Sammy FORGIT

73 exploits Active since Jun 2012
CVE-2012-10027 EXPLOITDB ruby WORKING POC
WP-Property <1.35.0 - RCE
WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
CVE-2012-10027 EXPLOITDB php WORKING POC
WP-Property <1.35.0 - RCE
WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
CVE-2012-10026 EXPLOITDB ruby WORKING POC
Asset-Manager <2.0 - RCE
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
CVE-2012-10026 EXPLOITDB php WORKING POC
Asset-Manager <2.0 - RCE
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
CVE-2012-10052 EXPLOITDB ruby WORKING POC
EGallery 1.2 - RCE
EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full remote code execution under the web server context.
CVE-2012-10020 METASPLOIT CRITICAL ruby WORKING POC
FoxyPress <0.4.2.1 - File Upload
The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
CVSS 9.8
CVE-2012-10052 METASPLOIT ruby WORKING POC
EGallery 1.2 - RCE
EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full remote code execution under the web server context.
CVE-2012-10027 METASPLOIT ruby WORKING POC
WP-Property <1.35.0 - RCE
WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
CVE-2012-10026 METASPLOIT ruby WORKING POC
Asset-Manager <2.0 - RCE
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
EIP-2026-114297 EXPLOITDB php WORKING POC
WordPress Plugin Zingiri Web Shop 2.4.3 - 'uploadfilexd.php' Arbitrary File Upload
EIP-2026-114149 EXPLOITDB text WORKING POC
WordPress Plugin Uploader - Arbitrary File Upload
EIP-2026-114255 EXPLOITDB text WORKING POC
WordPress Plugin Wp-ImageZoom - 'file' Remote File Disclosure
EIP-2026-114116 EXPLOITDB text WORKING POC
WordPress Plugin Thinkun Remind 1.1.3 - Remote File Disclosure
EIP-2026-114042 EXPLOITDB text WRITEUP
WordPress Plugin Shopping Cart for WordPress - '/wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php?reqID' SQL Injection
EIP-2026-114041 EXPLOITDB text WRITEUP
WordPress Plugin Shopping Cart for WordPress - '/wp-content/plugins/levelfourstorefront/scripts/administration/backup.php?reqID' SQL Injection
EIP-2026-114043 EXPLOITDB text WORKING POC
WordPress Plugin Shopping Cart for WordPress - '/wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php? reqID' SQL Injection
EIP-2026-114047 EXPLOITDB text WORKING POC
WordPress Plugin Simple Download Button ShortCode 1.0 - Remote File Disclosure
EIP-2026-114073 EXPLOITDB text WRITEUP
WordPress Plugin SocialFit - 'msg' Cross-Site Scripting
EIP-2026-114119 EXPLOITDB text WORKING POC
WordPress Plugin TinyMCE Thumbnail Gallery 1.0.7 - Remote File Disclosure
EIP-2026-114175 EXPLOITDB php WORKING POC
WordPress Plugin VideoWhisper Video Presentation 3.17 - 'vw_upload.php' Arbitrary File Upload
CVE-2012-3576 EXPLOITDB php WORKING POC
Jquindlen Wpstorecart < 2.5.29 - Access Control
Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/wpstorecart.
EIP-2026-114282 EXPLOITDB text WORKING POC
WordPress Plugin Xerte Online - 'save.php' Arbitrary File Upload
EIP-2026-113796 EXPLOITDB php WORKING POC
WordPress Plugin Google Maps via Store Locator 2.7.1 < 3.0.1 - Multiple Vulnerabilities
CVE-2012-3578 EXPLOITDB php WORKING POC
Wordpress Fcchat Widget < 2.2.13.1 - Access Control
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images.
EIP-2026-113812 EXPLOITDB php WORKING POC
WordPress Plugin HTML5 AV Manager 0.2.7 - Arbitrary File Upload