KrayinCRM-RCE-Exploit-CVE-2026-38526

🔓 Krayin CRM v2.2.x - Authenticated Remote Code Execution Exploit ⚠️ FOR AUTHORIZED SECURITY TESTING ONLY - Unauthorized use is illegal and unethical. 📋 Overview This exploit tool demonstrates a critical authenticated remote code execution RCE vulnerability discovered in Krayin CRM version 2.2.x...

CVE-2024-4577

CVE-2024-4577: Critical Vulnerability in PHP's CGI Configurations A severe security flaw exists in PHP's CGI mode that allows attackers to run arbitrary commands by manipulating URL parameters. Impacted Versions PHP versions before 7.4.29 and 8.0.19 on Windows running php-cgi. Attack Methodology...

setup-cve-2015-8562

Joomla! RCE CVE 2015-8562 Docker compose file to setup environment for CVE 2015-8562 testing Table of Contents 1. About The Project 2. Getting Started Prerequisites Installation 3. Usage 4. Contributing 5. License About The Project This project includes a Docker compose file to setup environment...

CVE-2022-24990

CVE-2022-24990 CVE-2022-24990 Information Disclosure + RCE All-in-One This PoC writes a file to the target, here it writes phpinfo. If you need other functionality, modify it yourself. Do not use for illegal purposes...

CVE-2019-11043

CVE-2019-11043 PHP-FPM Remote Code Execution Screencast: https://youtu.be/d6benC5FVZM Overview This zero-day exploit in common PHP-FPM configurations was discovered during the Realworld CTF competition in 2019. A regular expression is used to parse the requested URI, but newline characters %0a ar...

CVE-2026-15282

CVE-2026-15282 — Instant Appointment Mass RCE Exploit Pre-Auth filegetcontents + fileputcontents → PHP Webshell Overview CVE-2026-15282 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Instant Appointment WordPress plugin ≤ 1.2. The addservicefront AJAX action is...

CVE-2026-48909-Joomla-SP-Exploit

CVE-2026-48909 Joomla SP LMS — Unauthenticated PHP Object Injection → RCE Proof-of-concept assessment tool for CVE-2026-48909 Author: Sudeepa Wanigarathna !IMPORTANT Authorized use only. This tool is for security research, education, and testing systems you own or have explicit written permission...

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 Fully automated exploit for CVE-2024-25641. When a user is authenticated, Cacti version 1.2.26 is vulnerable to an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import...

Limbas-4.3.36.1319-is-vulnerable-to-Cross-Site-Scripting-XSS-

Limbas-4.3.36.1319-is-vulnerable-to-Cross-Site-Scripting-XSS DESCRIPTION Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting XSS LIMBAS http://www.limbas.org/ - 4.3.36.1319 PROOF OF CONCEMT UPDATE/up20.php the page reflexed with the XSS code EXAMPLE PAYLOAD 1'"&% DETAILS XSS Cross-site...

CVE-2012-1823

CVE-2012-1823 - PHP CGI Argument Injection Remote Code Execution RCE Severity: Critical CVSS 9.8 CVE: CVE-2012-1823 Published: May 11, 2012 Affected Software: PHP running in CGI mode php-cgi Vulnerability Type: Argument Injection / Remote Code Execution RCE Attack Vector: Network Authentication...

Amazon Linux 2023 : composer (ALAS2023-2026-3136)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3136 advisory. Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to...

SUSE CVE-2026-91767

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

SUSE CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-48907

CVE-2026-48907 – Joomla JCE Unauthenticated Remote Code Execution RCE Severity: Critical CVSS 9.8 / CVSS v4 10.0 CVE: CVE-2026-48907 CWE: CWE-284 – Improper Access Control Affected Software: Joomla Content Editor JCE Extension for Joomla Status: Publicly disclosed and actively exploited in the...

CVE-2015-6967

CVE-2015-6967 python exploit.py --url http://xx.xx.xx.xx --username admin --password nibbles --payload phprevshell.php Cambiar $ip en linea 7 de phprevshell.php nc -lvnp 1234...

CVE-2025-22510

CVE-2025-22510 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WC Price History for Omnibus Vulnerable version To activate this plugin, the WooCommerce plugin must first be installed and activated. 2. To test the PHP Object Inj...

CVE-2025-44108-SXSS

CVE-2025-44108 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

CVE-2024-4577-PHP-RCE

CVE-2024-4577-PHP-RCE 项目简介与原理 全球首款利用PHP默认环境（XAMPP）的CVE-2024-4577 PHP-CGI RCE 漏洞 EXP。 The world's first CVE-2024-4577 PHP-CGI RCE exploit utilizing the default PHP environment. Sharing original exploit, supports SSRF, supports WAF bypass. 实现PHP默认环境RCE。原理：cgi.forceredirect + REDIRECT-STATUS。...

CVE-2020-0688

CVE-2020-0688 스캐너 CVE-2020-0688에 취약한 Exchange 서버를 확인하기 위한 조금 지저분한 스크립트입니다. 못생기게 PHP로 작성되었습니다. 주의: 이 스크립트는 실제 CU 업데이트가 설치되어 있는지만 확인합니다. 버그 수정 패치가 설치되어 있다는 의미는 아닙니다! 요구 사항 php-cli와 php-curl이 필요합니다 사용법 먼저 저장소를 클론하세요: git clone https://github.com/righter83/CVE-2020-0688 단일 서버 스캔 https:// 없이 php...

CVE-2026-71981

Cypht CVE-2026-71981 PoC CVE-2026-71981 안전하지 않은 역직렬화 RCE에 대한 PoC입니다. 실행된 명령의 결과는 로그아웃 요청에 대한 응답에서 태그 이후에 출력됩니다. 전체 응답도 출력하려면 --print-all을 사용하세요. 취약한 버전: v2.12.2 종속성 설치 및 실행 이 스크립트는 unserialize 페이로드를 생성하기 위해 설치된 https://github.com/ambionics/phpggc 가 필요합니다. 설정 및 예시: python3 -m venv .venv source...