CVE-2025-49113-Roundcube-RCE

CVE-2025-49113 — PHP 객체 역직렬화를 통한 Roundcube 인증 후 RCE 개요 필드| 세부 정보 ---|--- CVE| CVE-2025-49113 소프트웨어| Roundcube Webmail 영향받는 버전| ≤ 1.6.10 취약점| PHP 객체 역직렬화 → RCE 인증| 필요 모든 유효한 사용자 영향| 서버에서의 원격 코드 실행 발견 경위| HackTheBox CTF 중 발견됨 설명 Roundcube Webmail 1.6.10 이하 버전은 인증 후 원격 코드 실행RCE에 취약합니다. 파일 업로드 핸들러는...

EUVD-2026-88009

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely...

CVE-2026-100875 mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely...

CVE-2026-100875 mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely...

CVE-2026-100875

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be ). The flaw is located in an unknown function within the updatedetailsfromfaculty.php file, where improper handling of the myfid argument allows for remote ex...

CVE-2026-100874

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The flaw affects an unknown function within the addnewstudent.php file, potentially allowing for remote attacks. The vulnerability description confirms that...

EUVD-2026-88008

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-100874 mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-100874 mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been published and may be...

CVE-2026-100873 mathurvishal CloudClassroom-PHP-Project cross-site request forgery

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-100873 mathurvishal CloudClassroom-PHP-Project cross-site request forgery

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-100873

A cross-site request forgery (CSRF) vulnerability was identified in the mathurvishal CloudClassroom-PHP-Project (specifically in versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be ). The vulnerability exists within an unknown function , allowing for remote attacks. The documents indicate tha...

EUVD-2026-88006

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

php_filter_chain_oracle_poc

phpfilterchainoraclepoc 概要 Synacktiv チームは、詳細な研究記事 PHP Filter Chains: File Read from Error-Based Oracle を公開しました。この研究は DownUnder CTF 2022 で初めて公開され、@hashkitten によるチャレンジに基づいています。このチャレンジでは、参加者は エラーベースのオラクル を使用して、脆弱な PHP ベースのインフラから /flag ファイルを漏洩するよう求められました。 深い技術的内部（PoC のコメントで確認可能）に踏み込む代わりに、このガイドでは...

PHP-binary-bugs

Exploits AI POP Builder のアドバイザリ PHP バイナリバグのアドバイザリ集 unserialize における未修正の GMP 型混乱 アイデア: 遅延 wakeup をバイパスし、PHP = 5.6.40 の未修正の GMP 型混乱バグを悪用する POC ソース: GMPtypeconfPOC.php アドバイザリ CVE-2022-31626 の解析 アイデア: mysqlnd のヒープバッファオーバーフロー、PHP = 7.4.29 POC ソース: ./cve202231626remoteexploit/exploitpoc.py アドバイザリ 連絡先...

Roundcube_CVE-2025-49113

RCE in Roundcube CVE-2025-49113 - 내 Obsidian 노트 .md date time Status: 완료 Lab: 쉬움 태그: RCE | PHP | LABTHM | EXPLOIT | CVE by KRPT Paulo G. Werneck - Linkedin - in.com/pgw-script 영향 : 로그인 후 원격 명령 실행 CVSS 9.9 영향받는 버전 : ≤ 1.5.10 / 1.6.10 패치됨 : 1.5.11 및 1.6.11 1 – 타임라인 날짜| 이벤트 ---|--- 2014|...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl 패널 RCE 익스플로잇 HTB 시즌 10 - Pterodactyl 머신 Writeup 개요 대상: Pterodactyl HTB 머신 중간 난이도 CVE: CVE-2025-49132 심각도: 치명적 CVSS 9.8 공격 유형: 인증되지 않은 원격 코드 실행 영향받는 버전: Pterodactyl Panel 원격 코드 실행 방법: 제공된 exploit.sh 사용 chmod +x exploit.sh Get user flag ./exploit.sh flag Execute command...

CVE-2021-29447

CVE-2021-29447 PoC 이 저장소는 PHP 8을 사용하는 WordPress 5.6 및 5.7 에 영향을 미치는 CVE-2021-29447 취약점에 대한 개념 증명PoC 익스플로잇을 포함합니다. 이 익스플로잇은 파일 업로드 권한이 있는 공격자가 미디어 라이브러리의 XML 파싱 취약점을 악용하여 XXEXML External Entity 공격을 수행하고, 결과적으로 대상 환경에서 로컬 파일을 외부로 유출할 수 있음을 보여줍니다. ⚠️ 면책 조항 이 프로젝트는 교육, 연구 및 승인된 보안 테스트 목적으로만 제공됩니다. 소유하...

CVE-2023-4220

Chamilo LMS 인증되지 않은 원격 코드 실행 익스플로잇 CVE-2023-4220 개요 이 저장소는 Chamilo LMS의 인증되지 않은 원격 코드 실행RCE 취약점을 임의 파일 쓰기를 통해 익스플로잇하는 Bash 스크립트를 포함합니다. 해당 취약점은 CVE-2023-4220으로 식별됩니다. 이 익스플로잇은 악성 PHP 파일을 업로드하여 공격자가 대상 서버에서 임의의 명령을 실행할 수 있도록 합니다. 전제 조건 취약한 Chamilo LMS 인스턴스. 리버스 셸을 수신할 리스너 예: Netcat 사용. 익스플로잇 세부 사항...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP オブジェクトインジェクション PoC Cotonti の CommentsWidget 実装で確認された PHP オブジェクトインジェクション問題に対する安全なローカル概念実証です。 脆弱性 プロジェクト: Cotonti 影響を受けるコンポーネント: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — 信頼できないデータのデシリアライズ CVE/候補: CAN-2026-2035973 / CVE-2026-71294 研究者: Harsh Raj Singhania...