CVE-2024-33438

Carga Arbitraria de Archivos Conduce a RCE CVE-2024-33438 CubeCart Después de ejecutarlo, esta es la salida esperada para una explotación exitosa: root@kitploit: python3 CubeCartCVE.py http://localhost/admin0Kqnr9.php admin 123456 whoami ,----. ||/ '. / O|| /| / "" / / // / launching exploit ||/...

CVE-2023-3824

PoC de archivo Phar malicioso en PHP CVE-2023-3824 Descripción Esta Prueba de Concepto PoC demuestra cómo crear un archivo Phar malicioso en PHP y desencadenar una vulnerabilidad de desbordamiento de búfer. Uso Creación del archivo Phar malicioso 1. Crea un nuevo archivo PHP por ejemplo,...

CVE-2020-29607

CVE-2020-29607-Exploit Título del Exploit: Pluck CMS 4.7.13 - Carga de archivos que permite ejecución remota de código Autenticado Descripción del CVE: Una vulnerabilidad de omisión de restricciones de carga de archivos en Pluck CMS anterior a 4.7.13 permite que un usuario con privilegios de...

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

CVE-2026-78839

CVE-2026-78839 Descripción Una vulnerabilidad de carga arbitraria de archivos en AppNitro MachForm v30 permite a los atacantes ejecutar código arbitrario mediante la carga de un archivo .phar manipulado. La explotación exitosa de este problema requiere dos salvedades prácticas. Primero, un atacan...

CVE-2025-3515

CVE-2025-3515 CVE‑2025‑3515 — Contact Form 7 的多文件拖放上传插件 描述： 通过 drag‑and‑drop‑multiple‑file‑upload‑contact‑form‑7 ≤1.3.8.9 版本可实现任意文件上传，允许上传 .phar 文件，从而在 Apache+modphp 环境下导致远程代码执行 :contentReferenceoaicite:29index=29。 CVSS（v3.1）： 8.1（高危）:contentReferenceoaicite:30index=30 补丁： 更新至 ≥1.3.9.0 版本...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell Upload Exploit 描述： 该 Python 脚本利用 Pluck CMS（例如 4.7.13 之前的版本）中的文件上传限制绕过漏洞，上传一个 PHP Webshell。上传成功后，该 shell（名为 "shell.phar"）可用于在目标服务器上执行命令。 脚本执行以下步骤： 1. 从目标获取并格式化会话 Cookie。 2. 使用提供的密码对目标进行身份验证。 3. 通过存在漏洞的文件上传功能上传 PHP Webshell。 4. 上传完成时显示成功消息。 成功时，脚本会打印： "Auth...

EUVD-2026-71712

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

PT-2026-86238

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

CVE-2026-78839: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

CVE-2026-23697

Vtiger CRM before 8.4.0 is vulnerable to an authenticated file upload RCE via the Documents module. An attacker with low privileges can upload a .phar file containing arbitrary PHP code, bypassing the extension denylist in config.inc.php (which omits .phar). The uploaded file is stored with its o...

CLSA-2026-1777946242 php: Fix of 13 CVEs

CVE-2018-14883: fix int overflow leading to heap overflow in exifthumbnailextract - CVE-2019-6977: fix imagecolormatch out-of-bounds write on heap in GD - CVE-2019-9022: fix memcpy with negative length via crafted DNS response - CVE-2019-9640: fix invalid read in exifprocessSOFn - CVE-2019-11042:...

CVE-2026-25524

OpenMage LTS (Magento LTS unofficial fork) before v20.17.0 is affected by a Phar deserialization flaw. PHP functions getimagesize(), file_exists(), and is_readable() can deserialize when given phar:// stream wrapper paths, used during image validation/media handling with controllable file paths. ...

CVE-2021-33352

An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via a phar file upload in the ticket message field...

CVE-2021-28998

File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file...

CVE-2019-16317

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different...

CVE-2023-53952 Dotclear 2.25.3 Authenticated Remote Code Execution via File Upload

Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through the blog post creation interface. Attackers can upload files containing PHP system commands that execute when the uploaded file is accessed...

CVE-2023-53924

UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload. Attackers can trigger code execution by visiting the uploaded file's location, enabling system command execution...

CVE-2023-53924

UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload. Attackers can trigger code execution by visiting the uploaded file's location, enabling system command execution...

CVE-2023-53921

SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to the files/images directory. Attackers can upload a .phar file with system command execution payload to compromise the web application and execute arbitrary system commands...