tag
Webshell
Citrix NetScaler ADC/Gateway -- Pre-Auth SAML PrefixList Heap Overflow to RCE (CVE-2026-8452)
CVE-2026-8452 is a pre-authentication heap buffer overflow in the Citrix NetScaler ADC and Gateway SAML authentication handler. The vulnerability exists in the XML Signature Canonicalization (C14N) processing of the PrefixList attribute within SAML responses.…
Joomla Balbooa Forms Unauthenticated Arbitrary File Upload → RCE (CVE-2026-56291)
Balbooa Forms is a popular drag-and-drop form builder extension for Joomla!. Its form.uploadAttachmentFile task — reachable via the unauthenticated combaforms component entry point — accepts multipart file uploads for form attachments but performs neither a…
Adobe ColdFusion RDS Path Traversal → Arbitrary File Read/Write → RCE (CVE-2026-48282)
Adobe ColdFusion's Remote Development Service (RDS), a legacy feature that lets IDEs like Dreamweaver remotely browse, read, and write files on a ColdFusion server, is reachable via the /CFIDE/main/ide.cfm endpoint using a simple length-prefixed text…
WordPress WPAMS Plugin Arbitrary File Upload to RCE (CVE-2025-39401)
The WPAMS WordPress plugin (<= 44.0) contains an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434): its public "apartment management member registration" form accepts an avatar/upload field (amgtuseravatar) without validating the file's…
Webkul Medical Prescription Attachment for WooCommerce — Unrestricted File Upload to Web Shell (CVE-2025-29009)
The Webkul Medical Prescription Attachment plugin for WooCommerce exposes an AJAX action, wkwcpahandleprescriptionsession, that lets storefront visitors upload a "prescription" file attachment without validating the uploaded file's extension or MIME type on…
WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057)
WavePlayer, a WordPress audio player plugin, exposes an AJAX action (wvpl-ajax=createlocalcopy) that lets an unauthenticated visitor instruct the server to fetch a remote URL and save it as a local "track" file inside the uploads directory, without validating…
ThinkPHP 5.0.24 File Inclusion Leading to Remote Code Execution (CVE-2025-63888)
ThinkPHP 5.0.24's read() method in thinkphp/library/think/template/driver/File.php fails to validate the template path derived from user-controlled input passed to the framework's view() function. By submitting a crafted template parameter (e.g. a…
StoreKeeper for WooCommerce Unauthenticated Arbitrary File Upload (CVE-2025-48148)
The StoreKeeper for WooCommerce plugin exposes an admin-ajax.php action (uploadproductimage) that fails to validate the type/extension of uploaded files, in all versions up to and including 14.4.4. An unauthenticated attacker can extract a public AJAX nonce…
KiotViet Sync Unauthenticated Arbitrary File Upload (CVE-2025-12674)
KiotViet Sync is a WordPress plugin that synchronizes products between the KiotViet retail/POS platform and a WooCommerce store via a custom REST route. Its createmedia() function, invoked when syncing a product's image, accepts a remote rawimageid URL and…
Flozen WordPress Theme Unauthenticated Arbitrary File Upload (CVE-2025-49071)
The Flozen Theme for WordPress (versions up to and including 1.5.1) registers a wphandleupload-routed AJAX action (backed by the theme's flozenaddnewcustomfont() function) that accepts a ZIP file upload without checking authentication or validating its…
Cibeles AI `actualizador_git.php` Unauthenticated Arbitrary File Upload / RCE (CVE-2025-13595)
The Cibeles AI plugin ships a debug/update helper, actualizadorgit.php, directly inside its plugin directory. The file is missing the standard WordPress ABSPATH guard, so it is reachable over plain HTTP without any authentication, and it implements a "GitHub…
AI Feeds `actualizador_git.php` Unauthenticated Arbitrary File Upload / RCE (CVE-2025-13597)
AI Feeds ships the same vulnerable actualizadorgit.php "GitHub mirror updater" helper found in the vendor's other plugin, Cibeles AI (CVE-2025-13595) — it is directly reachable over HTTP (no ABSPATH guard, no authentication) and blindly downloads and mirrors…
WordPress Ninja Forms Plugin Unauthenticated File Upload — CVE-2026-0740
Ninja Forms exposes a file-upload field feature reachable via WordPress's admin-ajax.php endpoint. The PoC script first requests a fresh nonce through the nffugetnewnonce action, then uses that nonce to submit a file via the nffuupload action. Because the…
WordPress "Drag and Drop File Upload for Contact Form 7" Unauthenticated RCE — CVE-2026-5364
The plugin determines an uploaded file's extension via pathinfo() on the raw, attacker-supplied filename before that filename is passed through WordPress's sanitizefilename(). By uploading a file named e.g. shell.php$, pathinfo() reports the extension as php$…
WebStack WordPress Theme Unauthenticated Arbitrary File Upload RCE — CVE-2026-1555
The WebStack WordPress theme registers an imgupload AJAX action via wpajaxnopriv, exposing it to unauthenticated visitors, and the handler function ioimgupload() performs no file type or extension validation before saving the uploaded file into a publicly…
Visitor Management System 1.0 — Unrestricted File Upload to RCE (CVE-2026-37748)
Visitor Management System 1.0 calls moveuploadedfile() in vms/php/adminuserinsert.php and vms/php/update1.php without validating the uploaded file's MIME type, extension, or content. An authenticated admin user can upload a PHP webshell disguised as a profile…
User Registration Advanced Fields WordPress Plugin Unauthenticated Arbitrary File Upload (CVE-2026-4882)
The User Registration Advanced Fields plugin (<= 1.6.20) leaks a valid AJAX nonce via wplocalizescript() on any page containing a registration form. Its urafprofilepictureuploadmethodupload AJAX action normally validates uploaded file extensions, but passing…
Piotnet Addons for Elementor Pro Unauthenticated Arbitrary File Upload RCE (CVE-2026-4885)
Piotnet Addons for Elementor Pro (<= 7.1.70) exposes a form-builder file-upload AJAX action (pafeajaxformbuilder) that insufficiently validates uploaded file extensions, allowing unauthenticated attackers to upload PHP files disguised with alternate…
midi-Synth WordPress Plugin Arbitrary File Upload (CVE-2026-1306)
The midi-Synth plugin's export AJAX action insufficiently validates the file type/extension of uploaded MIDI conversion payloads (CWE-434). The handler writes the attacker-supplied, Base64-encoded file content into the plugin's…
Mercator Configuration SSRF Chained to Internal Redis RCE (CVE-2026-49345)
This repository contains two Python PoCs that abuse an unvalidated provider URL parameter in Mercator's ConfigurationController::testProvider endpoint, which the server fetches with libcurl. ssrf2scan.py uses the telnet:// scheme to turn the SSRF into a blind…
KnowledgeDeliver ASP.NET ViewState Deserialization RCE via Hardcoded Machine Keys — CVE-2026-5426
CVE-2026-5426 stems from KnowledgeDeliver shipping with hardcoded, publicly known decryptionKey/validationKey values in its web.config <machineKey> element. Because ASP.NET Web Forms uses these keys to encrypt and HMAC-sign the VIEWSTATE field, anyone who…
Kanboard — Missing Access Control on Plugin Installation Leads to Administrative RCE via Webshell Plugin (CVE-2026-25924)
Kanboard defines a PLUGININSTALLER security constant (default disabled) that is meant to prevent installing plugins from remote URLs. The UI correctly hides the plugin-install controls when this constant is off, using Installer::isConfigured() checks in…
FUXA SCADA/HMI — Unauthenticated Path Traversal to Remote Code Execution (CVE-2026-25895)
FUXA's POST /api/upload endpoint (server/api/projects/index.js:193) is registered without the middleware chain applied to every other project-management route, so it bypasses both the JWT/API-key check and the admin permission gate — even when the…
FreeScout Zero-Click RCE via Email Attachment Filename Sanitization Bypass ("Mail2Shell") — CVE-2026-28289
FreeScout automatically saves incoming email attachments to a predictable, web-accessible storage path, and attempts to block dangerous filenames such as .htaccess. This PoC bypasses that filter by prepending a zero-width Unicode character to the .htaccess…
EspoCRM Authenticated RCE via Formula ACL Bypass + Attachment Path Traversal — CVE-2026-33656
EspoCRM's Formula scripting engine (Formula/action/run) can be abused by an admin-authenticated user to bypass access controls and directly rewrite the sourceId field of an Attachment record, redirecting where uploaded chunk data is written on disk via path…
Discuz! X5.0 Race Condition + CAPTCHA-Solving Pre-Auth to RCE Chain (CVE-2026-49952)
This is a multi-stage, pre-auth-to-RCE exploit chain against Discuz! X5.0 that combines several bugs: an authcode-based DB export/import feature is abused to leak the admin's username and MD5 password hash from a database backup; the exploit then registers a…
Control Web Panel Pre-Auth Blind SQL Injection to RCE — CVE-2026-57517
Control Web Panel versions <= 0.9.8.1224 contain a pre-authentication blind SQL injection in the userRes POST parameter of the user panel endpoint (/{username}/). The backend query runs with MySQL root privileges, which hold the global FILE privilege,…
Chamilo LMS Authenticated RCE via Unrestricted File Upload — CVE-2026-29041
Chamilo LMS's ckuploadimage AJAX endpoint (main/inc/ajax/document.ajax.php?a=ckuploadimage) validates uploaded files solely by inspecting magic bytes via PHP's mimecontenttype(), without checking the file extension or sanitizing the stored filename. An…
Bludit CMS API Unrestricted File Upload to RCE (CVE-2026-25099)
Bludit CMS's POST /api/files/<page-key> endpoint lets any holder of a valid API token upload files to a page without validating file extension or content, so a PHP file can be uploaded and dropped directly under the web-accessible uploads directory. Once…
Unauthenticated RCE in Joomla Content Editor (JCE) Profile Import (CVE-2026-48907)
CVE-2026-48907 is a critical improper access control vulnerability in the JCE extension for Joomla. The profile import workflow (index.php?option=comjce&task=profiles.import) is missing sufficient authorization checks, letting unauthenticated users create new…
Cisco Unified CM WebDialer SSRF to Arbitrary File Write / RCE (CVE-2026-20230)
CVE-2026-20230 is a critical server-side request forgery vulnerability in Cisco Unified CM / Unified CM SME caused by improper input validation of HTTP requests processed by the WebDialer component. A remote unauthenticated attacker can chain unauthenticated…