerce, storekeeper, arbitrary-file-upload, unauthenticated, webshell, rce, cwe-434, python.webCriticalwordpresswoocommercestorekeeperarbitrary-file-uploadunauthenticatedwebshellrcecwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-31324-sap-netweaver-visual-composer-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-31324-sap-netweaver-visual-composer-rce/Critical severity (CVSS 10) — web · CVE-2025-31324. Status: Weaponized. Affects: SAP NetWeaver Application Server (AS) Java — Visual Composer component (VCFRAMEWORK), specifically the Metadata Uploader servlet. Tags: sap-netweaver, visual-composer, metadatauploader, unrestricted-file-upload, java-deserialization, jsp-webshell, rce, cwe-434, cwe-502, python.webCriticalsap-netweavervisual-composermetadatauploaderunrestricted-file-uploadjava-deserializationjsp-webshellrcecwe-434cwe-502pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4632-magicinfo-path-traversal-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-4632-magicinfo-path-traversal-rce/Critical severity (CVSS 9.8) — web · CVE-2025-4632. Status: Weaponized. Affects: Samsung MagicINFO 9 Server (digital signage content management server), SWUpdateFileUploader servlet. Tags: samsung, magicinfo, path-traversal, arbitrary-file-upload, unauthenticated-rce, jsp-webshell, cwe-22, cwe-434, python.webCriticalsamsungmagicinfopath-traversalarbitrary-file-uploadunauthenticated-rcejsp-webshellcwe-22cwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-10147-podlove-podcast-publisher-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-10147-podlove-podcast-publisher-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-10147. Status: Weaponized. Affects: Podlove Podcast Publisher (WordPress plugin). Tags: wordpress, podlove, podcast-publisher, unauthenticated-file-upload, rce, cwe-434, python.webCriticalwordpresspodlovepodcast-publisherunauthenticated-file-uploadrcecwe-434pythonhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-34299-monsta-ftp-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-34299-monsta-ftp-rce/Critical severity (CVSS 9.8) — network · CVE-2025-34299. Status: Weaponized. Affects: Monsta FTP (web-based FTP manager). Tags: monsta-ftp, rce, pre-auth, unrestricted-file-upload, cwe-434, php, ftp, docker, nuclei, kev.networkCriticalmonsta-ftprcepre-authunrestricted-file-uploadcwe-434phpftpdockernucleikevhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49071-flozen-theme-arbitrary-file-upload/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49071-flozen-theme-arbitrary-file-upload/Critical severity (CVSS 9.8) — web · CVE-2025-49071. Status: Weaponized. Affects: Flozen Theme for WordPress. Tags: wordpress, flozen-theme, arbitrary-file-upload, unauthenticated, webshell, zip-upload, rce, cwe-434, python.webCriticalwordpressflozen-themearbitrary-file-uploadunauthenticatedwebshellzip-uploadrcecwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13595-cibeles-ai-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13595-cibeles-ai-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13595. Status: Weaponized. Affects: Cibeles AI (WordPress plugin). Tags: wordpress, cibeles-ai, unauthenticated-file-upload, github-mirror-abuse, webshell, python, cwe-434, cwe-306.webCriticalwordpresscibeles-aiunauthenticated-file-uploadgithub-mirror-abusewebshellpythoncwe-434cwe-306https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13597-ai-feeds-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-13597-ai-feeds-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-13597. Status: Weaponized. Affects: AI Feeds (WordPress plugin). Tags: wordpress, ai-feeds, unauthenticated-file-upload, github-mirror-abuse, webshell, python, cwe-434, cwe-306.webCriticalwordpressai-feedsunauthenticated-file-uploadgithub-mirror-abusewebshellpythoncwe-434cwe-306https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54236-magento-sessionreaper-lfi/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54236-magento-sessionreaper-lfi/Critical severity (CVSS 9.1) — web · CVE-2025-54236. Status: PoC. Affects: Adobe Commerce / Magento Open Source — customer/address_file/upload endpoint (dubbed "SessionReaper"). Tags: magento, adobe-commerce, sessionreaper, file-upload, lfi, customer-address, form-key, cwe-434, python.webCriticalmagentoadobe-commercesessionreaperfile-uploadlficustomer-addressform-keycwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/High severity — web · CVE-2026-0740. Status: PoC. Affects: WordPress "Ninja Forms" plugin — file upload field/module. Tags: wordpress, ninja-forms, file-upload, webshell, admin-ajax, plugin-vulnerability, cwe-434.webHighwordpressninja-formsfile-uploadwebshelladmin-ajaxplugin-vulnerabilitycwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5364-cf7-dnd-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5364-cf7-dnd-upload-rce/High severity (CVSS 8.1) — web · CVE-2026-5364. Status: PoC. Affects: WordPress plugin "Drag and Drop File Upload for Contact Form 7" (drag-and-drop-file-upload-for-contact-form-7). Tags: wordpress, contact-form-7, file-upload, webshell, rce, sanitize-file-name-bypass, admin-ajax, cwe-434.webHighwordpresscontact-form-7file-uploadwebshellrcesanitize-file-name-bypassadmin-ajaxcwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1555-webstack-wp-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1555-webstack-wp-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-1555. Status: Weaponized. Affects: WebStack theme for WordPress. Tags: wordpress, webstack-theme, arbitrary-file-upload, unauthenticated-rce, webshell, ajax, cwe-434.webCriticalwordpresswebstack-themearbitrary-file-uploadunauthenticated-rcewebshellajaxcwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37748-visitor-management-system-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37748-visitor-management-system-file-upload-rce/High severity (CVSS 7.2) — web · CVE-2026-37748. Status: PoC. Affects: Visitor Management System (sanjay1313) 1.0. Tags: php, unrestricted-file-upload, rce, webshell, admin-authenticated, cwe-434.webHighphpunrestricted-file-uploadrcewebshelladmin-authenticatedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37068-veno-file-manager-arbitrary-file-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37068-veno-file-manager-arbitrary-file-write/Critical severity — web · CVE-2026-37068. Status: Weaponized. Affects: Veno File Manager Project. Tags: veno-file-manager, arbitrary-file-write, rce, authenticated, superadmin, cwe-434.webCriticalveno-file-managerarbitrary-file-writerceauthenticatedsuperadmincwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9067-schema-structured-data-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-9067-schema-structured-data-file-upload/High severity (CVSS 8.1) — web · CVE-2026-9067. Status: PoC. Affects: Schema & Structured Data for WP & AMP (WordPress plugin, schema-and-structured-data-for-wp). Tags: wordpress, unrestricted-file-upload, cwe-434, ajax, unauthenticated, content-hosting.webHighwordpressunrestricted-file-uploadcwe-434ajaxunauthenticatedcontent-hostinghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1306-wp-midi-synth-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1306-wp-midi-synth-file-upload/Critical severity (CVSS 9.8) — web · CVE-2026-1306. Status: Weaponized. Affects: midi-Synth WordPress plugin. Tags: wordpress, wp-plugin, file-upload, cwe-434, webshell, ajax, mass-scanning.webCriticalwordpresswp-pluginfile-uploadcwe-434webshellajaxmass-scanninghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0911-hustle-wordpress-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0911-hustle-wordpress-upload/High severity — web · CVE-2026-0911. Status: PoC. Affects: Hustle (wordpress-popup) plugin by WPMU DEV. Tags: wordpress, hustle, plugin, file-upload, rce, wp_handle_upload, orphan-file, authenticated, cwe-434.webHighwordpresshustlepluginfile-uploadrcewp_handle_uploadorphan-fileauthenticatedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1657-eventprime-wp-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1657-eventprime-wp-file-upload/Medium severity — web · CVE-2026-1657. Status: PoC. Affects: EventPrime (WordPress plugin). Tags: wordpress, eventprime, arbitrary-file-upload, unauthenticated, ajax, media-library, cwe-434.webMediumwordpresseventprimearbitrary-file-uploadunauthenticatedajaxmedia-librarycwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29041-chamilo-lms-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29041-chamilo-lms-file-upload-rce/High severity (CVSS 8.8) — web · CVE-2026-29041. Status: Weaponized. Affects: Chamilo LMS. Tags: chamilo, lms, file-upload, rce, webshell, cwe-434, mime-bypass, authenticated.webHighchamilolmsfile-uploadrcewebshellcwe-434mime-bypassauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6960-bookingpress-unauth-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6960-bookingpress-unauth-file-upload/Critical severity (CVSS 9.8) — web · CVE-2026-6960. Status: Weaponized. Affects: BookingPress Pro (WordPress appointment-booking plugin). Tags: wordpress, bookingpress, unauthenticated, file-upload, rce, data-uri, cwe-434.webCriticalwordpressbookingpressunauthenticatedfile-uploadrcedata-uricwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25099-bludit-webshell-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25099-bludit-webshell-rce/High severity — web · CVE-2026-25099. Status: Weaponized. Affects: Bludit CMS (/api/files/<page-key> endpoint). Tags: bludit, cms, file-upload, webshell, rce, php, api-token, cwe-434, authenticated.webHighbluditcmsfile-uploadwebshellrcephpapi-tokencwe-434authenticatedhttps://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Critical severity (CVSS 10) — web · CVE-2026-48908 (GHSA-8fwr-8fxr-8v2p). Status: Weaponized — public PoC with mass-scan support, added to CISA KEV 2026-07-07, confirmed active in-the-wild exploitation. Affects: SP Page Builder extension for Joomla (joomshaper.net). Tags: RCE, unauthenticated, file-upload, PHP-webshell, Joomla, CMS, access-control, Python, CVSS-10, kev, backdoor, cwe-434.webCriticalRCEunauthenticatedfile-uploadPHP-webshellJoomlaCMSaccess-controlPythonCVSS-10kevbackdoorcwe-434