https://poc.intelseclab.com/tags/file-upload/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56291-joomla-balbooa-forms-file-upload-rce/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-56291-joomla-balbooa-forms-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-56291. Status: Weaponized. Affects: Balbooa Forms (com_baforms) — third-party Joomla! extension by balbooa.com. Tags: joomla, balbooa-forms, file-upload, webshell, unauthenticated, rce, kev, actively-exploited, cwe-434.webCriticaljoomlabalbooa-formsfile-uploadwebshellunauthenticatedrcekevactively-exploitedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-48939-icagenda-joomla-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2026-48939. Status: Weaponized (public PoC available, actively exploited in the wild, in CISA KEV since 2026-07-10). Affects: iCagenda — events/calendar extension (component) for Joomla. Tags: joomla, icagenda, file-upload, rce, cwe-434, unauthenticated, remote, kev, cms, php, access-control-bypass.webCriticaljoomlaicagendafile-uploadrcecwe-434unauthenticatedremotekevcmsphpaccess-control-bypasshttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-6440-woocommerce-dynamic-pricing-file-upload-rce/Critical severity (CVSS 9.8) — web · CVE-2025-6440. Status: Weaponized. Affects: WordPress WooCommerce Dynamic Pricing & Discounts plugin (wc-designer-pro). Tags: wordpress, woocommerce, wc-designer-pro, dynamic-pricing, file-upload, rce, unauthenticated, wp-ajax, cwe-434, nuclei.webCriticalwordpresswoocommercewc-designer-prodynamic-pricingfile-uploadrceunauthenticatedwp-ajaxcwe-434nucleihttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-27515-laravel-polyglot-upload-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-27515-laravel-polyglot-upload-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-27515. Status: Weaponized. Affects: Laravel Framework (file upload validation using files.* wildcard rules). Tags: laravel, php, file-upload, validation-bypass, polyglot, jpeg, wildcard-validation, cwe-20, rce, web-shell.webCriticallaravelphpfile-uploadvalidation-bypasspolyglotjpegwildcard-validationcwe-20rceweb-shellhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54236-magento-sessionreaper-lfi/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54236-magento-sessionreaper-lfi/Critical severity (CVSS 9.1) — web · CVE-2025-54236. Status: PoC. Affects: Adobe Commerce / Magento Open Source — customer/address_file/upload endpoint (dubbed "SessionReaper"). Tags: magento, adobe-commerce, sessionreaper, file-upload, lfi, customer-address, form-key, cwe-434, python.webCriticalmagentoadobe-commercesessionreaperfile-uploadlficustomer-addressform-keycwe-434pythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0740-ninja-forms-file-upload/High severity — web · CVE-2026-0740. Status: PoC. Affects: WordPress "Ninja Forms" plugin — file upload field/module. Tags: wordpress, ninja-forms, file-upload, webshell, admin-ajax, plugin-vulnerability, cwe-434.webHighwordpressninja-formsfile-uploadwebshelladmin-ajaxplugin-vulnerabilitycwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3844-wordpress-breeze-cache-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3844-wordpress-breeze-cache-file-upload/Critical severity — web · CVE-2026-3844. Status: PoC. Affects: Breeze Cache plugin for WordPress. Tags: wordpress, wordpress-plugin, unauthenticated, file-upload, rce, gravatar-cache, breeze-cache.webCriticalwordpresswordpress-pluginunauthenticatedfile-uploadrcegravatar-cachebreeze-cachehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5364-cf7-dnd-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5364-cf7-dnd-upload-rce/High severity (CVSS 8.1) — web · CVE-2026-5364. Status: PoC. Affects: WordPress plugin "Drag and Drop File Upload for Contact Form 7" (drag-and-drop-file-upload-for-contact-form-7). Tags: wordpress, contact-form-7, file-upload, webshell, rce, sanitize-file-name-bypass, admin-ajax, cwe-434.webHighwordpresscontact-form-7file-uploadwebshellrcesanitize-file-name-bypassadmin-ajaxcwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27542-woocommerce-wwlc-privesc-fileupload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27542-woocommerce-wwlc-privesc-fileupload/Critical severity (CVSS 9.8) — web · CVE-2026-27542 (bundled with CVE-2026-27540). Status: Weaponized. Affects: WooCommerce Wholesale Lead Capture (WWLC) plugin for WordPress. Tags: wordpress, woocommerce, plugin, privilege-escalation, file-upload, rce, unauthenticated, mass-scanning.webCriticalwordpresswoocommercepluginprivilege-escalationfile-uploadrceunauthenticatedmass-scanninghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5615-vvvebjs-svg-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5615-vvvebjs-svg-stored-xss/High severity (CVSS 8.5) — web · CVE-2026-5615. Status: PoC. Affects: VvvebJs (drag-and-drop website builder). Tags: vvvebjs, stored-xss, svg-upload, file-upload, cms.webHighvvvebjsstored-xsssvg-uploadfile-uploadcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4882-user-registration-advanced-fields-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4882-user-registration-advanced-fields-file-upload/Critical severity (CVSS 9.8) — web · CVE-2026-4882. Status: PoC. Affects: User Registration Advanced Fields plugin for WordPress. Tags: wordpress, wordpress-plugin, file-upload, webshell, unauthenticated, rce, nonce-leak.webCriticalwordpresswordpress-pluginfile-uploadwebshellunauthenticatedrcenonce-leakhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27621-typicms-svg-xss/Medium severity — web · CVE-2026-27621 (GHSA-xfvg-8v67-j7wp). Status: PoC. Affects: TypiCMS Core (typicms/core). Tags: typicms, stored-xss, svg-upload, cwe-79, cms, file-upload, laravel, session-hijack.webMediumtypicmsstored-xsssvg-uploadcwe-79cmsfile-uploadlaravelsession-hijackhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40487-postiz-svg-upload-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40487-postiz-svg-upload-xss/High severity (CVSS 8.9) — web · CVE-2026-40487 / GHSA-44wg-r34q-hvfx. Status: PoC. Affects: Postiz (open-source social media management platform, gitroomhq/postiz-app). Tags: file-upload, mime-spoofing, stored-xss, account-takeover, postiz, nodejs, oauth-backdoor.webHighfile-uploadmime-spoofingstored-xssaccount-takeoverpostiznodejsoauth-backdoorhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4885-piotnet-elementor-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4885-piotnet-elementor-file-upload/Critical severity — web · CVE-2026-4885. Status: PoC. Affects: Piotnet Addons for Elementor Pro (WordPress plugin). Tags: wordpress, wordpress-plugin, elementor, piotnet, file-upload, webshell, unauthenticated, rce, mass-exploit.webCriticalwordpresswordpress-pluginelementorpiotnetfile-uploadwebshellunauthenticatedrcemass-exploithttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3304-multer-orphaned-file-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3304-multer-orphaned-file-dos/High severity (CVSS 8.7) — web · CVE-2026-3304. Status: PoC. Affects: Multer (Node.js multipart/form-data middleware for Express). Tags: multer, nodejs, express, dos, file-upload, orphaned-file, disk-exhaustion, multipart.webHighmulternodejsexpressdosfile-uploadorphaned-filedisk-exhaustionmultiparthttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1306-wp-midi-synth-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1306-wp-midi-synth-file-upload/Critical severity (CVSS 9.8) — web · CVE-2026-1306. Status: Weaponized. Affects: midi-Synth WordPress plugin. Tags: wordpress, wp-plugin, file-upload, cwe-434, webshell, ajax, mass-scanning.webCriticalwordpresswp-pluginfile-uploadcwe-434webshellajaxmass-scanninghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-56290-joomla-pagebuilderck-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-56290-joomla-pagebuilderck-rce/Critical severity (CVSS 9.8) — web · CVE-2026-56290. Status: PoC. Affects: Page Builder CK (com_pagebuilderck) — Joomla extension. Tags: joomla, page-builder-ck, com_pagebuilderck, file-upload, unauth-rce, csrf, cms.webCriticaljoomlapage-builder-ckcom_pagebuilderckfile-uploadunauth-rcecsrfcmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0911-hustle-wordpress-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0911-hustle-wordpress-upload/High severity — web · CVE-2026-0911. Status: PoC. Affects: Hustle (wordpress-popup) plugin by WPMU DEV. Tags: wordpress, hustle, plugin, file-upload, rce, wp_handle_upload, orphan-file, authenticated, cwe-434.webHighwordpresshustlepluginfile-uploadrcewp_handle_uploadorphan-fileauthenticatedcwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54337-fireshare-file-overwrite/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54337-fireshare-file-overwrite/Info severity — web · CVE-2026-54337 (see [GHSA-hmh2-6g84-q8jx](https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-hmh2-6g84-q8jx)). Status: PoC. Affects: Fireshare (self-hosted video sharing app), <= 1.16.3. Tags: fireshare, unauthenticated, arbitrary-file-write, argument-injection, ffmpeg, file-upload, cwe-73, docker.webInfofireshareunauthenticatedarbitrary-file-writeargument-injectionffmpegfile-uploadcwe-73dockerhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33534-espocrm-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33534-espocrm-ssrf/Medium severity — web · CVE-2026-33534. Status: PoC. Affects: EspoCRM 9.3.3. Tags: espocrm, ssrf, cwe-918, ipv4-obfuscation, authenticated, crm, file-upload, python.webMediumespocrmssrfcwe-918ipv4-obfuscationauthenticatedcrmfile-uploadpythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33033-django-multipartparser-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33033-django-multipartparser-dos/Medium severity — web · CVE-2026-33033. Status: PoC. Affects: Django (django.http.multipartparser.MultiPartParser). Tags: django, dos, multipart, base64, cpu-amplification, python, file-upload.webMediumdjangodosmultipartbase64cpu-amplificationpythonfile-uploadhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29041-chamilo-lms-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29041-chamilo-lms-file-upload-rce/High severity (CVSS 8.8) — web · CVE-2026-29041. Status: Weaponized. Affects: Chamilo LMS. Tags: chamilo, lms, file-upload, rce, webshell, cwe-434, mime-bypass, authenticated.webHighchamilolmsfile-uploadrcewebshellcwe-434mime-bypassauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6960-bookingpress-unauth-file-upload/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6960-bookingpress-unauth-file-upload/Critical severity (CVSS 9.8) — web · CVE-2026-6960. Status: Weaponized. Affects: BookingPress Pro (WordPress appointment-booking plugin). Tags: wordpress, bookingpress, unauthenticated, file-upload, rce, data-uri, cwe-434.webCriticalwordpressbookingpressunauthenticatedfile-uploadrcedata-uricwe-434https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39387-boidcms-file-upload-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39387-boidcms-file-upload-rce/High severity — web · CVE-2026-39387. Status: Weaponized. Affects: BoidCMS. Tags: boidcms, php, authenticated, file-upload, path-traversal, template-injection, rce.webHighboidcmsphpauthenticatedfile-uploadpath-traversaltemplate-injectionrcehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25099-bludit-webshell-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25099-bludit-webshell-rce/High severity — web · CVE-2026-25099. Status: Weaponized. Affects: Bludit CMS (/api/files/<page-key> endpoint). Tags: bludit, cms, file-upload, webshell, rce, php, api-token, cwe-434, authenticated.webHighbluditcmsfile-uploadwebshellrcephpapi-tokencwe-434authenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21440-adonisjs-bodyparser-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21440-adonisjs-bodyparser-path-traversal/Critical severity (CVSS 9.2) — web · CVE-2026-21440 (GHSA-gvq6-hvvp-h34h). Status: Weaponized. Affects: @adonisjs/bodyparser (AdonisJS multipart file-upload handling). Tags: adonisjs, nodejs, path-traversal, arbitrary-file-write, cwe-22, file-upload, rce, bodyparser.webCriticaladonisjsnodejspath-traversalarbitrary-file-writecwe-22file-uploadrcebodyparserhttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-48907-joomla-jce-unauth-rce/Critical severity (CVSS 10) — web · CVE-2026-48907. Status: Weaponized. Affects: Joomla Content Editor (JCE) extension by Widget Factory. Tags: RCE, unauthenticated, Joomla, JCE, CMS, access-control, webshell, php-webshell, file-upload, CISA-KEV, active-exploitation.webCriticalRCEunauthenticatedJoomlaJCECMSaccess-controlwebshellphp-webshellfile-uploadCISA-KEVactive-exploitationhttps://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-30_cve-2026-48908-sp-page-builder-joomla-rce/Critical severity (CVSS 10) — web · CVE-2026-48908 (GHSA-8fwr-8fxr-8v2p). Status: Weaponized — public PoC with mass-scan support, added to CISA KEV 2026-07-07, confirmed active in-the-wild exploitation. Affects: SP Page Builder extension for Joomla (joomshaper.net). Tags: RCE, unauthenticated, file-upload, PHP-webshell, Joomla, CMS, access-control, Python, CVSS-10, kev, backdoor, cwe-434.webCriticalRCEunauthenticatedfile-uploadPHP-webshellJoomlaCMSaccess-controlPythonCVSS-10kevbackdoorcwe-434https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-20245-cisco-sdwan-priv-esc/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-20245-cisco-sdwan-priv-esc/High severity (CVSS 7.8) — network · CVE-2026-20245. Status: PoC. Affects: Cisco Catalyst SD-WAN Manager (vManage), SD-WAN Controller (vSmart), SD-WAN Validator (vBond). Tags: privilege-escalation, Cisco, SD-WAN, vManage, file-upload, command-injection, root, CISA-KEV, no-patch, Mandiant, nation-state.networkHighprivilege-escalationCiscoSD-WANvManagefile-uploadcommand-injectionrootCISA-KEVno-patchMandiantnation-state