CVE-2022-31897

CVE-2022-31897 Date: 06/22/2022 Exploit Author: Angelo Pio Amirante Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15344/zoo-management-system-phpoop-free-source-code.html Version: 1.0 Tested on: Server: XAMPP on Windows 10...

OWASPWebGoatPHP

WebGoatPHP OWASP WebGoatPHP es una adaptación de OWASP WebGoat a PHP y a bases de datos MySQL/SQLite. El objetivo es crear un entorno de enseñanza interactivo para la seguridad de las aplicaciones web, ofreciendo lecciones en forma de desafíos. En cada desafío, el usuario debe explotar la...

zentao

zentao Getshell Buscar downloadZipPackage root@kitploit: C:\Users\Jas502n\Desktop\xamppfindstr /s /i "downloadZipPackage" zentao\log.txt:module\client\control.php: $result = $this-client-downloadZipPackage$version, $link; zentao\log.txt:module\client\ext\model\xuanxuan.php:public function...

self-service-password

LDAP Tool Box Self Service Password Presentación Self Service Password es una aplicación PHP que permite a los usuarios cambiar su contraseña en un directorio LDAP. La aplicación puede utilizarse en directorios LDAPv3 estándar OpenLDAP, OpenDS, ApacheDS, Sun Oracle DSEE, Novell, etc. y también en...

exploit-CVE-2017-6090

Containerized exploitable CVE-2017-6090 This projects builds a container running PhpCollab 2.5.1, containing a remote code execution vulnerability as detailed in CVE-2017-6090. In addition, there is a docker-compse file to start that container and mysql to show the demo, and instructions to explo...

FUSE

FUSE FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload UEFU vulnerabilities. The details of the testing strategy is in our paper, "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute...

kirjuri

Kirjuri has been deprecated. I have started a new project that covers most of the use cases that Kirjuri handles and a lot more. Check out the DFIRe case management application for all your case and evidence management needs. SECURITY UPDATE 7.5.2021 As this project has been inactive for years, i...

CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015 – PHP Filter Chain Arbitrary File Read Program Code PHP root@kitploit: // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper...

CVE-2021-25790-Multiple-Stored-XSS

CVE-2021-25790-Múltiples-XSS-Almacenado: Múltiples XSS Almacenado en House Rental and Property Listing V1.0. Enlace del software: https://www.sourcecodester.com/download-code?nid=14649&title=House+Rental+and+Property+Listing+in+PHP+with+Full+Source+Code https://vulners.com/cve/CVE-2021-25790...

CVE-2026-86298 SourceCodester Class and Exam Timetabling System delete_subject.php sql injection

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /deletesubject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-86216 code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-72593 dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...

CVE-2026-10227

A vulnerability has been found in raisulislamg4 studentmanagementsystembyphp up to 310d950e09013d5133c6b9210aff9444382d16d1. The affected element is an unknown function of the file addusercheck.php of the component User Creation Handler. The manipulation of the argument role leads to sql injectio...

CVE-2026-7716

CVE-2026-7716 describes an SQL injection in the Gym Management System (code-projects) for PHP on Windows NT 1.0, via manipulation of the day parameter in /index.php. The exact vulnerable component and file are /index.php; the root cause is improper handling of user input leading to SQL injection....

📄 School Management System PHP 1.0.0 Cross Site Scripting

School Management System PHP version 1.0.0 suffers from a persistent cross site scripting vulnerability that can lead to administrative account takeover. ==================================================== School Management System PHP - Stored XSS leading to Admin Account Takeover...

CVE-2026-5537

A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function checksel of the file Apps/Index/Controller/IndexController.class.php of the component HTTP GET Parameter Handler. The manipulation of the argument seid leads to sql injection...

CVE-2026-23843

Summary: CVE-2026-23843 affects the teklifolustur_app PHP web app. An IDOR vulnerability exists in the offer view function: authenticated users can modify the offer_id to access offers owned by others due to missing authorization checks. The issue is mitigated by the patch introduced in commit dd...

CVE-2025-58947

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Athos athos allows PHP Local File Inclusion.This issue affects Athos: from n/a through = 1.9...