metasploit-payloads

metasploit-payloads Status de build do Appveyor: Este é um repositório unificado para diferentes payloads do Metasploit Framework, que mescla estes repositórios: C Windows Meterpreter Java and Android Meterpreter and Payloads Python and PHP Meterpreter Um Meterpreter C multiplataforma alternativo...

CVE-2016-16113-POC

Obter RCE - Exploit do Bludit CMS | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| Uma ferramenta automatizada de exploração que combina CVE-2019-17240 Bypass de Autenticação e CVE-2019-16113 Upload Arbitrário de Arquivos para obter execução...

Exploitation-of-a-Remote-Code-Execution-vulnerability--CVE-2024-7954-

Ausnutzung einer Remote Code Execution-Schwachstelle CVE-2024-7954 Projekt zum Testen von Softwareschwachstellen Eingereicht von: Shivansh Kuntal Überblick Dieses Projekt demonstriert die Ausnutzung von CVE-2024-7954 , einer kritischen Remote Code Execution RCE-Schwachstelle, die SPIP CMS über da...

metasploit-javapayload

Este repositório foi mesclado em metasploit-payloads Observe que este repositório foi mesclado em um repositório unificado para meterpreters: https://github.com/rapid7/metasploit-payloads O histórico foi preservado, juntamente com a pré-história do metasploit-framwork:...

CVE-2026-82627

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

Invision Community <=5.0.6 Unauthenticated RCE via Template Injection

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by unauthenticated...

CVE-2026-82627

The Uncanny Automator plugin for WordPress (versions up to and including 7.6.1.1 ) is vulnerable to PHP Object Injection due to the deserialization of untrusted input. This flaw allows authenticated attackers with Subscriber-level access or higher to inject a PHP Object. The attack is feasible wh...

EUVD-2026-94658

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

CVE-2026-82627 Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

PT-2026-107767

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated...

PT-2026-107829

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including...

PT-2026-108168

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver affected versions not specified Description The BSON encoder fails to verify certain return values when a document exceeds the size limit of libbson, which can leave the encoder in an invalid state. An unauthenticated actor...

PT-2026-108167

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver affected versions not specified Description The BSON encoder converts a string length to a 32-bit value without proper validation. If an application encodes a string close to 4 GiB, the allocation size may wrap around while...

PT-2026-107989

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

PT-2026-107851

Name of the Vulnerable Software and Affected Versions Bricksforge versions prior to 3.1.8.10 Description An unauthenticated arbitrary file upload issue exists due to insufficient validation of the attacker-controlled URL field within the temporaryFileUploads parameter during form submission. An...

CVE-2022-1329

WordPress प्लगिन - Elementor 3.6.0 3.6.1 3.6.2 दूरस्थ कोड निष्पादन Ngày: 16 tháng 4 năm 2023 Khai thác Tác giả: Việt Hùng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://elementor.com/ Link phần mềm: https://wordpress.org/plugins/elementor/advanced/ kéo xuống chọn phiên b...

CVE-2025-66034-htb-ctf

CVE-2025-66034-htb-ctf VariaType Exploit für den Generator variabler Schriftarten Dieses Repository enthält einen speziellen Exploit für die VariaType -Maschine auf Hack The Box. Der Exploit nutzt eine Schwachstelle in der Art und Weise aus, wie die fontTools-Bibliothek oder die Webanwendung...

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Summary The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as webshell.pHp therefore bypassed the blacklist and was written to the web-accessible upload directory as...

WordPress Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion vulnerability

Authenticated Subscriber+ PHP Object Injection to Arbitrary File Deletion vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Uncanny Automator versions = 7.6.1.1...