CVE-2024-4577

CVE-2024-4577 Argument injection vulnerability in PHP INSTALL git clone https://github.com/didarul342/CVE-2024-4577.git cd CVE-2024-4577 pip3 install -r requirements.txt USAGE Scan A Target python3 CVE-2024-4577.py -t https://160.153.61.66/ -c "" Scan a list of Targets python3 CVE-2024-4577.py -f...

CVE-2022-32119

CVE-2022-32119 - Arox-Unrestricted-File-Upload There are multiple unrestricted file uploads that result in the arbitrary execution of PHP code. Authenticated Vulnerable Pages: localhost/officeadmin/?pid=54&action=add -----------------------------181967832439954202373233921976 Content-Disposition:...

CVE-2024-6330

CVE-2024-6330 GEO my WordPress ivv900fnzbln0dem43z7zmzjjgigz...

FOXCMS-CVE-2025-29306-POC

FOXCMS Parameter Injection RCE – CVE-2025-29306 This repository contains a Python-based PoC for a Remote Code Execution RCE vulnerability affecting FOXCMS v1.2, a Chinese open-source content management system. CVE-ID: CVE-2025-29306 Affects: FOXCMS v1.2 Type: Service Parameter Injection → Code...

Magento-CVE-2016-4010

Analysis and Exploitation of Magento Unauthenticated Remote Code Execution Vulnerability CVE-2016-4010 0x00 Preface On May 17, foreign security researcher Netanel Rubin publicly disclosed an unauthenticated remote code execution vulnerability in Magento CVE-2016-4010. This vulnerability actually...

CVE-2024-25641

CVE-2024-25641 RCE for Cacti 1.2.26 This repository automates the process of exploiting CVE-2024-25641 on Cacti 1.2.26. When a user is authenticated, An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates"...

CVE-2024-25641-CACTI-RCE-1.2.26

CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵 Authenticated RCE Cacti version v1.2.26 Summary An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code ...

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 Fully automated exploit for CVE-2024-25641. When a user is authenticated, Cacti version 1.2.26 is vulnerable to an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

CVE-2026-125912

The WP Ultimate CSV Importer WordPress plugin versions before 9.2 is vulnerable to arbitrary PHP code execution within the shared WordPress context. The root cause is a failure to restrict the destination filename and extension, as well as a lack of validation for the fetched content type during ...

WordPress WP Ultimate CSV Importer plugin < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability

Multisite Subsite Admin+ Network-Wide PHP Code Execution vulnerability discovered by Charles Vosburgh in WordPress Plugin WP Ultimate CSV Importer versions 9.2...

CVE-2026-125912 WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared WordPress contex...

CVE-2023-5965

PoC for Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Advisory An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. To upload the file go to...

discuz-ml-rce

discuz-ml-rce Affected systems and versions: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Vulnerability cause: The Discuz!ML system does not filter the language parameter content received by l in the cookie, leading to string concatenation, thereby executing PHP code. The cookie field will contain an...

OpenCATS - Command Injection

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard. id: CVE-2026-277...

Invision Community <=5.0.6 Unauthenticated RCE via Template Injection

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by unauthenticated...

Ads Pro Plugin <= 4.89 - Local File Inclusion

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsatemplate' parameter of the bsapreviewcallback function. This makes it possible for unauthenticated attackers to includ...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Proof of Concept POC Just access the URL with your PHP code in "gridValoresPopHidden" parameter. Researches h...

CVE-2026-117551

Joomla Extension - jdownloads.com - RCE through file upload in jDownloads 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution...

EUVD-2026-124608

Joomla Extension - jdownloads.com - RCE through file upload in jDownloads 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution...