Unraid 6.8.0 Auth Bypass PHP Code Execution

This module exploits two vulnerabilities affecting Unraid 6.8.0An authentication bypass is used to gain access to the administrativeinterface, and an insecure use of the extract PHP function can be abusedfor arbitrary code execution as root. from kittysploit import from...

CVE-2025-13576

A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. Multiple endpoints...

EUVD-2006-2659

Malware in sbrugna...

EUVD-2008-6701

Malware in sbrugna...

EUVD-2006-4473

Malware in sbrugna...

EUVD-2007-4764

Malware in sbrugna...

EUVD-2010-1934

Malware in sbrugna...

EUVD-2008-2048

Malware in sbrugna...

EUVD-2007-0448

Malware in sbrugna...

EUVD-2007-3774

Malware in sbrugna...

EUVD-2004-1018

Malware in sbrugna...

CVE-2025-48828: Improper Protection of Alternate Path

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "vardump""test" syntax, attackers can bypass security checks and execute...

CVE-2024-52778

DCME-320 =7.4.12.90, DCME-520 =9.25.5.11, DCME-320-L =9.3.5.26, and DCME-720 =9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/monstathist.php...

CVE-2010-5066

The createRandomPassword function in includes/functionscommon.php in Virtual War aka VWar 1.6.1 R2 uses a small range of values to select the seed argument for the PHP mtsrand function, which makes it easier for remote attackers to determine randomly generated passwords via a brute-force attack...

CVE-2019-25217

The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switchphp function called via the /switch-php REST API...

CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...

CVE-2024-42356

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the "context" variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...

PT-2024-29892

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.5.8.13 Shopware versions prior to 6.6.5.1 Description The issue concerns the context variable injected into almost any Twig Template, allowing access to current language and currency information. The context object...

CVE-2024-7222

A vulnerability, which was classified as critical, was found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /home.php. The manipulation of the argument type leads to sql injection. It is possible to launch the attack remotely. The exploit has...

GHSA-MG4X-PRH7-G4MX Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability

In Zend Framework, ZendCaptchaWord v1 and Zend\Captcha\Word v2 generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal arrayrand function. This function does not generate...