CVE-2023-49103

CVE-2023-49103 PoC for the CVE-2023-49103 Overview This Python script is designed to efficiently process a large list of URLs to check for the presence of phpinfo output. It uses multi-threading to handle a large number of URLs concurrently, significantly speeding up the process. The script also...

Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting

The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. id: CVE-2017-18496 info: name: Htaccess by BestWebSoft 1.7.6 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. impact: |...

svn-extractor

Svn-Extractor 很多时候，Web 应用渗透测试人员会遇到 .svn 文件夹。对于那些不了解的人来说，.svn 文件夹是 SVN 版本控制系统用于执行其操作的。对于黑盒渗透测试，该文件夹包含大量信息。其中一些关键的帮助领域包括： 1. 发现隐藏的文件和文件夹名称 2. 访问文件的源代码。 3. 即使 htaccess 中设置了限制，也能下载文件。 如何实现这一点。 1. 发现隐藏的文件和文件夹名称 根据所使用的 SVN 版本，有两种方法可以实现这一点。 对于 1.6 版本，我们有 .svn/wc.db，其中包含类似的数据，但采用 sqlite3 格式。 这些文件可以通过 URL...

CVE-2023-47400

CVE-2023-47400 CVE-2023-47400 的概念验证 通过任意文件写入在 Nagios XI 5.11.0 上实现已认证的 PHP 远程代码执行 !Note 此 PoC 基于 NCC 集团发布的技术公告 https://research.nccgroup.com/2023/12/13/technical-advisory-multiple-vulnerabilities-in-nagios-xi/ 此 PoC 遵循以下过程： 上传一个名为 placeholder.jpg 的有效图像（仅包含 JFIF 魔数头部，无内容） 使用自定义包含的 重命名 功能将图像重命名为...

CVE-2018-19422-SubrionCMS-RCE

CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 Authenticated Remote Code Execution /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Exploit Usage Commands: Windows/Linux: $ sudo python3...

htshells

HTSHELLS - Web shells autocontenidos y otros ataques mediante archivos .htaccess. Los ataques se nombran de la siguiente manera: module.attack.htaccess y se agrupan por tipo de ataque en directorios. Elige el que necesites y cópialo a un archivo nuevo llamado .htaccess; revisa el archivo para ver...

htshells

HTSHELLS - Self contained web shells and other attacks via .htaccess files. Attacks are named in the following fashion, module.attack.htaccess and grouped by attack type in directories. Pick the one you need and copy it to a new file named .htaccess, check the file to see if it needs editing befo...

CVE-2018-11736

CVE-2018-11736 PHP 远程代码执行漏洞利用 Pluck CMS 免责声明 ⚠️：本漏洞利用代码主要作为编程入门练习用 Rust 编写，请谅解其中可能缺乏技术严谨性或非惯用的代码模式。此外，此漏洞并非本人发现，编写利用代码时参考了官方报告。 针对影响 Pluck CMS 4.7.7-dev2 之前版本的 CVE-2018-11736 的 PoC 利用代码。漏洞位于 /data/inc/images.php，允许攻击者上传任意文件。通过上传伪装成 image/jpeg MIME 类型的恶意 .htaccess 文件，可迫使 Web 服务器将 .jpg 文件解释为 PHP...

CVE-2017-9798

检查 CVE-2017-9798 此小型脚本用于检查共享主机环境是否存在 CVE-2017-9798 漏洞，若发现存在风险的 .htaccess 文件，则以返回码 1 退出。 使用示例 root@kitploit: python check.py --path /var/customers/webs/...

CVE-2025-67887

🛡️ Fix for the "vulnerability" CVE-2025-67887/86 in the 1C-Bitrix Translate module 1C-Bitrix Security The Information Security and Incident Monitoring Center of 1C-Bitrix informs Information appeared in Telegram channels about a vulnerability in the "Translate" module allegedly allowing...

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM command 示例: ./poc.sh http://192.168.5.16:8090 admin admin id...

CVE-2026-10821

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

EUVD-2026-70033

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821

Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2017-9798

CVE-2017-9798 This small script checks a shared hosting environment for CVE-2017-9798 and exits with a return code of 1 if a vulnerable .htaccess file has been found...

Astra Linux – Vulnerability in Apache2

A vulnerability in the Apache HTTP Server’s AllowOverride FileInfo directive allows for bypassing moduserdir+suexec. Users who have access to use the RequestHeader directive in htaccess can cause certain CGI scripts to run under an unexpected userid. This issue affects the Apache HTTP Server...

WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability

Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...

GHSA-VWG3-W8W3-PC79 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...