PoC-for-CVE-2020-28948-CVE-2020-28949

POC for CVE-2020-28948 & CVE-2020-28949 The files here contain PoC for CVE-2020-28948 & CVE-2020-28949 to achieve remote exploit The server The server folder contains a simple upload server which uses the vulnerable ArchiveTar library, located in server/Archive. The server accepts a Tar archive...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell Upload Exploit Descripción: Este script de Python explota una vulnerabilidad de omisión de restricción de carga de archivos en Pluck CMS por ejemplo, versiones anteriores a la 4.7.13 para cargar un webshell PHP. Una vez cargado, el shell llamado...

CVE-2021-3129

CVE-2021-3129 Exploit RCE de Laravel Ignition Este es un script de exploit en Python para CVE-2021-3129, una vulnerabilidad de ejecución remota de código en Laravel cuando el paquete Ignition está instalado. Esta vulnerabilidad permite a un atacante ejecutar comandos arbitrarios del sistema a...

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Remote Code Execution CVSS 9.8 Critical | Unsafe File Operations → Log Poisoning → Phar Deserialization → RCE Overview Laravel Ignition -c "whoami" References NVD — CVE-2021-3129 Ignition Patch 2.5.2...

CVE-2018-19422

CVE-2018-19422 Exploit Title: File Upload Bypass to RCE Authenticated Google Dork: N/A Date: 17/05/2021 Exploit Author: Drew Alleman Based on an exploit written by: Fellipe Oliveira Vendor Homepage: https://subrion.org/ Software Link: https://github.com/intelliants/subrion Version: SubrionCMS 4.2...

CVE-2021-3129

CVE-2021-3129 生成自定义命令的phar包： php -d'phar.readonly=0' ./phpggc monolog/rce1 system "cat /etc/passwd" --phar phar -o php://output | base64 -w0 php -a 进入php命令行环境 $fp = fopen'php://output', 'w'; streamfilterappend$fp, 'convert.quoted-printable-encode'; $size = ""; fwrite$fp,...

CVE-2026-64949

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

BIT-PHP-MIN-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-PHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

CVE-2026-64949 Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64949

Pandora FMS versions 777 onwards are susceptible to a vulnerability in the File Manager module caused by an incomplete extension blacklist . This flaw allows authenticated users to upload and execute arbitrary .phar files , potentially leading to unauthorized code execution. No specific remediati...

EUVD-2026-90598

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64949 Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

BIT-LIBPHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

CVE-2026-64949: Unrestricted Upload of File with Dangerous Type

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

PT-2026-105134

phar tar number parses the octal size field of a TAR header into a uint32 t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets...

PT-2026-103767

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2026_61903)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661903 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives...

CentOS Linux 8.5 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1785936981)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1785936981 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_57574)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202657574 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives...