b4tm4n

B4TM4N PHP WEBSHELL Login Account Default Username : k4mpr3t Password : k4mpr3t Features 0 File Manager 1 Sec. Info 2 Simply Database 3 Interactive terminal 4 PHP Reverse Back Connect 5 Run PHP Code 6 Custom Toolz 7 Self Script Encryptor ! 8 Error Handler 9 Themes Self Script Encryptor Usage :...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - Unauthenticated Arbitrary File Upload CVE-2026-3891 PoC 📜 Description CVE-2026-3891 is an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin. The plugin exposes an AJAX endpoint lknpixforwoocommercec6savesettings that...

CVE-2018-16763-FuelCMS-1.4.1-RCE

CVE-2018-16763 - FuelCMS = 1.4.1 RCE Exploit to trigger RCE for CVE-2018-16763 on FuelCMS = 1.4.1 and interactive shell. Features Automatically uploads a php webshell API in FuelCMS using CVE-2018-16763. Execute system commands via an API with ?action=exec. Download files from the remote system t...

rome-webshell

Rome WebShell A powerful and delightful PHP WebShell This is a lightweight PHP webshell , using only vanilla JavaScript and CSS, no jQuery/Bootstrap bloat. Features Fully interactive file explorer , browser directories and download files instantly Upload files directly from the browser Execute...

pinky

Uploading a webshell is almost always the next step after exploiting a web vulnerability, but services like Cloudflare and the new generation of firewalls do a really good job preventing attackers to run commands in the target via HTTP or HTTPS. On the other hand, text content filtering and...

nano

nano Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient. Put it on watch maybe, I will continue to upload more webshells in here. Nano ?=$GETp==&&$GETf; Features 35 bytes in size Can't be detected by static code scanners Supports authentication Usage...

slopShell

slopShell php webshell Since I derped, and forgot to talk about usage. Here goes. For this shell to work, you need 2 things, a victim that allows php file uploadyourself, in an educational environment and a way to send http requests to this webshell the client script is the 100% best way to...

CVE-2026-15282

CVE-2026-15282 — Instant Appointment Mass RCE Exploit Pre-Auth filegetcontents + fileputcontents → PHP Webshell Overview CVE-2026-15282 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Instant Appointment WordPress plugin ≤ 1.2. The addservicefront AJAX action is...

CVE-2024-54761

BigAnt Office Messenger 5.6.06 RCE via SQL Injection SQL injection vulnerability in BigAnt Messenger causes RCE vulnerability. Follow the steps to exploit. Usage: CVE-2024-54761.py -h -r RHOST -p RPORT -u USERNAME -P PASSWORD options: -h, --help show this help message and exit -r, --rhost RHOST...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell Upload Exploit Description: This Python script exploits a file upload restriction bypass vulnerability in Pluck CMS e.g., versions prior to 4.7.13 to upload a PHP webshell. Once uploaded, the shell named "shell.phar" can be used to execute commands on the...

OpenSTAManager-RCE-Exploit-CVE-2026-38751

OpenSTAManager RCE Exploit CVE-2026-38751 Arbitrary File Upload leading to Remote Code Execution Full-featured proof-of-concept for CVE-2026-38751 , written in Rust. Warning: This tool is intended for authorised security testing and educational purposes only. Use it only on systems you own or hav...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestricted PHP File Upload via TinyMCE Description CVE-2026-38526 is a critical authenticated remote code execution vulnerability affecting Webkul Krayin CRM v2.2.x. The vulnerability exists in the TinyMCE media upload endpoint...

CVE-2023-38836

CVE-2023-38836 Exploit File Upload vulnerability in BoidCMS v.2.0.0 allows an authenticated attacker to upload a file with dangerous type CWE-434. To exploit, an attacker could add a GIF header to bypass MIME type checks. GIF89a; Usage usage: CVE-2023-38836.py -h -u URL -U USER -P PASSWD -l LHOST...

SecAssignment

CVE-2020-7246 qdPM 9.1 For educational purposes only. See Reference for the details. Run $ git clone https://github.com/arafatansari/SecAssignment.git $ cd SecAssignment $ docker build -t cve-assignment:ine . $ docker run -it -p 80:80 cve-assignment:ine $ service apache2 start | service mysql sta...

CVE-2023-41892_poc

CVE-2023-41892poc Customized this for my own use pocnoauth.py Basic PHP one-liner webshell OS command execution via ?cmd= pocauth.py Simple key-based authentication added webshell SHA-256 hash comparison method Commands can only be executed if the correct key is provided Code modification require...

CVE-2021-42669

CVE-2021-42669 CVE-2021-42669 - Remote code execution via unrestricted file upload vulnerability in the Engineers online portal system. Technical description: A unrestricted file upload vulnerability exists in the Engineers Online Portal system. An attacker can leverage this vulnerability in orde...

WG-CVE-2026-1555-Linux

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ ██║ ╚██╗ ██╔╝██╔══╝ ██╔═══╝ ████╔╝██║██╔═══╝ ██╔═══██╗ ╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗╚██████╔╝ ╚═════╝ ╚═══╝...

CVE-2018-17553

CVE-2018-17553 CVE-2018-17553 PoC Navigate CMS version 2.8 and prior This proof of concept was put together when working on the Black Pearl box from TCM. I couldn't find anyone that put out a PoC other than just using Metasploit. As I'm avoiding Metasploit in my hacking journey to then go back an...

CVE-2025-48827

Description: RCE for Vbullettin versions between 5.0.0 - 5.7.5 and 6.0.0 - 6.0.3 with PHP 8.1 Futures: Multi thread Read from multiple target from file Detect vbullettin websites Checks vulnerabilit, if succes upload a php webshell Detail of usage: usage: CVE-2025-48827.py -h --url URL --list LIS...

b4tm4n

B4TM4N PHP WEBSHELL Account di Accesso Predefinito Username : k4mpr3t Password : k4mpr3t Funzionalità 0 File Manager 1 Sec. Info 2 Simply Database 3 Interactive terminal 4 PHP Reverse Back Connect 5 Run PHP Code 6 Custom Toolz 7 Self Script Encryptor ! 8 Error Handler 9 Themes Criptatore Automati...