RCE-Simplephpblog-biggiedroid

CVE-2025-15495 - Arbitrary File Upload Leading to Remote Code Execution RCE Product BiggiDroid – Simple PHP Blog CMS Product page: https://biggidroid.com/product/simple-php-blog/ Vulnerability Type Arbitrary File Upload Unrestricted File Upload Remote Code Execution RCE Severity Critical CVSS...

CVE-2024-4577

CVE-2024-4577 Fixed and minimalist PoC of the CVE-2024-4577 I just tested some PoCs for this vulnerability, and a few of them were not working correctly, so I fixed it by creating my own non-intrusive and minimalist PoC to check if you are vulnerable. How to use: python3 CVE-2024-4577.py URL...

CVE-2023-42326

pfSense 2.7.0 Command Injection Exploit CVE-2023-42326 This Python script is a Proof-of-Concept PoC exploit for the command injection vulnerability CVE-2023-42326 in pfSense 2.7.0. The vulnerability allows authenticated attackers to inject and execute arbitrary commands via the...

CVE-2018-12613

CVE-2018-12613 Modified standalone exploit ported to Python 3. Tested on Python 3.7.3, phpMyAdmin 4.8.1 running on Ubuntu 16.04 Works on Linux only. Original exploit by SSD. All credits to them. Changes made 1. Added function to exit if provided phpMyAdmin username/password is correct 2. Added...

pcc

PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...

CVE-2023-46818

CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash CVE-2023-46818 Authenticated PHP Code Injection in ISPConfig for more details: advisory CVE-2023-46818 PoC Introduction ISPConfig versions Note: This exploit requires valid ISPConfig admin credentials and will deploy a command web she...

CVE-2022-24990

CVE-2022-24990 Description - POC for CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation. - create by antx at 2022-04-12. Detail - The vulnerability allows a remote attacker to execute arbitrary commands on the target system. - The vulnerability...

CVE-2023-33253

CVE-2023-33253 LabCollector 6.0 though 6.15 allows remote code execution An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as...

CVE-2024-2961

CVE-2024-2961 CVE-2024–2961 Security Issue Mitigation Script Description This repository contains a Bash script to check and mitigate the buffer overflow vulnerability identified in GNU libc glibc versions 2.39 and older, known as CVE-2024-2961. This vulnerability affects PHP when the iconv...

CVE-2023-46818-Exploit

CVE-2023-46818-Exploit This is my own exploit for CVE-2023-46818 happy hacking! This exploit automates the attack described in CVE-2023-46818 by taking advantage of a PHP code injection vulnerability in ISPConfig version 3.2.11 and earlier. It logs into the ISPConfig panel using valid credentials...

cve-2024-4577

cve-2024-4577 poc Check for vulnerabilities python cve-2024-4577.py -u http://172.16.128.133 After a vulnerability is detected, you can use -c to execute a custom command python cve-2024-4577.py -u http://172.16.128.133 -c '?php system'whoami';'...

CVE-2025-49113

CVE-2025-49113 – Roundcube Remote Code Execution RCE PoC This repository contains a Proof-of-Concept PoC exploit for CVE-2025-49113 , a critical remote code execution vulnerability in Roundcube Webmail versions prior to 1.5.10 and 1.6.11. The vulnerability arises from insecure PHP object...

CVE-2024-25641-CACTI-RCE-1.2.26

CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵 Authenticated RCE Cacti version v1.2.26 Summary An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code ...

Chankro

Chankro Your favourite tool to bypass disablefunctions and openbasedir in your pentests. How it works PHP in Linux calls a binary sendmail when the mail function is executed. If we have putenv allowed, we can set the environment variable "LDPRELOAD", so we can preload an arbitrary shared object...

ramnit_traffic_parser

ramnittrafficparser If you have traffic data between Ramnit and C2, you can dump the configs & modules Require PHP 7 tshark Usage $ php main.php pcap/URL Example $ php main.php "https://content.any.run/tasks/b1cf6c3e-f079-49b4-9798-44a7c511d194/download/pcap" + REGISTERBOT0xe2 : output/00e2.bin +...

CVE-2019-11043

CVE-2019-11043 Python exp for CVE-2019-11043 You can use build environment from https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043 Usage： python3 main.py -u http://iptopage/index.php If you success, you will see: Base status code is 200 qsl:1760 with status code 502 The target maybe...

safeshell

safeshell Prevent PHP vulnerabilities similar to CVE-2016-10033 and CVE-2016-10045...

b374k

b374k shell 3.2 This PHP Shell is a useful tool for system or web administrator to do remote management without using cpanel, connecting using ssh, ftp etc. All actions take place within a web browser Features : File manager view, edit, rename, delete, upload, download, archiver, etc Search file,...

p0wny-shell

p0wny@shell: -- Single-file PHP Shell p0wny@shell: is a very basic, single-file, PHP shell. It can be used to quickly execute commands on a server when pentesting a PHP application. Use it with caution: this script represents a security risk for the server. Features: Command history using arrow...

CVE-2005-0603-phpBB-2.0.12-Full-path-disclosure

CVE: https://vulners.com/cve/CVE-2005-0603 Neo Security Team NST® - Advisory 06 - 25/02/05 Program: phpBB 2.0.12 Homepage: http://www.phpbb.com Vulnerable Versions: phpBB 2.0.12 & Lower versions Risk: Low Risk!! Impact: Full path disclosure -==phpBB 2.0.12 Full path disclosure==- Description phpB...