cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms Fix A drop-in WordPress plugin that blocks the vulnerable Demo Import handler in FunnelForms Pro ≤ 3.8.1 to mitigate Remote Code Execution CVE-2026-39440, CVSS 9.9. The Vulnerability Field| Value ---|--- CVE ID| CVE-2026-39440 CVSS Score| 9.9 Critical Affected|...

PanaceaSoft-0day-Exploit

PanaceaSoft-0day-Exploit PanaceaSoft all products 0day exploit https://packetstormsecurity.com/files/157869/PanaceaSoft-Shell-Upload.html no write-up read: jQuery File Upload's PHP Upload Handler...

DVWA

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA is a PHP/MariaDB web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of...

CVE-2026-25099

CVE-2026-25099 - Bludit CMS API Unrestricted File Upload to RCE Description Bludit CMS versions before 3.18.4 allow an authenticated attacker with a valid API token to upload files of any type and extension via the POST /api/files/ endpoint. The uploadFile function performs no file extension or...

XORpass

XORpass is an encoder to bypass WAF filters using XOR operations. Installation & Usage root@kitploit: git clone https://github.com/devploit/XORpass cd XORpass $ python3 xorpass.py -h Example of bypass: Using clear PHP function: Using XOR bypass of that function: root@kitploit: $ python3 xorpass.p...

zencart_auth_rce_poc

zencartauthrcepoc CVE-2021-3291 1- login as admin 2- get any modules edit page 3- inspect element any true radiobox 4- change true to true','MODULEORDERTOTALTOTALSTATUS'; echo id; // 5- click update 6- to trig command go again edit page CVE-2021-3291 https://vulners.com/cve/CVE-2021-3291 POC...

Unrestricted-File-Upload-on-SiteMagic-CMS-4.4.2

Unrestricted File Upload on SiteMagic CMS 4.4.2 This repo describe how to exploit unrestricted file upload vulnerability on SiteMagic CMS 4.4.2 About SiteMagic CMS 4.4.2 Website: https://sitemagic.org/ Download: https://sitemagic.org/Download.html PoC - Exploiting unrestricted file upload...

CVE-2026-3395-Lab

CVE-2026-3395 — MaxSite CMS Unauthenticated RCE Lab This repository is for educational and research purposes only. All testing must be done in a local Docker lab environment. Do not deploy this setup to public or production systems. Summary CVE-2026-3395 affects MaxSite CMS and allows...

Grawler

Grawler - v1.0 This project isnot maintained anymore. Grawler is the best tool ever, made for automating google dorks it's a tool written in PHP which comes with a web interface that automates the task of using google dorks, scrapes the results, and stores them in a file, version 1.0 is the more...

osTicketFileReadIntoRCE

CVE-2026-22200: osTicket Lectura Arbitraria de Archivos a RCE Exploit de cadena completa que combina la inyección de cadenas de filtros PHP con CVE-2024-2961 CNEXT para la Ejecución Remota de Código no autenticada en instalaciones vulnerables de osTicket. Tabla de Contenidos Visión General Detall...

CVE-2025-62429

CVE-2025-62429 PoC - clipbucket RCE Proof-of-Concept for RCE via PHP Code Injection in updatelaunch.php Disclosure: Originally reported by me via GHSA-3h9c-7j8r-xc3v ⚠️ Authorized pentesting/research use only. Vulnerability Information...

quasibot

quasiBot quasiBot 0.3 - Read Me 07.08.14 Agenda QuasiBot is a complex webshell manager written in PHP, which operate on web-based backdoors implemented by user himself. Using prepared php backdoors, quasiBot will work as C&C trying to communicate with each backdoor. Tool goes beyond average...

CVE-2021-21311

CVE-2021-21311 Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers e.g. adminer.php are affected. This is fixed in version 4.7.9...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Authenticated Administrator+ Arbitrary File Upload via 'mdjmemailuploadfile' Parameter The WordPress MDJM Event Management plugin version 1.7.8.3 and prior contains an arbitrary file upload vulnerability that allows authenticated administrators to upload maliciou...

CamPhish

CamPhish Obtén capturas de la cámara frontal del teléfono de la víctima o de la webcam del PC simplemente enviando un enlace. ¿Qué es CamPhish? CamPhish son técnicas para tomar capturas de la cámara frontal del teléfono de la víctima o de la webcam del PC. CamPhish aloja un sitio web falso en un...

tpadmin-CVE-2026-2113-poc

tpadmin-CVE-2026-2113-poc A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload. Vulnerability Description A critical Remote Code Execution vulnerability exists in H-ui.admin system's WebUploader preview component. The...

CVE-2026-42879

CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass Summary An authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF...

slopShell

slopShell php webshell Since I derped, and forgot to talk about usage. Here goes. For this shell to work, you need 2 things, a victim that allows php file uploadyourself, in an educational environment and a way to send http requests to this webshell the client script is the 100% best way to...

CVE-2021-24307-all-in-one-seo-pack-admin-rce

Admin PHP unserialization RCE in All in one SEO pack CVE-2021-24307 Simple PoC of an admin authenticated RCE in AISEO = 4.1.0.1 provided as an example. Full write-up here: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Usage: root@kitploit: ph...

CVE-2026-36340

CVE-2026-36340 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critical Affected Product: Krayin CRM v2.1.5 Vulnerability Type: Remote Code Execution RCE Authentication Required: Yes Summary A...