htshells

HTSHELLS - Self contained web shells and other attacks via .htaccess files. Attacks are named in the following fashion, module.attack.htaccess and grouped by attack type in directories. Pick the one you need and copy it to a new file named .htaccess, check the file to see if it needs editing befo...

svn-extractor

Svn-Extractor Many a times web application pen-testers are encountered with the presence of .svn folders. For those not aware .svn folder is used by SVN version control system to perform its operations. For a blackbox pentest this folder contains huge amount of information. Some of the key areas...

Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting

The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. id: CVE-2017-18496 info: name: Htaccess by BestWebSoft 1.7.6 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. impact: |...

CVE-2023-49103

CVE-2023-49103 PoC for the CVE-2023-49103 Overview This Python script is designed to efficiently process a large list of URLs to check for the presence of phpinfo output. It uses multi-threading to handle a large number of URLs concurrently, significantly speeding up the process. The script also...

CVE-2018-19422-SubrionCMS-RCE

CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 Authenticated Remote Code Execution /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Exploit Usage Commands: Windows/Linux: $ sudo python3...

htshells

HTSHELLS - 通过 .htaccess 文件实现的自包含 Web Shell 及其他攻击。 攻击的命名方式为 module.attack.htaccess，并按攻击类型分组存放在目录中。选择你需要的攻击，将其复制到一个新文件并命名为 .htaccess，检查文件以确认在上传前是否需要编辑。除非文件另有说明，Web Shell 通过查询参数 c 执行命令。 要准备攻击，运行 ./prepare.sh file 生成待上传的 .htaccess 文件。示例： root@kitploit: $ ./prepare.sh shell/modphp.shell.htaccess ┬...

CVE-2023-47400

CVE-2023-47400 Proof of Concept for the CVE-2023-47400 Authenticated PHP Remote Code Execution via Arbitrary file write on Nagios XI 5.11.0 !Note This poc is based on the technical advisory published by NCC group...

CVE-2018-11736

CVE-2018-11736 PHP RCE Exploit Pluck CMS Disclaimer ⚠️: This exploit was developed in Rust primarily as an introductory programming learning exercise. Please excuse any lack of technical rigor or non-idiomatic code patterns. Also, this is not my discovery; I relied on official reports to write thi...

CVE-2017-9798

CVE-2017-9798 This small script checks a shared hosting environment for CVE-2017-9798 and exits with a return code of 1 if a vulnerable .htaccess file has been found...

CVE-2025-67887

🛡️ Fix for the "vulnerability" CVE-2025-67887/86 in the 1C-Bitrix Translate module 1C-Bitrix Security The Information Security and Incident Monitoring Center of 1C-Bitrix informs Information appeared in Telegram channels about a vulnerability in the "Translate" module allegedly allowing...

CVE-2017-9798

Check for CVE-2017-9798 This small script checks a shared hosting environment for CVE-2017-9798 and exits with a return code of 1 if a vulnerable .htaccess file has been found. Example usage root@kitploit: python check.py --path /var/customers/webs/...

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM = 9.3.3 CVE-2026-33656 — Authenticated RCE via Formula ACL Bypass + Attachment sourceId Path Traversal + .htaccess Poisoning Author : Jiva jivasecurity.com Writeup : https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 Product : EspoCRM = 9.3.3 Auth : Admin credentials required...

CVE-2026-54611

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611

InstantCMS , a free and open-source content management system, contains a Remote Code Execution vulnerability in its component installer in versions prior to 2.18.2 . A remote authenticated attacker can upload a malicious component; although the component is not formally installed, the uploaded P...

CVE-2026-10821

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

EUVD-2026-70033

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821

Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...