CVE-2026-104723

The LifterLMS WordPress plugin (versions

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress (versions up to and including 2.8.187 ) are vulnerable to Local File Inclusion (LFI) . The root cause is an insecure handling of the 'design_type' parameter , which allows unauthenticated attack...

CVE-2025-32432

CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Authentication Remote Code Execution in Craft CMS Affected: Craft CMS 3.x, 4.x, and 5.x up to 5.6.16 Info: This exploit is tested against HackTheBox Orion machine Overview This repository contains a proof-of-concept exploit for CVE-2025-32432...

CVE-2025-46178

CVE-2025-46178 Cross-Site Scripting XSS vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or...

PHP-REVERSE-SHELL

PHP Reverse Shell Powerful & Stealthy This is a powerful and stealthy PHP reverse shell designed for ethical hacking and penetration testing. It establishes a reliable and quiet connection back to your machine. ⚠️ Disclaimer This PHP reverse shell is developed strictly for educational and...

CVE-2023-26469-Jorani

CVE-2023-26469 Exploitation Tool Overview This is a Proof of Concept PoC exploit tool for Jorani 1.0.0, which allows attackers to achieve remote code execution through path traversal and log injection techniques. ⚠️ Warning: This tool is intended for security research and authorized testing only...

CVE-2019-6340

CVE-2019-6340 Solo a scopo educativo Esecuzione $ docker run --rm -p 8080:80 knqyf263/cve-2019-6340 Exploit GET $ curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?format=haljson" -d ' "link": "value": "link", "options":...

CVE-2026-102425

🖥️ BAForms-RCE — CVE-2026-102425 GUI Dark-neon GUI scanner/exploit untuk CVE-2026-102425 — Balbooa Forms combaforms 1.0.0–2.4.3.3: Unauthenticated RCE via field shortcode injection pada PHP-after-submission action eval. Implementasi GUI mandiri standalone — ditulis ulang dari nol berdasarkan...

CVE-2019-19369

CVE-2019-19369 - FusionPBX = 4.5.10 Authenticated RCE Authenticated attackers can use PHP-Editor function in FusionPBX versions = 4.5.10 to edit one of the existing PHP pages to insert a PHP payload. By navigating to the changed file we are able to gain a shell as www-data. Discovered by...

CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

CVE-2026-65883

CVE-2026-65883 — Aimy Captcha-Less Form Guard = 20.0 clfgd Field → XOR Recovery → unserialize → FormattedtextLogger → RCE Overview Unauthenticated PHP Object Injection in Aimy Captcha-Less Form Guard for Joomla. The onCheckAnswer method base64-decodes the attacker-controlled clfgd POST field, run...

cve-2024-0012_9474-panos_authbypass_reproduction

CVE-2024-0012 / CVE-2024-9474 — PAN-OS Authentication Bypass → Privilege Escalation Chain CVE| Description| CVSS ---|---|--- CVE-2024-0012| PAN-OS Management Interface Authentication Bypass| 9.3 CVE-2024-9474| PAN-OS Privilege Escalation| 6.9 When chained, these vulnerabilities allow...

CVE-2025-26199

🛡️ CVE-2025-26199 — Insecure Password Transmission via Cleartext in CloudClassroom-PHP-Project v1.0 📄 Description CloudClassroom-PHP-Project v1.0 is vulnerable to insecure transmission of user credentials. During the authentication process, passwords are submitted over unencrypted HTTP rather than...

CVE-2025-49132

CVE-2025-49132 - RCE non autenticata su Pterodactyl Panel / |\ \ / /| | | / | | | | || | / | || / | | \ V / | || / / | |/ / | | | | , /| || \ / / | / || /| //||/ || // ||/ /| Exploit per Pterodactyl Panel ≤ 1.11.10 - da LFI non autenticata a RCE. La vulnerabilità L'endpoint...

CVE-2025-69212-PoC

CVE-2025-69212 - OpenSTAManager OS Command Injection PoC Usage Install dependencies: pip install -r requirements.txt Run a single command and print its output: python3 cve-2025-69212poc.py -u http://target.com -U admin -P 'password' -c 'id' Drop a persistent PHP webshell instead: python3...

Cockpit CMS 0.6.1 - Remote Code Execution

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. id: CVE-2020-35131 info: name: Cockpit CMS 0.6.1 ...

HuangDou UTCMS V9 - OS Command Injection

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The...

WordPress UserPro 4.9.32 - Cross-Site Scripting

WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API v2 it relies on allows it via the example/success.php errordescription parameter. id: CVE-2019-14470 info: name: WordPress UserPro 4.9.32 - Cross-Site Scripting author: daffainfo severity: mediu...

Revive Adserver 4.2 - Remote Code Execution

Revive Adserver 4.2 is susceptible to remote code execution. An attacker can send a crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. This can be exploited to perform various types of attacks, e.g...

NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...