CVE-2021-24307-all-in-one-seo-pack-admin-rce

Admin PHP unserialization RCE in All in one SEO pack CVE-2021-24307 Simple PoC of an admin authenticated RCE in AISEO = 4.1.0.1 provided as an example. Full write-up here: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Usage: php exploit.php u...

CVE-2026-36340

CVE-2026-36340 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 Remote Code Execution RCE Vulnerability in Krayin CRM v2.1.5 CVE: CVE-2026-36340 Severity: Critical Affected Product: Krayin CRM v2.1.5 Vulnerability Type: Remote Code Execution RCE Authentication Required: Yes Summary A...

CVE-2026-2058-PoC

CVE-2026-2058-PoC – CloudClassroom PHP Project SQL Injection Overview A SQL Injection vulnerability exists in the Post Query functionality of the CloudClassroom PHP Project v1.0. The vulnerability allows attackers to inject arbitrary SQL commands via the squeryx POST parameter, leading to databas...

CVE-2026-29861

CVE-2026-29861 🛡️ CVE Disclosure: CVE-2026-29861 — SQL Injection in PHP-MYSQL-User-Login-System Disclosure Date: 10 April 2026 CVE ID: CVE-2026-29861 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in PHP-MYSQL-User-Login-System v1.0, specifically within the...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – Authenticated Remote Code Execution in Custom Block Builder – Lazy Blocks ≤ 4.2.0 Researcher : ZeYrOXxx Plugin : Custom Block Builder – Lazy Blocks Affected Versions : ≤ 4.2.0 Severity : High CVSS : 8.8 Vulnerability Type : Authenticated Remote Code Execution RCE Attack Vector :...

CVE-2023-46474

PMB =7.5.3 - Remote Code Execution via Unrestricted File Upload CVE-2023-46474 CVSS v3.1 Vector| CVSS v3.1 Score ---|--- AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H| 9.1 Discovered during a penetration test by Marcus Reynaud of Devensys Cybersecurity Description The script pmb/admin/convert/startimport.p...

CVE-2026-7229-SQLI

Authenticated SQL Injection in Coaching Management System Allows Database Dump Description A SQL Injection vulnerability exists in the Coaching Management System in PHP. The complaintreply parameter in the admin reply functionality is not properly sanitized before being used in SQL queries. An...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: SQL Injection CWE: CWE-89 Affected Endpoint: /admin/jobs-admins/delete-jobs.php Parameter: id GET Impact: Allows deletion of all job records in th...

CVE-2026-6201-IDOR

Broken Access Control in CodeAstro Online Job Portal Allows Arbitrary Job Deletion Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: Broken Access Control IDOR CWE: CWE-639 Affected File: /jobs/job-delete.php Parameter: id GET Impact: An...

CVE-2026-6183-SQLI

SQL Injection via id Parameter in index.php - Simple Content Management System in PHP Description A SQL Injection vulnerability exists in Simple Content Management System PHP. The id parameter in index.php is not sanitized before being passed to the SQL query, allowing an unauthenticated attacker...

CVE-2023-48858

CVE-2023-48858 PoC for CVE-2023-48858 A Cross-site scripting XSS vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part. Proof of Concept:...

CVE-2026-37637

CVE-2026-37637 Proof of Concept for CVE-2026-37637 - Remote Code Execution in Alexantr filemanager v1.0 via unrestricted file upload in filemanager.php. Overview CVE-2026-37637 is a Remote Code Execution vulnerability affecting Alexantr filemanager v1.0. The vulnerability exists in the...

CVE-2025-60736

CVE-2025-60736: SQL Injection Vulnerability in Online Medicine Guide Executive Summary This document outlines a critical SQL injection vulnerability discovered in the Online Medicine Guide web application. The vulnerability allows unauthorized database access and poses significant security risks ...

Polkit-CVE-2021-4034-HLP

Polkit-CVE-2021-4034-HLP Polkit CVE-2021-4034 exploitation in High-Level Programming Language Build make LHOST=ip.or.domain.tld LPORT=8000 Usage Open TCP port listener, example with ncat on loopback ncat -vl 127.0.0.1 8000 Run exploit php $ARCHexploit.php python $ARCHexploit.py...

CVE-2026-7222-XSS

Cross-Site Scripting XSS Almacenado en el Sistema de Gestión de Coaching Permite la Toma de Control de la Cuenta Producto Sistema de Gestión de Coaching en PHP Code-Projects.org https://code-projects.org/coaching-management-system-in-php-with-source-code/ Componentes Afectados...

exploit_cms_fuel

Fuel CMS 1.4.1 - Exploit de Ejecución Remota de Código RCE Este repositorio contiene una implementación en Python 3 de un exploit para Fuel CMS versión 1.4.1. El script aprovecha CVE-2018-16763 , una vulnerabilidad donde la validación insuficiente de entrada en los parámetros filter y preview...

CVE-2019-11043

CVE-2019–11043: Vulnerabilidad de ejecución remota de código en PHP-FPM Nginx Descripción de la vulnerabilidad e impacto CVE-2019–11043 es una vulnerabilidad de ejecución remota de código RCE. Afecta a PHP-FPM, que es un administrador de procesos FastCGI comúnmente utilizado con servidores web...

CVE-2024-4577

lol CVE-2024-4577 1. exploit command RCE value python3 cek.py --target http://target/index.php --ls --dir /path/to/directory python3 cek.py --target https://target/index.php --dir /path/to/directory python3 cek.py --target https://target/index.php --cat /path/to/directory find writable dir python...

CVE-2024-25641

CVE-2024-25641 Exploit Title: Cacti 1.2.26 - RCE Authenticated Date: 06/01/2025 Exploit Author: D3Ext Vendor Homepage: https://cacti.net/ Software Link: https://github.com/Cacti/cacti/archive/refs/tags/release/1.2.26.zip Version: 1.2.26 Tested on: Kali Linux 2024 CVE: CVE-2024-25641 Explanation...

CVE-2026-17543-PHP-Exposure-Validator

Validador de Exposición PHP CVE-2026-17543 Validador seguro del lado de la red para comprobar una posible exposición a PHP CVE-2026-17543. Este proyecto comprueba si un servidor web remoto expone una versión de PHP afectada por CVE-2026-17543 y, opcionalmente, puede realizar pruebas no destructiv...