CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro - Cross-Site Scripting stockée non authentifiée Utilisation rapide python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Notes d'exploitation Severity: CRITICAL CVSS: 9.8 Impact: Confidentialité, Intégrité, Disponibilité Published:...

By-Poloss..-..CVE-2017-20251

CVE-2017-20251: Внедрение PHP-кода в плагин Insert PHP Название уязвимости Неаутентифицированное внедрение PHP-кода через обработку шорткодов в плагине Insert PHP Основная информация Поле| Значение ---|--- CVE ID| CVE-2017-20251 Плагин| Insert PHP ныне Woody Code Snippets Затронутые версии| 3.3.1...

CVE-2025-56399

CVE-2025-56399 – Exécution de code à distance authentifiée dans laravel-file-manager v3.3.1 🧭 Aperçu Une vulnérabilité d'exécution de code à distance RCE authentifiée dans laravel-file-manager v3.3.1 et versions antérieures permet aux attaquants ayant accès à l'interface du gestionnaire de fichie...

CVE-2023-27372

Exploit CVE-2023-27372 Exploit pour CVE-2023-27372 , une vulnérabilité d'exécution de code à distance sans authentification dans le CMS SPIP affectant les versions antérieures à 4.2.1. ⚠️ À des fins éducatives uniquement. Utilisez exclusivement sur des systèmes vous appartenant ou pour lesquels...

cve-2026-67363-67364

Balbooa Forms пред-авторизационный RCE + подмена платежей CVE-2026-67364 / CVE-2026-67363 PoC и шаблоны обнаружения для двух пред-авторизационных уязвимостей в Balbooa Forms combaforms для Joomla, исправленных в 2.4.3.2. CVE-2026-67364 — Пред-авторизационная инъекция PHP-кода - RCE CVSS 9.8...

CVE-2023-46818

CVE-2023-46818 - Выполнение PHP-кода в ISPConfig | Эксплойт Высокое удалённое выполнение кода в ISPConfig Реализация PoC. Краткое описание Версии ISPConfig /admin/languageedit.php — Уязвимая конечная точка ISPConfig 🚀 Запуск эксплойта Запустите скрипт эксплойта CVE-2024-47533.py. python3...

POC-exploit-for-Dolibarr

Exploit POC pour Dolibarr example: python3 exploit.py http://example.com login password 127.0.0.1 9001 ---Reverse Shell Exploit for Dolibarr = 17.0.0 CVE-2023-30253--- positional arguments: hostname Target hostname username Username of Dolibarr ERP/CRM password Password of Dolibarr ERP/CRM lhost...

CVE-2024-7094

CVE-2024-7094 CVE-2024-7094 Vérificateur de vulnérabilité Type de vulnérabilité : PHP Code Injection...

CVE-2024-25600

Exploit de CVE-2024-25600 - WordPress Bricks Builder Ejecución Remota de Código RCE Un script de exploit para CVE-2024-25600 , una vulnerabilidad crítica de Ejecución Remota de Código RCE sin autenticación en el plugin Bricks Builder para WordPress. Esta herramienta detecta la falla, extrae el...

CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/id/import accepts a DataObject field name that is emitted without an identifier allowlist b...

WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability

Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...

CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-67364

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...

EUVD-2026-62397

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...

CVE-2026-67364

Balbooa Forms for Joomla (versions

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...

PT-2026-78353

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An unauthenticated attacker can perform PHP code injection due to the use of the eval function in the optional custom-PHP post-submission handler. The URL parameter = X shortcode is replaced...

CVE-2026-67364: Improper Control of Generation of Code

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...