CVE-2026-53933

Maravel , a PHP dependency-injection framework, is vulnerable to side-channel information disclosure via dynamic route fuzzing in versions prior to 10.73.1 . When routes are compiled with dynamic placeholders (e.g., /api/v1/users/{id}), the raw placeholder key is mistakenly registered into the fl...

CVE-2022-43117

Suggested description Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the Name, Username, Description and Site Feature parameters. Additional Information Proof Of Concept:...

CVE-2023-50564

CVE-2023-50564 For educational purposes only. This script abuses CVE-2023-50564 to upload a reverse-php shell to the target server. You can use a shell like this one. Just zip the php file and pass the zip to this script. Example root@kitploit: python3 cve-2023-50564.py -u http://idonot.exist -f...

flashsploit

Exploitation Framework for ATtiny85 HID Attacks Twitter - Telegram - Blog Available in Flashsploit is an Exploitation Framework for Attacks using ATtiny85 HID Devices such as Digispark USB Development Board, flashsploit generates Arduino IDE Compatible .ino Scripts based on User Input and then...

DVWA

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA is a PHP/MariaDB web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of...

CVE-2023-36845

CVE-2023-36845 Juniper JunOS J-Web PHP external variable modification CVE-2023-36845 exploit...

CVE-2026-17543-PHP-Exposure-Validator

PHP CVE-2026-17543 Exposure Validator Safe network-side validator for checking potential exposure to PHP CVE-2026-17543. This project checks whether a remote web server exposes a PHP version affected by CVE-2026-17543 and can optionally perform non-destructive login-form probes using harmless...

CVE-2025-12973

S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator = 1.7.7 - Authenticated Editor+ Arbitrary File Upload The WordPress S2B AI Assistant plugin versions 2.47 and prior contains an arbitrary file upload vulnerability that allows authenticated WordPress users with Editor role or...

CVE-2023-3824

PHP Malicious Phar File PoC CVE-2023-3824 Description This Proof of Concept PoC demonstrates how to create a malicious Phar file in PHP and trigger a buffer overflow vulnerability. Usage Creating the Malicious Phar File 1. Create a new PHP file e.g., createphar.php and add the following code:...

phpcms-2008-CVE-2018-19127

phpcms-2008-CVE-2018-19127 Recently we found a vulnerability in /type.php of phpcms 2008 source code. When attackers send crafted requests like "/type.php?template=tag;@unlinkFILE;assert$POST1;//../rss", evil content in this case "@unlinkFILE;assert$POST1;" will be written into cache file in this...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

CVE-2024-33113

CVE-2024-33113 D-LINK DIR-845L is vulnerable to information disclosure via the bscsmsinbox.php file. CVE-2024-33113 is a vulnerability in the D-LINK DIR-845L router that allows information disclosure through the bscsmsinbox.php file. The vulnerability arises from improper handling of the include...

GHSA-65FR-J4P9-VC33 mongodb: Reject "." and NUL bytes in database and collection names

Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. Patches Fixed in PHP library 1.21.4 and 2.4.1. Workarounds Validate database and collection names prior to passing into APIs...

mongodb: Reject "." and NUL bytes in database and collection names

Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. Patches Fixed in PHP library 1.21.4 and 2.4.1. Workarounds Validate database and collection names prior to passing into APIs...

EUVD-2026-67209

mongodb: Reject "." and NUL bytes in database and collection names...

EUVD-2026-69608

Composer arbitrary command execution via a malicious package's Perforce source URL...

EUVD-2026-69576

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery...

CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS

CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS Exploit Author: emirhanerdogu Vendor Homepage https://www.sourcecodester.com/php/16928/sticky-notes-app-using-php-source-code.html Software Link...

CVE-2024-34833-payroll-management-system-rce

CVE-2024-34833 Payroll Management System RCE Unauthenticated PoC RCE via file upload for https://www.sourcecodester.com/php/14475/payroll-management-system-using-phpmysql-source-code.html. The filenames have timestamp prepended with a minute accuracy. The script tries to guess the filename using...

CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE Exploit Tool CVE-2023-41425 This Python-based offensive security tool automates the exploitation of a Remote Code Execution RCE vulnerability in WonderCMS 4.3.2 , specifically CVE-2023-41425. It streamlines the process of crafting a malicious ZIP theme module and delivering a...