Roundcube_CVE-2025-49113

RCE in Roundcube CVE-2025-49113 - My Obsidian note .md date time Status: Completed Lab: Easy Tags: RCE | PHP | LABTHM | EXPLOIT | CVE by KRPT Paulo G. Werneck - Linkedin - in.com/pgw-script Impact : remote command execution post-login CVSS 9.9 Affected versions : ≤ 1.5.10 / 1.6.10 Patched : 1.5.1...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

xss_vulnerability_challenges

Escenarios de Vulnerabilidad XSS desafíos Este repositorio es una aplicación PHP Dockerizada que contiene algunos desafíos de vulnerabilidad XSS. Las ideas detrás de los desafíos son: Bypass de validación de JavaScript Bypass de entidades HTML Bypass de WAF Bypass de validación de lista negra...

CVE-2023-4220

Exploit de ejecución remota de código no autenticada en Chamilo LMS CVE-2023-4220 Resumen Este repositorio contiene un script Bash que explota una vulnerabilidad de ejecución remota de código RCE no autenticada en Chamilo LMS mediante la escritura arbitraria de archivos. La vulnerabilidad está...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP Object Injection PoC Safe local proof of concept for the PHP object injection issue identified in Cotonti's CommentsWidget implementation. Vulnerability Project: Cotonti Affected component: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — Deserialization of...

CVE-2024-4577

CVE-2024-4577 Environment Setup Files and PHP Files --poc-- Invoke-WebRequest -Method POST -Headers @"Content-Type" = "application/x-www-form-urlencoded" -Body "" -Uri "http://localhost/test.php?%ADd+allowurlinclude%3D1+%ADd+autoprepend file%3Dphp://input"...

CVE-2025-34100-demo

CVE-2025-34100-demo Demo web server !NOTE Please note that this is just the PHP files for the website, to understand the CVE better and create a more effective PoC, visit https://nvd.nist.gov/vuln/detail/CVE-2025-34100 These files will not cause the CVE, but rather are the entry point to exploit...

CVE-2024-4577

CVE-2024-4577 Vulnerability Checker This script is designed to check for the vulnerability described by CVE-2024-4577, which involves exploiting certain PHP configurations to execute arbitrary code remotely. It sends a POST request to specified endpoints on a list of domains and checks if the...

CVE-2024-10449-patch

Patch for CVE-2024-10449 https://nvd.nist.gov/vuln/detail/CVE-2024-10449 Steps: Download the patched loginAction.php file from this repository https://raw.githubusercontent.com/g-u-i-d/CVE-2024-10449-patch/refs/heads/main/loginAction.php and replace the vulnerable version with this one. Edit the...

b374k

b374k shell 3.2 Este PHP Shell es una herramienta útil para administradores de sistemas o web para realizar gestión remota sin usar cpanel, conectarse mediante ssh, ftp, etc. Todas las acciones se realizan dentro de un navegador web. Características: Gestor de archivos ver, editar, renombrar,...

CVE-2025-34030-PoC

CVE-2025-34030 - sar2html 'plot' parameter RCE CVSS: 10.0 Critical Vulnerability: OS Command Injection Programming Language: PHP Exploit Code: Python References: https://nvd.nist.gov/vuln/detail/CVE-2025-34030 https://www.vulncheck.com/advisories/sar2html-command-injection Description sar2html...

CVE-2024-4577

Just for researching Poc For Default XAMPP curl -v -d "" http://127.0.0.1/php-cgi/php-cgi.exe/?%add+allowurlinclude%3Don+-d+autoprependfile%3Dphp%3A//input+-d+cgi.forceredirect%3D0...

payday

Payday Generador de payloads que utiliza Metasploit y Veil. Toma la dirección IP como entrada y luego construye payloads automáticamente. Llama al framework Veil con la dirección IP proporcionada y crea binarios y handlers. Utiliza msfvenom para crear payloads y escribe archivos de handlers de...

CVE-2024-51430

CVE-2024-51430 Vulnerability Type Cross-Site Scripting XSS Description Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component Vendor of...

CVE-2023-41892_poc

CVE-2023-41892poc Customized this for my own use pocnoauth.py Basic PHP one-liner webshell OS command execution via ?cmd= pocauth.py Simple key-based authentication added webshell SHA-256 hash comparison method Commands can only be executed if the correct key is provided Code modification require...

cve-2024-37762

Description MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution. The application offers the possibility of a creation of a form with a file upload functionality. While by default the accepted files are restricted to a common sa...

CVE-2015-8351

gwollebuster this script is exploit for wordpress old plugin gwolle usage: ./gwollebuster.py first arguments = your target url of wordpress that installed gwolle second arguments = your ip third arguments = listening port for reverse shell example: ./gwollebuster.py http://vulnpress.com/...

CVE-2012-2122-scanner

Usage: php scanner.php 10.0.0.1/18 block in cidr notation Requirements: php5-cli...

CVE-2016-010033-010045

CVE-2016-010033-010045 Php mail RCE CVE-2016-010033/45 imported to python3 Getting Started These instructions will get you a copy of the project up and running on your local machine for development and testing purposes. See deployment for notes on how to deploy the project on a live system...