CVE-2026-71426 GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...

CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

EUVD-2026-91043

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-53953

In GetSimple CMS CE version 3.3.22 , the password reset endpoint is accessible without authentication. When a reset request is submitted for an existing user, the application generates a temporary password using PHP rand() seeded with microtime() . Because this seed is time-based and has a limite...

CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

cpanel-malware-cleaner-cve-2026

🚨 Очиститель вредоносных программ cPanel – Инструмент исправления CVE-2026-41940 Лёгкий и мощный инструмент безопасности для обнаружения, удаления и предотвращения вредоносных заражений, вызванных недавними уязвимостями cPanel, включая CVE-2026-41940. 🔥 Возможности Обнаруживает и удаляет...

cve-2024-4577-lab

CVE-2024-4577 — PHP-CGI Argument Injection → RCE Docker Lab / CTF Автономный Docker-лабораторный стенд с нуля , демонстрирующий реальный примитив argument-injection → Remote Code Execution, лежащий в основе CVE-2024-4577. Эксплуатируйте его через http://localhost:8080, получите шелл и прочитайте...

copy-fail-CVE-2026-31431-php

CVE-2026-31431 Copy Fail PHP PoC www-data@jumpbox:/home$ id uid=33www-data gid=33www-data groups=33www-data www-data@jumpbox:/home$ uname -a Linux testbox 5.15.0-136-generic 147-Ubuntu SMP Sat Mar 15 15:53:30 UTC 2025 x8664 x8664 x8664 GNU/Linux www-data@jumpbox:/home$ php CVE-2026-31431.php id...

cve-2026-39440-funnelforms-fix

Исправление CVE-2026-39440 для FunnelForms Готовый к установке WordPress-плагин, который блокирует уязвимый обработчик импорта демо-данных в FunnelForms Pro ≤ 3.8.1 для устранения удалённого выполнения кода CVE-2026-39440, CVSS 9.9. Уязвимость Поле| Значение ---|--- ID CVE| CVE-2026-39440 Оценка...

HTB-Pterodactyl-Writeup

Penetration Test Report — HackTheBox: Pterodactyl Date: April 8, 2026 Target: Pterodactyl HackTheBox Difficulty: Medium OS: Linux openSUSE Leap 15.6 Tester: V0idW1re Executive Summary The Pterodactyl machine on HackTheBox presented a realistic attack scenario involving a misconfigured web...

PanaceaSoft-0day-Exploit

PanaceaSoft-0day-Exploit PanaceaSoft all products 0day exploit https://packetstormsecurity.com/files/157869/PanaceaSoft-Shell-Upload.html no write-up read: jQuery File Upload's PHP Upload Handler...

CVE-2026-25099

CVE-2026-25099 - Неограниченная загрузка файлов через API Bludit CMS с последующим выполнением кода RCE Описание Версии Bludit CMS до 3.18.4 позволяют аутентифицированному атакующему с действительным API-токеном загружать файлы любого типа и расширения через конечную точку POST /api/files/. Функц...

CVE-2024-27115-Exploit

SOPlanning 1.52.01 — Удалённое выполнение кода RCE с аутентификацией Детали эксплойта Название эксплойта : SOPlanning 1.52.01 Simple Online Planning Tool — Удалённое выполнение кода RCE с аутентификацией Дата : 6 октября 2024 года Автор эксплойта : Ardayfio Samuel Nii Aryee Версия : 1.52.01...

CVE-2026-3395-Lab

CVE-2026-3395 — Лаборатория неаутентифицированного RCE в MaxSite CMS Этот репозиторий предназначен только для образовательных и исследовательских целей. Все тестирование должно проводиться в локальной среде Docker-лаборатории. Не разворачивайте эту конфигурацию на публичных или производственных...

CVE-2021-21311

CVE-2021-21311 Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers e.g. adminer.php are affected. This is fixed in version 4.7.9...

CVE-2026-42879

CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass Summary An authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF...

zencart_auth_rce_poc

zencartauthrcepoc CVE-2021-3291 1- login as admin 2- get any modules edit page 3- inspect element any true radiobox 4- change true to true','MODULEORDERTOTALTOTALSTATUS'; echo id; // 5- click update 6- to trig command go again edit page CVE-2021-3291 https://vulners.com/cve/CVE-2021-3291 POC...

Unrestricted-File-Upload-on-SiteMagic-CMS-4.4.2

Unrestricted File Upload on SiteMagic CMS 4.4.2 This repo describe how to exploit unrestricted file upload vulnerability on SiteMagic CMS 4.4.2 About SiteMagic CMS 4.4.2 Website: https://sitemagic.org/ Download: https://sitemagic.org/Download.html PoC - Exploiting unrestricted file upload...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Authenticated Administrator+ Arbitrary File Upload via 'mdjmemailuploadfile' Parameter The WordPress MDJM Event Management plugin version 1.7.8.3 and prior contains an arbitrary file upload vulnerability that allows authenticated administrators to upload maliciou...