CVE-2024-8353-PoC

Proof-Of-Concept Code for CVE-2024-8353 This repository contains a script for exploiting the CVE-2024-8353 vulnerability in the GiveWP plugin for WordPress. This vulnerability allows unauthenticated PHP Object Injection, potentially leading to remote code execution. Overview The provided scripts...

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-31 Technical...

CVE-2022-45599

CVE-2022-45599 CVE URL:| https://vulners.com/cve/CVE-2022-45599 ---|--- Reported by:| TanYeeTat Product:| Aztech WMB250AC Wireless Mesh Routers Affected Firmware:| 2020 Release topaz-linux.lzma.img Firmware download:| closed source Product Manual: https://kylaconnect.com/download-center/...

CVE-2026-109398

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-107248

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection SSTI flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker...

CVE-2022-41358

Exploit Title: Garage Management System 1.0 - 'categoriesName' - Stored XSS Exploit Author: Sam Wallace Software Link: https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html Version: 1.0 Tested on: Debian ID: CVE-2022-41358 Summary: Garage Management...

EUVD-2026-97649

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...

CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...

EUVD-2026-97620

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...

CVE-2026-109318

The Grav Git Sync plugin, versions 1.0.2 through 3.4.12 , is vulnerable to command injection when the gravuser or gravfull author modes are enabled. Authenticated content editors can execute OS commands by injecting shell substitutions into profile fields, such as username , full name , or email ...

EUVD-2026-97607

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates t...

CVE-2026-109305 Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates t...

CVE-2026-109305

Craft CMS versions 5.10.2 through 5.10.13 contain a Twig sandbox bypass vulnerability. This flaw allows non-admin users with the System Messages permission to invoke arbitrary PHP callables (such as passthru or system) via the "has some" and "has every" operators in sandboxed templates. Successfu...

CVE-2019-6340

CVE-2019-6340 CVE-2019-6340 POC Drupal rce python poc.py url php func command node number Example: python poc.py http://192.168.142.148/drupal-8.6.9/ system ipconfig 200 Twitter: @0w4ys...

CVE-2021-3831

PHP Exploit CVE-2021-3831 Script Overview This PHP script is designed to interact with a target website by generating specific MD5 hashes and making HTTP requests to exploit potential vulnerabilities. It is intended for educational purposes and should only be used in environments where you have...

PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-

CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 - PHP Object Injection → RCE -red 📋 Description CVE-2026-45247 is a critical PHP Object Injection vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce. An unauthenticated attacker can achieve...

CVE-2021-44967

CVE-2021-44967 Exploit Title: LimeSurvey 5.2.4 - Authenticated Remote Code Execution RCE Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login Date: 05/12/2021 Discovered by: Y1LD1R1M Exploit Author: D3Ext Vendor Homepage: https://www.limesurvey.org/ Software Link:...

CVE-2026-103535

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The itemname parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This...

CVE-2026-103522

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...