CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP prior to 4.4.18 on SQLite-backed installations contains a code injection vulnerability in the navigation endpoint. The endpoint mishandles array-typed user input, bypasses input sanitization, and can break out of a PHP-quoted string context, enabling an authenticated attacker (minimum editor...

CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CLSA-2026-1786371522 TuxCare security update for dompdf/dompdf (5 CVEs)

TuxCare rebuilt dompdf/dompdf to address 5 CVEs. Fixed in 3.1.0-p1+tuxcare...

WordPress Grand Spa theme <= 3.5.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Spa versions = 3.5.3...

WordPress Grand Car Rental theme <= 3.7.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Grand Car Rental versions = 3.7.2...

CVE-2026-72593 dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...

EUVD-2026-55214

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72592 dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CLSA-2026-1786346242 TuxCare security update for guzzlehttp/psr7 (1 CVE)

TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.9.1-p2+tuxcare...

CVE-2026-16985

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

php-Charts - wizard/url.php RCE Detection

Detects php-Charts = 1.0 RCE via /wizard/url.php?$phpinfo=1. !/usr/bin/env python3 -- coding: utf-8 -- """php-Charts wizard/url.php RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'php-Charts - wizard/url.php RCE...

Traq - Unauthenticated Plugin Hook RCE

Exploits Traq by installing an unauthenticated plugin hook that executes attacker PHP, then cleans up the plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Traq unauthenticated plugin hook RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

TikiWiki - jhot.php Upload Detection (CVE-2006-4602)

Detects CVE-2006-4602 by uploading a PHP file via /jhot.php and verifying phpinfo under /img/wiki/. !/usr/bin/env python3 -- coding: utf-8 -- """TikiWiki jhot.php arbitrary PHP upload CVE-2006-4602.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Symantec Web Gateway - releasenotes LFI Detection (CVE-2012-0297)

Detects CVE-2012-0297/0299 by injecting PHP into accesslog via a crafted GET path then including it through releasenotes.php?relfile=. !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Web Gateway accesslog LFI + PHP injection CVE-2012-0297/0299.""" from kittysploit import from...

TerraMaster TOS - GetTest.php RCE Detection (CVE-2017-9328)

Detects CVE-2017-9328 by injecting a PHP webshell write via /include/ajax/GetTest.php and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS GetTest.php unauthenticated RCE CVE-2017-9328.""" import re from kittysploit import from lib.protocols.http.httpclient import...

AWStats Totals - sort Parameter RCE (CVE-2008-3922)

Exploits CVE-2008-3922 by injecting PHP into the sort parameter of awstatstotals.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats Totals sort parameter RCE CVE-2008-3922.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

PHP File Manager - Backdoor Login Detection

Detects PHP File Manager backdoor account DONOTREMOVETHISENTRY / travan44 via multipart login. !/usr/bin/env python3 -- coding: utf-8 -- """PHP File Manager hardcoded backdoor credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHP Utility Belt - ajax.php RCE Detection

Detects PHP Utility Belt RCE by writing info.php via ajax.php code= parameter and verifying phpinfo output. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Utility Belt ajax.php code execution.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...