BigAnt admin /Addin/Upload/uploadMultipleFile.html 任意文件上传漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://cn-sec.com/archives/3922830.html
• https://www.ddpoc.com/DVB-2025-9001.html
• https://cn-sec.com/archives/4095059.html
• https://update.nsfocusglobal.com/update/listNewipsDetail/v/rule5.6.11
• https://www.gm7.org/archives/32778
• https://zhuanlan.zhihu.com/p/1932214870562047555

Related Vulnerabilities

• PoCCVE-2026-2113: tpadmin <= 1.3.12 - Remote Code Execution
• PoCnacos-v3-auth-scope-bypass: Nacos 3.x - Unauthenticated Admin Takeover
• PoCCVE-2026-19598: Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router
• PoCCVE-2026-55224: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE
• PoCCVE-2025-13342: DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update
• PoCCVE-2026-34976: Dgraph <=v25.3.0 - Admin Mutation Missing Authorization
• PoCCVE-2026-45332: Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure
• Cisco ISE /admin/files-upload/ 文件上传漏洞（CVE-2025-20282）
• PoCCVE-2026-8732: WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation
• PoCNginxWebUI /adminPage/login/getAuth 命令执行漏洞
• PoCNginxWebUI /Adminpage/Conf/loadOrg 文件读取漏洞
• NginxWebUI /Adminpage/Remote/cmdOver 命令执行漏洞
• MasterStudy LMS /wp-admin/admin-ajax.php?action=stm_lms_load_content 文件包含漏洞（CVE-2024-3136）