StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores

TL;DR: Between September 9 and September 13, 2026, we detected a coordinated campaign exploiting Magento and Adobe Commerce stores across Western Europe, North America, and the Asia-Pacific region. The activity used /paypal/transparent/response/, an endpoint tied directly to StyleSmuggler...

b4tm4n

B4TM4N PHP WEBSHELL Login Account Default Username : k4mpr3t Password : k4mpr3t Features 0 File Manager 1 Sec. Info 2 Simply Database 3 Interactive terminal 4 PHP Reverse Back Connect 5 Run PHP Code 6 Custom Toolz 7 Self Script Encryptor ! 8 Error Handler 9 Themes Self Script Encryptor Usage :...

slopShell

slopShell php webshell Since I derped, and forgot to talk about usage. Here goes. For this shell to work, you need 2 things, a victim that allows php file uploadyourself, in an educational environment and a way to send http requests to this webshell the client script is the 100% best way to...

rome-webshell

Rome WebShell A powerful and delightful PHP WebShell This is a lightweight PHP webshell , using only vanilla JavaScript and CSS, no jQuery/Bootstrap bloat. Features Fully interactive file explorer , browser directories and download files instantly Upload files directly from the browser Execute...

CVE-2021-42669

CVE-2021-42669 CVE-2021-42669 - Remote code execution via unrestricted file upload vulnerability in the Engineers online portal system. Technical description: A unrestricted file upload vulnerability exists in the Engineers Online Portal system. An attacker can leverage this vulnerability in orde...

CVE-2025-57819-RCE

FreePBX 16 — Unauthenticated SQLi to RCE Summary: This guide demonstrates how to chain two vulnerabilities in FreePBX 16 CVE-2025-57819 and CVE-2025-61678 to achieve a complete attack chain from unauthenticated access to Remote Code Execution RCE. Vulnerability / CVE Information CVE ID| Affected...

CVE-2023-41892_poc

CVE-2023-41892poc Customized this for my own use pocnoauth.py Basic PHP one-liner webshell OS command execution via ?cmd= pocauth.py Simple key-based authentication added webshell SHA-256 hash comparison method Commands can only be executed if the correct key is provided Code modification require...

cve-2022-23636-poc

CVE-2022-23626 - m1k1o's Blog Authenticated RCE Authenticated Remote Code Execution via file upload vulnerability in m1k1o's Blog v1.3 and below. Description The ajax.php?action=uploadimage endpoint does not properly validate uploaded file types, allowing an authenticated user to upload a PHP...

CVE-2026-15282

CVE-2026-15282 — Instant Appointment Mass RCE Exploit Pre-Auth filegetcontents + fileputcontents → PHP Webshell Overview CVE-2026-15282 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Instant Appointment WordPress plugin ≤ 1.2. The addservicefront AJAX action is...

CVE-2025-48827

Description: RCE for Vbullettin versions between 5.0.0 - 5.7.5 and 6.0.0 - 6.0.3 with PHP 8.1 Futures: Multi thread Read from multiple target from file Detect vbullettin websites Checks vulnerabilit, if succes upload a php webshell Detail of usage: usage: CVE-2025-48827.py -h --url URL --list LIS...

CVE-2024-54761

BigAnt Office Messenger 5.6.06 RCE via SQL Injection SQL injection vulnerability in BigAnt Messenger causes RCE vulnerability. Follow the steps to exploit. Usage: CVE-2024-54761.py -h -r RHOST -p RPORT -u USERNAME -P PASSWORD options: -h, --help show this help message and exit -r, --rhost RHOST...

CVE-2018-17553

CVE-2018-17553 CVE-2018-17553 PoC Navigate CMS version 2.8 and prior This proof of concept was put together when working on the Black Pearl box from TCM. I couldn't find anyone that put out a PoC other than just using Metasploit. As I'm avoiding Metasploit in my hacking journey to then go back an...

nano

nano Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient. Put it on watch maybe, I will continue to upload more webshells in here. Nano ?=$GETp==&&$GETf; Features 35 bytes in size Can't be detected by static code scanners Supports authentication Usage...

pinky

Uploading a webshell is almost always the next step after exploiting a web vulnerability, but services like Cloudflare and the new generation of firewalls do a really good job preventing attackers to run commands in the target via HTTP or HTTPS. On the other hand, text content filtering and...

wwwolf-php-webshell

wwwolf's PHP web shell I frequently encountered issues when using other web shells: They use new PHP syntax features not compatible with the old PHP version running on some targets. They make wrong assumption on the remote URL, breaking PHP code injection or GET parameters unexpected by the serve...

OpenSTAManager-RCE-Exploit-CVE-2026-38751

OpenSTAManager RCE Exploit CVE-2026-38751 Arbitrary File Upload leading to Remote Code Execution Full-featured proof-of-concept for CVE-2026-38751 , written in Rust. Warning: This tool is intended for authorised security testing and educational purposes only. Use it only on systems you own or hav...

SecAssignment

CVE-2020-7246 qdPM 9.1 For educational purposes only. See Reference for the details. Run $ git clone https://github.com/arafatansari/SecAssignment.git $ cd SecAssignment $ docker build -t cve-assignment:ine . $ docker run -it -p 80:80 cve-assignment:ine $ service apache2 start | service mysql sta...

CVE-2018-16763-FuelCMS-1.4.1-RCE

CVE-2018-16763 - FuelCMS = 1.4.1 RCE Exploit to trigger RCE for CVE-2018-16763 on FuelCMS = 1.4.1 and interactive shell. Features Automatically uploads a php webshell API in FuelCMS using CVE-2018-16763. Execute system commands via an API with ?action=exec. Download files from the remote system t...

Magneto-PolyShell

Magento 2 RCE Exploit - Unauthenticated File Upload to RCE ⚠️ This tool is for educational and authorized security testing only. Unauthorized use against systems you do not own is illegal. This exploit targets a critical unauthenticated remote code execution RCE vulnerability in Magento 2 Adobe...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestricted PHP File Upload via TinyMCE Description CVE-2026-38526 is a critical authenticated remote code execution vulnerability affecting Webkul Krayin CRM v2.2.x. The vulnerability exists in the TinyMCE media upload endpoint...