PT-2026-107767

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

PT-2026-107851

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.10 Description An unauthenticated arbitrary file upload issue exists due to insufficient validation of the attacker-controlled URL field within the temporaryFileUploads parameter during form submission. An...

CVE-2022-1329

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Ejecución remota de código Fecha: 16 de abril de 2023 Autor del exploit: Việt Hùng https://github.com/phanthibichtram12 Sitio web del proveedor: https://elementor.com/ Enlace del software: https://wordpress.org/plugins/elementor/advanced/ desplácese...

CVE-2025-66034-htb-ctf

CVE-2025-66034-htb-ctf Exploit del Generador de Fuentes Variables VariaType Este repositorio contiene un exploit especializado para la máquina VariaType de Hack The Box. El exploit aprovecha una vulnerabilidad en la forma en que la biblioteca fontTools o la aplicación web maneja archivos XML...

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Summary The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as webshell.pHp therefore bypassed the blacklist and was written to the web-accessible upload directory as...

WordPress Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion vulnerability

Authenticated Subscriber+ PHP Object Injection to Arbitrary File Deletion vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Uncanny Automator versions = 7.6.1.1...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 Validation Rule Injection CVE-2023-32692 is a code injection vulnerability in the CodeIgniter 4 PHP framework, affecting versions 4.0.0 through 4.3.4. It was fixed in 4.3.5 released June 2023. This is a demo environment for anyone that wants to play with it...

CVE-2026-95534 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Object Injection. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 2.0.19...

CVE-2026-95534

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting versions up to and including 2.0.19 , is vulnerable to a PHP Object Injection flaw. This issue stems from the deserialization of untrusted data , which could allow an attacker to execute arbitrary c...

DRUPAL-CONTRIB-2026-192

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...

CVE-2023-3519

Citrix ADC RCE CVE-2023-3519 Este exploit utiliza direcciones y shellcode para Citrix VPX 13.1-48.47. Para el artículo completo, haga clic aquí. Uso Se requiere NASM para compilar el shellcode. $ sudo apt install nasm El shellcode incluido descargará y ejecutará un script de shell desde un servid...

pocs

minervais.com.phpMyAdminRCE.sh phpMyAdmin '/scripts/setup.php' POC de Inyección de Código PHP RCE. Este fue el primer exploit lanzado públicamente para CVE-2009-1151. Sintaxis $ ./phpMyAdminRCE.sh usage: ./phpMyAdminRCE.sh i.e.: ./phpMyAdminRCE.sh http://target.tld/phpMyAdmin/ Demostración $...

CVE-2018-9206-jquery-file-upload

CVE-2018-9206 - Blueimp jQuery-File-Upload Lab Vulnerable Docker environment for CVE-2018-9206 - Unrestricted File Upload in Blueimp jQuery-File-Upload ' Execute it curl "http://localhost:8888/jQuery-File-Upload/server/php/files/test.php" Output: CVE-2018-9206-PWNED Or run the PoC script:...

-Limesurvey-RCE-CVE-2021-44967

🚀 LimeSurvey RCE CVE-2021-44967 - Ejecución Remota de Código Autenticada Este repositorio contiene un exploit funcional para CVE-2021-44967 , una vulnerabilidad de Ejecución Remota de Código autenticada en LimeSurvey. 🎯 Compatibilidad Probado y confirmado funcionando en: LimeSurvey 5.2.x LimeSurv...

CVE-2020-15568

CVE-2020-15568 Un POC rápido y sencillo para CVE-2020-15568. No probado, pero basado en la información encontrada aquí: https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/...

ChamiloLMS-CVE-2023-4220

Exploit de ChamiloLMS CVE-2023-4220 Exploit en Python para CVE-2023-4220 , una vulnerabilidad de subida arbitraria de archivos sin autenticación que afecta a Chamilo LMS = 1.11.24. La vulnerabilidad se encuentra en el componente BigUpload de Chamilo. En instalaciones vulnerables, el manejador de...

CVE-2024-43363

CVE-2024-43363 Script de explotación de CVE-2024-43363 Este script de Python está diseñado para probar si una instancia de Cacti es vulnerable a CVE-2024-43363, una vulnerabilidad de ejecución remota de código RCE causada por envenenamiento de registros log poisoning. Cómo funciona la...

WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme ColorFolio versions = 1.3...

WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Neo | Barber Shop WordPress Theme versions = 3.5...

WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme CleanSkin versions = 1.5.0...