CVE-2026-48907

CVE-2026-48907 CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems Also if...

CVE-2025-45955

CVE-2025-45955 Server-Side Request Forgery in DonWeb Ferozo CVE-2025-45955 Description An attacker can exploit this vulnerability by uploading and executing a specially crafted PHP file on the Ferozo hosting platform. When accessed, the file launches a series of SSRF attempts targeting internal...

exploit-CVE-2020-5844

Exploit for CVE-2020-5844 Pandora FMS v7.0NG.742 - Remote Code Execution Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description...

CVE-2020-5844

CVE-2020-5844 Authenticated RCE in PandoraFMS 7.0-NG 742 Admin privileged attackers can upload malicious PHP documents. By decoding the base64 file location users can gain a shell as apache user. Discovered by TheCyberGeek PoC python script root@kitploit: Usage: python3 CVE-2020-5844.py URL USER...

CVE-2023-4220

Chamilo LMS Unauthenticated Remote Code Execution Exploit CVE-2023-4220 Overview This repository contains a Bash script that exploits an unauthenticated remote code execution RCE vulnerability in Chamilo LMS via arbitrary file write. The vulnerability is identified as CVE-2023-4220. This exploit...

MSAPer

MSAPer | CVE-2023-3076 - MStore API Automatic Mass Tool for check and exploiting vulnerability in CVE-2023-3076 - MStore API install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use Make sure you already install Parallel! Then do: git clone...

HTB_Nibbles

HTBNibbles In questo repository troverai il report tecnico di Nibbles, l'exploit pwned.py per abusare della CVE-2015-6967 e uno strumento autopwn autopwn.py nel caso tu voglia risolvere la macchina in HackTheBox. Strumento Pwned.py: Questo file ti aiuterà a sfruttare la CVE-2015-6967. Se vuoi...

CVE-2025-24801

CVE-2025-24801 PoC per RCE su GLPI Questo repository contiene uno script proof-of-concept poc.py che sfrutta CVE-2025-24801, una vulnerabilità LFI-to-RCE in GLPI 10.0.17. Automatizza: Accesso a GLPI Abilitazione del caricamento di file .php aggiornando le impostazioni dei tipi di documento...

CVE-2026-48908-by-yora

🔐 CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder — Unauthenticated File Upload / Potential RCE Developed byyora 📌 About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...

tinyfilemanager-2.4.3-exploit

CVE-2021-45010 Tiny File Manager-2.4.3 эксплойт Уязвимость обхода пути Path Traversal в функциональности загрузки файлов в tinyfilemanager.php в Tiny File Manager Project's Tiny File Manager = 2.4.6 позволяет удалённым злоумышленникам с действительными учётными записями пользователей загружать...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e Questo modulo richiede Metasploit: https://metasploit.com/download Sorgente corrente: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q This exploit requires Metasploit to have a FQDN an...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Caricamento Arbitrario di File Autenticato Amministratore+ tramite il Parametro 'mdjmemailuploadfile' Il plugin WordPress MDJM Event Management versione 1.7.8.3 e precedenti contiene una vulnerabilità di caricamento arbitrario di file che consente agli...

tpadmin-CVE-2026-2113-poc

tpadmin-CVE-2026-2113-poc Una prova di concetto che sfrutta un'esecuzione remota di codice con privilegi del server web tramite caricamento arbitrario di file. Descrizione della vulnerabilità Esiste una vulnerabilità critica di esecuzione remota di codice nel componente di anteprima WebUploader d...

CVE-2026-1357

CVE-2026-1357 -- WPvivid RCE Esecuzione remota di codice RCE non autenticata in WPvivid Backup & Migration 800%2C000-brightgreen?style=for-the-badge" alt="Installs" Grave vulnerabilità che impatta oltre 800.000–900.000+ siti WordPress Upload PHP arbitrario non autenticato → compromissione totale...

CVE-2026-48907

CVE-2026-48907 – Joomla JCE Nicht authentifizierte Remote-Codeausführung RCE Schweregrad: Kritisch CVSS 9.8 / CVSS v4 10.0 CVE: CVE-2026-48907 CWE: CWE-284 – Unzureichende Zugriffskontrolle Betroffene Software: Joomla Content Editor JCE-Erweiterung für Joomla Status: Öffentlich offengelegt und...

CVE-2023-24249-Exploit

CVE-2023-24249 Script di Exploit Descrizione Questo repository contiene uno script di exploit per CVE-2023-24249, una vulnerabilità critica trovata in laravel-admin versione 1.8.19. Questa vulnerabilità consente il caricamento arbitrario di file, permettendo agli attaccanti di eseguire codice...

CVE-2020-24186

CVE-2020-24186 Dieses Skript nutzt die Schwachstelle CVE-2020-24186 in WordPress aus, um eine getarnte PHP-Nutzlast hochzuladen und eine Shell auf dem Zielsystem zu erhalten. Es gibt drei Betriebsmodi: 1. Interaktive Shell: Lädt die Basis-Webshell hoch und wechselt in einen interaktiven Modus, in...

Python-CVE-2020-25213

Python-CVE-2020-25213 Python Interactive Exploit für die WP File Manager Schwachstelle. Das File Manager wp-file-manager Plugin vor Version 6.9 für WordPress ermöglicht es entfernten Angreifern, willkürlichen PHP-Code hochzuladen und auszuführen, da es eine unsichere Beispiel-Connector-Datei von...

juniper-rce_cve-2023-36844

CVE-2023-36844 , CVE-2023-36845 , CVE-2023-36846 , CVE-2023-36847 Ein Proof of Concept für die Verkettung der CVEs CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847, entwickelt von @watchTowr, um Remote Code Execution in Juniper JunOS auf SRX- und EX-Serie-Produkten zu erreichen...

cve-2025-0364

CVE-2025-0364: Bypass de Registro de Conta do BigAntSoft BigAnt Server para RCE via Upload de Arquivo O BigAntSoft BigAnt Server, que fornece um servidor de chat on-premises hospedado em Windows focado em casos de uso empresarial, é vulnerável a execução remota de código não autenticada por meio ...