webvulscan

WebVulScan Synopsis WebVulScan is a web application vulnerability scanner. It is a web application itself written in PHP and can be used to test remote, or local, web applications for security vulnerabilities. As a scan is running, details of the scan are dynamically updated to the user. These...

CVE-2025-39601

🚨 CVE-2025-39601 - CSRF to RCE in WordPress Custom CSS, JS & PHP plugin WordPress Custom CSS, JS & PHP plugin CSRF PoC - WordPress Custom CSS, JS & PHP plugin By : Nxploited | Khaled Alenazi input typ...

OpenEMR_Vulnerabilities

OpenEMR Remote Code Execution Vulnerability OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious php codes. PoC git clone https://github.com/EmreOvunc/OpenEMRVulnerabilities.git cd OpenEMRVulnerabilities python3 openemrrcepoc.py -t http://127.0.0.1/openemr -u admin -p...

phpstan

PHPStan - Outil d'analyse statique PHP PHPStan se concentre sur la recherche d'erreurs dans votre code sans avoir à l'exécuter. Il détecte des classes entières de bugs avant même que vous n'écriviez des tests pour le code. Il rapproche PHP des langages compilés dans le sens où l'exactitude de...

cnext-exploits

CNEXT эксплойты Эксплойты для CNEXT CVE-2024-2961, переполнение буфера в iconv из glibc, автор @cfreal Использование $ git clone --recurse-submodules https://github.com/ambionics/cnext-exploits.git $ pip install -r requirements.txt Технический анализ Уязвимость и эксплойты описаны в следующих...

cve-2026-87902-wordpress-lfi-lab

CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress getpagetemplate 인증되지 않은 LFI → 조건부 RCE 재현 랩 + URL 목록 스캐너 + PoC, Docker 랩에서 실제 WordPress 7.1.1 취약 및 7.1.2 패치됨을 대상으로 구축 및 엔드투엔드 검증 완료. 권고문: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp 유형: CWE-98...

hostscan

hostscan 0.2 Hostscan is a php tool which allows you to scan specific range of hosts, mostly for information gathering and testing for weak passwords. I guess it's a pentest tool, i'd created it to automate some tests that i often do. Since it's PHP, it works quite slowly compared to client-side...

CVE-2024-4577-RCE

PHP CGI Argument Injection CVE-2024-4577 RCE 📜 Description In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command...

wordpress-php-object-helper

wordpress-php-object-helper About You have a Known plugin with a PHP object exploit?, but you need to determine which library to use to exploit the issue and run with phpggc. This should help you out. Example Output $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst Processing URLs:...

RCE

CVE-2022-31814 WebApp bug import argparse import requests import time import sys import urllib.parse from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning parser = argparse.ArgumentParserdescription="pfBlockerNG =...

cve-2016-1555

Description The module leverages an unauthenticated arbitrary command execution vulnerability in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0. The vulnerability occurs within how the router handles POST requests from 1...

php-app-race-condition

Vulnerable PHP App Race Condition Environment setup: docker-compose up Environment verification: Connection Test: http://localhost/test.php Vulnerable endpoint: http://localhost/poc.php Race condition exploit: echo http://localhost | nuclei -t race.yml Observe that less than 1280$ were accounted...

OpenSTAManager_RCE_Exploit-CVE-2026-38751-

OpenSTAManager RCE Exploit CVE-2026-38751 Overview This Python script exploits a Remote Code Execution vulnerability in OpenSTAManager version 2.10, identified as CVE-2026-38751. The exploit allows authenticated users to upload a malicious module and execute arbitrary commands on the target syste...

vboxdie-cracker

Craqueur de mot de passe de chiffrement d'image disque Virtual Box Prérequis 1. PHP = 5.5.0 2. OpenSSL = 1.0.1 prise en charge XTS Description de l'algorithme Le mot de passe utilisateur est stocké en utilisant une combinaison de PBKDF2 et AES-XTS comme suit les valeurs affichées sont fixes pour ...

ip-finder-cli

IPFinder CLI Interface en Ligne de Commande https://ipfinder.io/ Prend en charge une seule adresse IP, asn, plages, pare-feu comme entrée Prend en charge le traitement par lots Exporte les résultats vers l'écran ou vers un fichier de sortie Prend en charge IPv4 et IPv6 Prend en charge le numéro...

ip-finder-cli

IPFinder CLI Command Line Interface https://ipfinder.io/ Supports Single IP Address, asn, ranges, firewall as Input Supports Bulk Exports Results to Screen or to An Output File Supports IPv4 and IPv6 Supports ASN number , RANGES , Firewall Getting Started sign up for a free account at...

CVE-2025-49113-exploit

CVE-2025-49113 - Roundcube Remote Code Execution A proof-of-concept exploit for CVE-2025-49113, a remote code execution vulnerability in Roundcube Webmail. Description This exploit targets a deserialization vulnerability in Roundcube Webmail versions 1.5.0 through 1.6.10. The vulnerability allows...

CVE-2015-6967

CVE-2015-6967 python exploit.py --url http://xx.xx.xx.xx --username admin --password nibbles --payload phprevshell.php Cambiar $ip en linea 7 de phprevshell.php nc -lvnp 1234...

BlackNET

BlackNET 😈 Free advanced and modern Windows botnet with a nice and secure PHP panel developed using VB.NET. About BlackNET 🤓 Free advanced and modern Windows botnet with a nice and secure PHP panel built using VB.NET. this botnet controller comes with a lot of features and the most secure panel f...

b4tm4n

B4TM4N WEBSHELL PHP Compte de connexion par défaut Username : k4mpr3t Password : k4mpr3t Fonctionnalités 0 Gestionnaire de fichiers 1 Informations de sécurité 2 Base de données simple 3 Terminal interactif 4 Connexion inverse PHP 5 Exécuter du code PHP 6 Outils personnalisés 7 Auto-encrypteur de...