CVE-2026-112302

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been ma...

CVE-2026-112301

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...

CVE-2026-112302

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been ma...

CVE-2026-112302 kiwilan php-archive Extraction ArchiveZip.php extract path traversal

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been ma...

EUVD-2026-104607

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been ma...

CVE-2026-112301 orbitale imagemagick-php Command.php font os command injection

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...

CVE-2026-112301

A security flaw exists in orbitale imagemagick-php up to version 3.3.5 . The vulnerability is located in the Command::font function within the src/Command.php file. Improper handling of the fontFile argument allows for remote OS command injection . Public exploits for this vulnerability are avail...

EUVD-2026-104602

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...

symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony is used by thousands of web applications and most of the popular PHP projects. Installation Install Symfony with Composer see requirements details. Symfony follows the semantic versioning...

CVE-2026-22241

CVE-2026-22241 Lab Environment for CVE-2026-22241 Vulnerability Description: Vulnerability: Unrestricted Upload of File with Dangerous Type. Impact: Remote Code Execution RCE. Description: This flaw allows an attacker with administrative privileges to upload a malicious PHP file Web Shell, leadin...

phuip-fpizdam

PHuiP-FPizdaM What's this This is an exploit for a bug in php-fpm CVE-2019-11043. In certain nginx + php-fpm configurations, the bug is possible to trigger from the outside. This means that a web user may get code execution if you have vulnerable config see below. Writeup While we were too lazy t...

php-reverse-shell

php-reverse-shell...

CVE-2024-50970

CVE-2024-50970 Description A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

phpstan

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code. It moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be...

CVE-2025-48827

Description: RCE for Vbullettin versions between 5.0.0 - 5.7.5 and 6.0.0 - 6.0.3 with PHP 8.1 Futures: Multi thread Read from multiple target from file Detect vbullettin websites Checks vulnerabilit, if succes upload a php webshell Detail of usage: usage: CVE-2025-48827.py -h --url URL --list LIS...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

fuckshitup

Agenda FuckShitUp 0.1 - Multi Vulnerabilities Scanner Basically, FSU is bunch of tools written in PHP-CLI. Using build-in functions, you are able to grab url's using search engines - and so, dork for interesting files and full path disclosures. Using list of url's, scanner will look for Cross Sit...

better-poc-for-CVE-2018-15133

Better PoC for CVE-2018-15133 An automated PoC for CVE 2018-15133 All credits goes to kozmic who made the original PoC of CVE 2018-15133 This is just an automation script i made while doing some lab box having this vulnerability because i didnt want to make a new deserialized object with phpggc...

CVE-2022-1329

WP Elementor 3.6.0/1/2 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version Version: 3.6.0,...

CVE-2024-50507

CVE-2024-50507 DS.DownloadList = 1.3 - Unauthenticated PHP Object Injection Description The DS.DownloadList plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input. This makes it possible for unauthenticated...