Description
Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Nibbleblog File Upload Vulnerability
exploit/multi/http/nibbleblog_file_upload
Exploit-DB 1
- Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit) EDB-38489 · remote · Oct 19, 2015 · verified
GitHub 5 repositories
-
dix0nym/CVE-2015-6967 ★ 15 · Feb 25, 2021
Nibbleblog 4.0.3 - Arbitrary File Upload (CVE-2015-6967)
-
innocentx0/CVE-2015-6967-EXPLOIT ★ 0 · Aug 18, 2025
CVE-2015-6967 PoC Exploit
-
cuerv0x/CVE-2015-6967 ★ 0 · Jun 23, 2025
-
3mpir3Albert/HTB_Nibbles ★ 0 · Nov 5, 2023
In this repository you will find the technical report of Nibbles, the exploit to abuse the CVE-2015-6967 and an autopwn tool in case you want to resolve the machine in HackTheBox
-
FredBrave/CVE-2015-6967 ★ 0 · Jun 26, 2023
An exploit for the Nibbles manager version 4.0.3. This exploit allows RCE to be performed.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.