Webshell — PoC Archive

Citrix NetScaler ADC/Gateway -- Pre-Auth SAML PrefixList Heap Overflow to RCE (CVE-2026-8452)

Sun, 16 Aug 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — network · CVE-2026-8452. Status: Patched. Affects: Citrix NetScaler ADC and NetScaler Gateway. Tags: citrix, netscaler, adc, gateway, saml, heap-overflow, preauth, rce, shellcode, webshell, freebsd, xml-signature, c14n, CVE-2026-8452.

Joomla Balbooa Forms Unauthenticated Arbitrary File Upload → RCE (CVE-2026-56291)

Mon, 27 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2026-56291. Status: Weaponized. Affects: Balbooa Forms (com_baforms) — third-party Joomla! extension by balbooa.com. Tags: joomla, balbooa-forms, file-upload, webshell, unauthenticated, rce, kev, actively-exploited, cwe-434.

Adobe ColdFusion RDS Path Traversal → Arbitrary File Read/Write → RCE (CVE-2026-48282)

Sun, 19 Jul 2026 00:00:00 +0000

Critical severity (CVSS 10) — web · CVE-2026-48282 (Adobe APSB26-68). Status: Weaponized — arbitrary file read/write, directory browsing, webshell deployment, and command execution all confirmed. Affects: Adobe ColdFusion — Remote Development Service (RDS), /CFIDE/main/ide.cfm. Tags: coldfusion, adobe, rds, path-traversal, cwe-22, unauthenticated, remote, webshell, kev, actively-exploited.

WordPress WPAMS Plugin Arbitrary File Upload to RCE (CVE-2025-39401)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 10) — web · CVE-2025-39401. Status: Weaponized. Affects: WPAMS (WordPress Apartment/Property Management System) plugin by mojoomla. Tags: wordpress, wpams, mojoomla, arbitrary-file-upload, webshell, rce, unauthenticated, python, multithreaded, cwe-434.

Webkul Medical Prescription Attachment for WooCommerce — Unrestricted File Upload to Web Shell (CVE-2025-29009)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 10) — web · CVE-2025-29009. Status: Weaponized. Affects: Webkul "Medical Prescription Attachment Plugin for WooCommerce" (WordPress plugin). Tags: wordpress, woocommerce, medical-prescription-attachment, unrestricted-file-upload, webshell, cwe-434, unauthenticated, python.

WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-12057. Status: Weaponized. Affects: WavePlayer (WordPress plugin). Tags: wordpress, waveplayer, arbitrary-file-upload, unauthenticated, rce, webshell, ajax, nonce, php, python.

ThinkPHP 5.0.24 File Inclusion Leading to Remote Code Execution (CVE-2025-63888)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-63888. Status: Weaponized. Affects: ThinkPHP (top10.org / TopThink PHP framework). Tags: thinkphp, php, file-inclusion, lfi, rce, log-poisoning, webshell, cwe-98, cwe-22.

StoreKeeper for WooCommerce Unauthenticated Arbitrary File Upload (CVE-2025-48148)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-48148. Status: Weaponized. Affects: StoreKeeper for WooCommerce (WordPress plugin). Tags: wordpress, woocommerce, storekeeper, arbitrary-file-upload, unauthenticated, webshell, rce, cwe-434, python.

KiotViet Sync Unauthenticated Arbitrary File Upload (CVE-2025-12674)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-12674. Status: Weaponized. Affects: KiotViet Sync (WordPress plugin). Tags: wordpress, kiotviet-sync, arbitrary-file-upload, unauthenticated, rce, rest-api, webshell, python.

Flozen WordPress Theme Unauthenticated Arbitrary File Upload (CVE-2025-49071)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-49071. Status: Weaponized. Affects: Flozen Theme for WordPress. Tags: wordpress, flozen-theme, arbitrary-file-upload, unauthenticated, webshell, zip-upload, rce, cwe-434, python.

Cibeles AI `actualizador_git.php` Unauthenticated Arbitrary File Upload / RCE (CVE-2025-13595)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-13595. Status: Weaponized. Affects: Cibeles AI (WordPress plugin). Tags: wordpress, cibeles-ai, unauthenticated-file-upload, github-mirror-abuse, webshell, python, cwe-434, cwe-306.

AI Feeds `actualizador_git.php` Unauthenticated Arbitrary File Upload / RCE (CVE-2025-13597)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-13597. Status: Weaponized. Affects: AI Feeds (WordPress plugin). Tags: wordpress, ai-feeds, unauthenticated-file-upload, github-mirror-abuse, webshell, python, cwe-434, cwe-306.

WordPress Ninja Forms Plugin Unauthenticated File Upload — CVE-2026-0740