Grawler

Grawler - v1.0 This project isnot maintained anymore. Grawler is the best tool ever, made for automating google dorks it's a tool written in PHP which comes with a web interface that automates the task of using google dorks, scrapes the results, and stores them in a file, version 1.0 is the more...

CVE-2023-5965

PoC para Espo CRM 7.2.4 CVE-2023-5965 y CVE-2023-5965 CVE-2023-5965 Aviso Un atacante autenticado con privilegios podría subir un zip especialmente manipulado al servidor EspoCRM en la versión 7.2.5, a través del formulario de actualización, lo que podría llevar a la ejecución arbitraria de códig...

CVE-2016-3141

CVE-2016-3141 1. Vulnerability Detail. Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service memory corruption and application crash or possibly have unspecified other impact by triggering a...

CVE-2025-39601

🚨 CVE-2025-39601 - CSRF to RCE in WordPress Custom CSS, JS & PHP plugin = 2.4.1 🧠 Description A Cross-Site Request Forgery CSRF vulnerability in the WPFactory Custom CSS, JS & PHP plugin allows for Remote Code Execution RCE by injecting malicious PHP code via unauthorized POST requests. This...

CVE-2025-49113-exploit

CVE-2025-49113 - Roundcube Remote Code Execution A proof-of-concept exploit for CVE-2025-49113, a remote code execution vulnerability in Roundcube Webmail. Description This exploit targets a deserialization vulnerability in Roundcube Webmail versions 1.5.0 through 1.6.10. The vulnerability allows...

D-RAT_VB.NET_MySQL_PHP

D-RATVB.NETMySQLPHP D-RAT VB.NET+MySQL+PHP The project is composed of "D-RAT" server and client "D-STUB" Programming for the client and server languages: "VB.NET Framework 2" Database: "MySQL" Web page: "PHP" https://www.youtube.com/watch?v=opBbmQ5BRFk...

Bughound

What is Bughound? Bughound is an open-source static code analysis tool that analyzes your code and sends the results to Elasticsearch and Kibana to get useful insights about the potential vulnerabilities in your code. Bughound has its own Elasticsearch and Kibana Docker image that is preconfigure...

CVE-2020-24186_reverse_shell_upload

CVE-2020-24186 reverse shell upload Exploit for WpDiscuz 7.0.4 based on the the exploit written by h3v0x. Exploits the vulnerability and uploads a reverse PHP shell. Inspiration was the Blogger CTF. exploit.py -u http://192.168.1.81/blog -p /wordpress/2021/06/blogpost -l '192.168.1.9' -s 9001...

CVE-2021-43936

CVE-2021-43936 CVE-2021-43936 es una vulnerabilidad crítica CVSS3 10.0 que conduce a la Ejecución Remota de Código RCE en el firmware de WebHMI. Esta vulnerabilidad afecta a las versiones 4.0 y las más recientes. Probada solo en 4.0.7475. El script utiliza la vulnerabilidad en los siguientes paso...

csaf

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA es una aplicación web hecha en PHP/MySQL que es extremadamente vulnerable. Su principal objetivo es ayudar a profesionales de seguridad a poner a prueba sus habilidades y herramientas en un entorno legal, ayudar a desarrolladore...

php-reverse-shell

php-reverse-shell...

pinky

Uploading a webshell is almost always the next step after exploiting a web vulnerability, but services like Cloudflare and the new generation of firewalls do a really good job preventing attackers to run commands in the target via HTTP or HTTPS. On the other hand, text content filtering and...

CVE-2021-44967

CVE-2021-44967: LimeSurvey RCE Description This Proof-of-Concept POC can be used to exploit CVE-2021-44967 to upload and execute a malicious LimeSurvey PHP plugin as administrator to obtain a reverse shell. A Remote Code Execution RCE vulnerabilty exists in LimeSurvey 5.2.4 via the upload and...

CVE-2024-47051

Summary Bad sanitization of uploaded file's content, type and extension in the Asset Edition feature allows an authenticated attacker to write arbitrary PHP code inside the web directory and locate where said file is written. This results in Remote Code Execution. A path traversal also allows to...

CVE-2024-4577

CVE-2024-4577 Disclaimer This tool is intended only for personal security research and learning. Any direct or indirect consequences or losses caused by the dissemination or use of this tool are the sole responsibility of the user; the tool author assumes no responsibility. PHP NAME: PHP-CGI -...

CVE-2023-50564_Pluck-v4.7.18_PoC

CVE-2023-50564 PoC Este repositorio contiene una Prueba de Concepto para la vulnerabilidad CVE-2023-50564 en Pluck CMS versión 4.7.18 Descripción CVE-2023-50564 es una vulnerabilidad que permite la subida no autorizada de archivos en Pluck CMS versión 4.7.18. Este exploit aprovecha una falla en l...

CVE-2023-33253

CVE-2023-33253 LabCollector 6.0 though 6.15 allows remote code execution An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as...

scodescanner

SCodeScanner SCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod. Website for newreleases, new...

scodescanner

SCodeScanner SCodeScanner significa Escáner de Código Fuente, donde el usuario puede escanear el código fuente para encontrar vulnerabilidades críticas. El objetivo principal de este escáner es encontrar vulnerabilidades dentro del código fuente antes de que el código se publique en producción...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 - Unauthenticated PHP Object Injection Description The Partners plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject...