[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":75,"vulnerability-29982":82,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":110,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":116},[4,15,24,31,50,55,64],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"priority":13,"campaign_id":14},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","secondary","php2shell-rce",{"title":16,"slug":17,"text":18,"link":19,"external":20,"targets":21,"cta":23,"variant":13,"priority":13,"campaign_id":17},"Node2Shell - Exploit on Sniper: Auto-Exploiter page","node2shell-exploit","🚨 Exclusive exploit for Node2Shell now live","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-sniper",false,[22],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan",{"title":25,"slug":17,"text":26,"link":27,"external":9,"targets":28,"cta":30,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - Exploit on the NS page","🚨 Go beyond Node2Shell detection: exploit it with our exclusive module","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=node2shell&utm_content=call-to-action&utm_term=get-exploit-network",[29],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":32,"slug":17,"text":33,"link":8,"external":9,"targets":34,"cta":12,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - top pages, pricing CTA","Detect PHP2Shell & Node2Shell with every paid plan. Prove Node2Shell with the Exploit plan.",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",{"title":51,"slug":17,"text":33,"link":52,"external":20,"targets":53,"cta":52,"variant":13,"priority":13,"campaign_id":17},"Node2Shell exploit - pricing page",null,[54],"\u002Fpricing",{"title":56,"slug":57,"text":58,"link":59,"external":9,"targets":60,"cta":63,"variant":13,"priority":13,"campaign_id":57},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",[61,62],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":65,"slug":66,"text":67,"link":68,"external":20,"targets":69,"cta":12,"variant":13,"priority":13,"campaign_id":66},"*sshole, PHP2Shell & Node2Shell with any paid plan. Get proof with our Sniper exploit","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing?utm_medium=website&utm_source=website&utm_campaign=ssh-nov26&utm_content=call-to-action&utm_term=get-homepage",[70,71,72,73,74],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct",["Island",76],{"key":77,"params":78,"result":80},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":79},"{}",{"head":81},{},{"id":83,"detectable_with":84,"vuln_details":91,"vuln_id":107,"name":108,"published":109,"updated":52},29982,{"tool":85,"engine":88},{"id":86,"name":87},1,"Network Scanner",{"id":89,"name":90},2,"Nuclei",{"id":83,"codename":52,"description":52,"severity":92,"risk_description":93,"public_description":94,"public_recommendation":95,"recommendation":52,"references":96,"cvssv3":99,"epss_score":100,"epss_percentile":101,"cve":102,"in_cisa_catalog":20,"date":104,"software_type":52,"vendor":105,"product":106,"ptt_exploit_capabilities":52},"critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to and including 1.5.3. The elementor_file_upload AJAX handler, accessible to unauthenticated users via the wp_ajax_nopriv hook, validates file extensions using only a filename-based pathinfo check against an incomplete blacklist. The blacklist omits .php8 (among other extensions), allowing unauthenticated attackers to upload files with non-blacklisted dangerous extensions. The nonce required for the upload is exposed on public-facing pages via wp_localize_script, making the entire upload flow unauthenticated. The patched version (1.5.4) adds wp_check_filetype_and_ext() for content-based validation and uses wp_handle_upload(), rejecting files whose content does not match recognized MIME types.","Update the Drag and Drop File Upload for Elementor Forms plugin to version 1.5.4 or later, which implements content-based file type validation via wp_check_filetype_and_ext().",[97,98],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-49387","https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fdrag-and-drop-file-upload-for-elementor-forms\u002Fvulnerability\u002Fwordpress-drag-and-drop-file-upload-for-elementor-forms-plugin-1-5-3-arbitrary-file-upload-vulnerability",10,0.00379,0.32195,[103],"CVE-2025-49387","2025-08-28T00:00:00Z","add-ons.org","drag-and-drop-file-upload-for-elementor-forms","NETSCAN-NUCLEI-CVE-CVE-2025-49387","WordPress Drag and Drop File Upload for Elementor Forms \u003C=1.5.3 - Unauthenticated Arbitrary File Upload","2026-11-09T00:00:00Z",["Island",111],{"key":112,"params":113,"result":114},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":79},{"head":115},{},["Island",117],{"key":118,"params":119,"result":121},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":120},"{\"text-color\":\"gray\"}",{"head":122},{}]