110342 matches found
bantam
Bantam Una herramienta avanzada de gestión de backdoors PHP, con una huella de servidor ligera, comunicación multi-hilo y una herramienta avanzada de generación y ofuscación de payloads. Cuenta con cifrado de extremo a extremo con claves de cifrado únicas por solicitud y transmisión de payloads...
CVE-2023-4220-Proof-of-concept
CVE-2023-4220-Proof-of-concept Chamilo LMS Unauthenticated Big Upload File that allows remote code execution CODE IS MADE AND USED FOR HACKTHEBOX CTF PERMX Unauthenticated file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS the php...
CVE-2026-61424
CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload Task → No Auth → 3-String Filter Bypass Overview Unauthenticated arbitrary file upload in DJ-Classifieds for Joomla. The imageupload task endpoint processes file uploads without authentication and relies on a 3-string blocklist ?php, eval, base...
CVE-2025-49132-PHP-PEAR
CVE-2025-49132: Pterodactyl Panel Unauthenticated RCE via PHP PEAR Method Table of Contents Overview Vulnerability Details Technical Analysis Exploit Flow Installation Usage Examples Mitigation Disclaimer References Author Overview This repository contains a proof-of-concept PoC exploit for...
php_reverse_shell
This repository does not have a README...
php-8.1.0-dev-exploit
php-8.1-dev-Exploit ⚠️ Important read first This repository contains a Java proof-of-concept PoC intended for CTF / lab use only. Do not run this code against systems you do not own or do not have explicit written permission to test. Unauthorized exploitation is illegal. Use only in isolated...
drupalgeddon-2
Drupalgeddon-2 Vuln checker for Drupal v7.x + v8.x Usage : php drupalgeddon.php Target http://example.com :...
CVE-2026-9691
CVE-2026-9691 CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule...
CVE-2024-52433
CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...
CVE-2024-4577
CVE-2024-4577 - PHP-CGI Argument Injection RCE | | ---|---|--- CVE| Description| CVSSv3 CVE-2024-4577| PHP-CGI Argument Injection Vulnerability| 9.8 | | "CVE-2024-4577 is a critical argument injection vulnerability in PHP that can be exploited to achieve remote code execution RCE. According to...
CVE-2025-49113
CVE-2025-49113 Roundcube Exploit A Python exploit for CVE-2025-49113, targeting a vulnerability in Roundcube webmail that allows remote code execution through PHP object deserialization. Overview This exploit leverages a deserialization vulnerability in Roundcube's file upload functionality. It...
CVE-2026-108750: Improper Handling of Highly Compressed Data (Data Amplification)
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...
CVE-2026-104028: Unrestricted Upload of File with Dangerous Type
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...
PT-2026-110011
Name of the Vulnerable Software and Affected Versions Anton Extensions versions prior to 1.2.3 Description An issue exists where the plugin fails to perform capability checks, nonce verification, and file-type validation before writing content to a chosen path. This allows unauthenticated attacke...
CVE-2023-24249-Exploit
CVE-2023-24249 Exploit Script Description This repository contains an exploit script for CVE-2023-24249, a critical vulnerability found in laravel-admin version 1.8.19. This vulnerability allows for arbitrary file upload, enabling attackers to execute arbitrary code via a crafted PHP file. The...
CVE-2024-12877-Exploit
GO-TO CVE – CVE-2024-12877-Exploit Week 66 | Author: Ali Soltani soltanali0 Welcome to Week 66 of the GO-TO CVE series , where we dissect vulnerabilities, analyze root causes, and demonstrate practical exploitation techniques in a safe, educational context. 🚨 Overview CVE-2024-12877 is a PHP Obje...
CVE-2021-40373
CVE-playsms There is a vulnerability in playsms 1.4.3 that allows potential attackers to execute remote code execution. how to reproduce RCE shell: https://playsms.org/ docker pull playsms/playsms:1.4.3 docker run -d -p 80:80 playsms/playsms login using admin:admin...
WG-CVE-2026-1555-Linux
██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ ██║ ╚██╗ ██╔╝██╔══╝ ██╔═══╝ ████╔╝██║██╔═══╝ ██╔═══██╗ ╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗╚██████╔╝ ╚═════╝ ╚═══╝...
