CVE-2026-104723

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

EUVD-2026-96118

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...

EUVD-2026-96108

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-104723

The LifterLMS WordPress plugin (versions

CVE-2026-104723 LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress (versions up to and including 2.8.187 ) are vulnerable to Local File Inclusion (LFI) . The root cause is an insecure handling of the 'design_type' parameter , which allows unauthenticated attack...

CVE-2025-32432

CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Authentication Remote Code Execution in Craft CMS Affected: Craft CMS 3.x, 4.x, and 5.x up to 5.6.16 Info: This exploit is tested against HackTheBox Orion machine Overview This repository contains a proof-of-concept exploit for CVE-2025-32432...

CVE-2023-26469-Jorani

CVE-2023-26469 Exploitation Tool Overview This is a Proof of Concept PoC exploit tool for Jorani 1.0.0, which allows attackers to achieve remote code execution through path traversal and log injection techniques. ⚠️ Warning: This tool is intended for security research and authorized testing only...

CVE-2026-102425

🖥️ BAForms-RCE — CVE-2026-102425 GUI Dark-neon GUI scanner/exploit untuk CVE-2026-102425 — Balbooa Forms combaforms 1.0.0–2.4.3.3: Unauthenticated RCE via field shortcode injection pada PHP-after-submission action eval. Implementasi GUI mandiri standalone — ditulis ulang dari nol berdasarkan...

CVE-2026-103889 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

CVE-2026-65883

CVE-2026-65883 — Aimy Captcha-Less Form Guard = 20.0 clfgd Field → XOR Recovery → unserialize → FormattedtextLogger → RCE Overview Unauthenticated PHP Object Injection in Aimy Captcha-Less Form Guard for Joomla. The onCheckAnswer method base64-decodes the attacker-controlled clfgd POST field, run...

cve-2024-0012_9474-panos_authbypass_reproduction

CVE-2024-0012 / CVE-2024-9474 — PAN-OS Authentication Bypass → Privilege Escalation Chain CVE| Description| CVSS ---|---|--- CVE-2024-0012| PAN-OS Management Interface Authentication Bypass| 9.3 CVE-2024-9474| PAN-OS Privilege Escalation| 6.9 When chained, these vulnerabilities allow...

CVE-2025-26199

🛡️ CVE-2025-26199 — Insecure Password Transmission via Cleartext in CloudClassroom-PHP-Project v1.0 📄 Description CloudClassroom-PHP-Project v1.0 is vulnerable to insecure transmission of user credentials. During the authentication process, passwords are submitted over unencrypted HTTP rather than...

CVE-2025-69212-PoC

CVE-2025-69212 - OpenSTAManager OS Command Injection PoC Usage Install dependencies: pip install -r requirements.txt Run a single command and print its output: python3 cve-2025-69212poc.py -u http://target.com -U admin -P 'password' -c 'id' Drop a persistent PHP webshell instead: python3...

CVE-2024-25600-mass

mass upload shell for cve python3 exploit.py -l yourlist.txt path shell https://examplewebsite.com/asd.php...

CVE-2026-17544-PoC

CVE-2026-17544 — PHP bcmath bccomp Out-of-Bounds-Write Stack-Smashing CVSS 9.8 Kritisch · CWE-787 · GHSA-x692-q9x7-8c3f Zusammenfassung bcstr2num in ext/bcmath/libbcmath/src/str2num.c mitgeliefertes libbcmath, PHP 8.4+ enthält einen Off-by-N-Out-of-Bounds-Write. Wenn die vom Benutzer angegebene...

PT-2026-109792

Name of the Vulnerable Software and Affected Versions Angio versions prior to 1.1.2 Description PHP Object Injection occurs in the Subscriber component, allowing an attacker to inject malicious objects into the application. Recommendations Update to a version newer than 1.1.1...

PT-2026-109589

Name of the Vulnerable Software and Affected Versions Axiomthemes Balance versions prior to 1.12.1 Description The Axiomthemes Balance WordPress theme contains a flaw where it deserializes untrusted user-controlled data using the unserialize function. This allows for PHP object injection, where...

PT-2026-109505

Name of the Vulnerable Software and Affected Versions Rank Math SEO versions prior to 1.0.280 Description The settings import feature fails to correctly validate the type of uploaded files. This allows users with administrator-level access to upload a PHP file, which can lead to remote code...

Linux Distros Unpatched Vulnerability : CVE-2026-106432

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4...