cve-2018-7600-drupalgeddon2-lab

CVE-2018-7600 Drupalgeddon2 Vulnerability Lab Educational lab demonstrating exploitation of CVE-2018-7600 Drupalgeddon2 using a vulnerable Drupal 7.56 environment deployed with Docker. This project simulates a real-world vulnerability assessment workflow, including: Vulnerable environment setup...

GHSA-JM85-8CPP-9CJC AdminNeo: version-cache array injection causes persistent denial of service

Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which PHP converts ...

AdminNeo: version-cache array injection causes persistent denial of service

Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which PHP converts ...

CVE-2026-59978 AdminNeo: version-cache array injection causes persistent denial of service

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF or parameter-type validation. A version parameter becomes a PHP array that bootstrap.inc.php serializes into the shared...

CVE-2026-59978 AdminNeo: version-cache array injection causes persistent denial of service

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF or parameter-type validation. A version parameter becomes a PHP array that bootstrap.inc.php serializes into the shared...

CVE-2026-59978

AdminNeo , a PHP-based database management tool, is vulnerable to a Denial of Service (DoS) via an array injection in the ?script=version endpoint. In versions 4.6.2 through 5.5.0 , the application fails to validate the request origin, CSRF tokens, or parameter types. An unauthenticated attacker ...

EUVD-2026-114329

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF or parameter-type validation. A version parameter becomes a PHP array that bootstrap.inc.php serializes into the shared...

CVE-2026-110799 Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been...

CVE-2026-110799 Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been...

CVE-2026-110799

The Vvveb CMS (versions prior to 1.0.8.7 ) is vulnerable to an Authentication Bypass within its password reset functionality. The root cause is insufficient validation of the user and token GET parameters, which can be exploited via PHP Array Injection . This vulnerability can lead to a full Acco...

CVE-2025-30144

Summary The fast-jwt library does not properly validate the iss claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential...

Exploit for CVE-2026-114509

CVE-2026-114509 — Laravel TokenGuard Authentication Bypass...

Exploit for Improper Input Validation in Drupal

Drupalgeddon 2 CVE-2018-7600 Vulhub's...

Drupal Drupalgeddon2 RCE (CVE-2018-7600)

Exploits CVE-2018-7600 in Drupal 7/8 via form API render array injection on /user/register mailpostrender=passthru for unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Drupalgeddon2 RCE CVE-2018-7600.""" import re from kittysploit import from lib.protocols.http.httpclient...

EUVD-2026-75628

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Summary Adminer v5.4.1 has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which P...

GHSA-Q4F2-39GR-45JH Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Summary Adminer v5.4.1 has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which P...

CVE-2026-25892 Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from a...

CVE-2026-25892 Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from a...

CVE-2026-25892 Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from a...