105487 matches found
HTMLawed
HTMLawed is ... ... a single-file, 45 kb PHP script that makes input text more secure, HTML standards-compliant, and suitable in general from the viewpoint of a web-page administrator, for use in the body of HTML, XHTML or XML documents. A simple HTMLTidy alternative, the htmLawed filter,...
CVE-2020-5844
CVE-2020-5844 Authenticated RCE in PandoraFMS 7.0-NG 742 Admin privileged attackers can upload malicious PHP documents. By decoding the base64 file location users can gain a shell as apache user. Discovered by TheCyberGeek PoC python script root@kitploit: Usage: python3 CVE-2020-5844.py URL USER...
OWASPWebGoatPHP
WebGoatPHP OWASP WebGoatPHP is a port of OWASP WebGoat to PHP and MySQL/SQLite databases. The goal is to create an interactive teaching environment for web application security by offering lessons in the form of challenges. In each challenge the user must exploit the vulnerability to demonstrate...
php-encryption
php-encryption root@kitploit: composer require defuse/php-encryption This is a library for encrypting data with a key or password in PHP. It requires PHP 5.6 or newer and OpenSSL 1.0.1 or newer. We recommend using a version of PHP that still has security support, which at the time of writing mean...
tirreno
tirreno tirreno es un framework de seguridad. tirreno tir.ˈrɛ.no ayuda a comprender, monitorear y proteger tu producto frente a amenazas, fraude y abuso. Mientras que la ciberseguridad clásica se centra en la infraestructura y el perímetro de red, la mayoría de las brechas ocurren a través de...
CVE-2021-40964
Tiny File Manager = 2.4.6 - Remote Code Execution Authenticated 🚨 About the Exploit This is a Bash-based authenticated Remote Code Execution RCE exploit for Tiny File Manager versions = 2.4.6, vulnerable under CVE-2021-40964. The script leverages: Weak upload validation and webroot disclosure, An...
CVE-2021-43936
CVE-2021-43936 CVE-2021-43936 is a critical vulnerability CVSS3 10.0 leading to Remote Code Execution RCE in WebHMI Firmware. This vulnerability works on versions 4.0 and the newest ones. Tested only on 4.0.7475. Vulnerability is used by script in the following steps: 1. Logs into the application...
b4tm4n
B4TM4N PHP WEBSHELL Cuenta de inicio de sesión por defecto root@kitploit: Usuario : k4mpr3t Contraseña : k4mpr3t Características root@kitploit: 0 Administrador de archivos 1 Info de seguridad 2 Base de datos simple 3 Terminal interactiva 4 Conexión inversa PHP Reverse Back Connect 5 Ejecutar códi...
CVE-2026-27475
CVE-2026-27475 CVSS-B 9.2 CRITICAL Authenticated Insecure Deserialization in SPIP 4.4.8 Explanations and more on my website RCE Gadget Attacker plugins/rcegadget/rcegadgetoptions.php root@kitploit: DEBUG:\n"; echo "File: "; vardump$this-file; echo "Data: "; vardump$this-data; echo "";...
CVE-2024-38473-Nuclei-Template
CVE-2024-38473 Nuclei Template Description Nuclei template designed to detect Apache servers vulnerable to CVE-2024-38473. It first identifies servers running Apache 2.4.60 with default PHP-FPM settings. Then, it fuzzes for potential PHP files protected by ACLs that might be bypassed due to this...
CVE-2023-50564_Pluck-v4.7.18_PoC
CVE-2023-50564 PoC This repository contains a Proof of Concept for CVE-2023-50564 vulnerability in Pluck CMS version 4.7.18 Description CVE-2023-50564 is a vulnerability that allows unauthorized file uploads in Pluck CMS version 4.7.18. This exploit leverages a flaw in the module installation...
pinky
Uploading a webshell is almost always the next step after exploiting a web vulnerability, but services like Cloudflare and the new generation of firewalls do a really good job preventing attackers to run commands in the target via HTTP or HTTPS. On the other hand, text content filtering and...
Karkinos
Aviso legal Este es un proyecto ANTIGUO que hice en la universidad... todo el código fue improvisado sobre la marcha y casi nada fue planeado. Esta herramienta debe ser utilizada únicamente en aplicaciones/redes para las que tengas permiso de atacar. Cualquier mal uso o daño causado será...
phpMussel
¿Qué es phpMussel? Una solución ideal para entornos de hosting compartido, donde a menudo no es posible utilizar o instalar soluciones antivirus convencionales. phpMussel es un script PHP diseñado para detectar troyanos, virus, malware y otras amenazas en los archivos subidos a su sistema...
Door404
Door404 Door404 es un proyecto de código abierto desarrollado porMrSqar & Rizer Este proyecto fue desarrollado por 2 razones Primero " Ayudar a los principiantes a aprender a programar . " Segundo " Ayudar a los administradores de servidores novatos a aprender nuevos trucos de protección . "...
CVE-2020-13405
CVE-2020-13405 Base Score: 7.5 HIGH🟥 MicroWeber is an open-source Content Management System CMS written in PHP. It allows web administrators to easily build a website by dragging and dropping components where they want them to be. It is a popular choice among those looking to start a website that...
DVWA
DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA es una aplicación web hecha en PHP/MySQL que es extremadamente vulnerable. Su principal objetivo es ayudar a profesionales de seguridad a poner a prueba sus habilidades y herramientas en un entorno legal, ayudar a desarrolladore...
PHP-Fuzzer
PHP Fuzzer Esta biblioteca implementa un fuzzer para PHP, que se puede usar para encontrar errores en bibliotecas particularmente bibliotecas de análisis sintáctico alimentándolas con entradas "aleatorias". La retroalimentación de la instrumentación de cobertura de aristas se utiliza para guiar l...
CVE-2025-6058
🚨 CVE-2025-6058 — WordPress WPBookit ≤ 1.0.4 Unauthenticated File Upload Exploit Unauthenticated Arbitrary File Upload Exploit targeting WordPress WPBookit Plugin ≤ 1.0.4 Exploit allows remote shell upload and full command execution. Author: 0xgh057r3c0n 📌 About The Vulnerability CVE-2025-6058 is...