EUVD-2026-82416

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275

Datadog PHP Tracer prior to 1.19.2 contains a denial-of-service vulnerability in ddtrace_deserialize_baggage (ext/distributed_tracing_headers.c). The function parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES, allowing a remote una...

CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC

CVE-2024-25600 — WordPress Bricks Builder RCE PoC Vulnerabilidad de ejecución remota de código no autenticada en WordPress Bricks Builder id uid=33www-data gid=33www-data groups=33www-data...

astrolock

Astrolock A purposely vulnerable application in order to demonstrate PHP payload smuggling techniques for PNG files...

PHP-8.1.0-dev_WebShell-RCE

PHP 8.1.0-dev WebShell RCE Unauthenticated Exploit Code for PHP 8.1.0-dev WebShell RCE Unauthenticated Expected outcome: Exploiting backdoor installed on PHP 8.1.0-dev server thereby obtaining WebShell to execute commands remotely. Intended only for educational and testing in corporate...

PHP_imap_open_exploit

PHPimapopenexploit Bypassing disabled exec functions in PHP via imapopen Debian & Ubuntu Original report by CRLF: https://bugs.php.net/bug.php?id=76428...

HTB-Pterodactyl-Writeup

Informe de Prueba de Penetración — HackTheBox: Pterodactyl Fecha: 8 de abril de 2026 Objetivo: Pterodactyl HackTheBox Dificultad: Media SO: Linux openSUSE Leap 15.6 Evaluador: V0idW1re Resumen Ejecutivo La máquina Pterodactyl en HackTheBox presentó un escenario de ataque realista que involucraba...

PanaceaSoft-0day-Exploit

PanaceaSoft-0day-Exploit PanaceaSoft all products 0day exploit https://packetstormsecurity.com/files/157869/PanaceaSoft-Shell-Upload.html no write-up read: jQuery File Upload's PHP Upload Handler...

zencart_auth_rce_poc

zencartauthrcepoc CVE-2021-3291 1- login as admin 2- get any modules edit page 3- inspect element any true radiobox 4- change true to true','MODULEORDERTOTALTOTALSTATUS'; echo id; // 5- click update 6- to trig command go again edit page CVE-2021-3291 https://vulners.com/cve/CVE-2021-3291 POC...

Unrestricted-File-Upload-on-SiteMagic-CMS-4.4.2

Unrestricted File Upload on SiteMagic CMS 4.4.2 This repo describe how to exploit unrestricted file upload vulnerability on SiteMagic CMS 4.4.2 About SiteMagic CMS 4.4.2 Website: https://sitemagic.org/ Download: https://sitemagic.org/Download.html PoC - Exploiting unrestricted file upload...

osTicketFileReadIntoRCE

CVE-2026-22200: osTicket Lectura Arbitraria de Archivos a RCE Exploit de cadena completa que combina la inyección de cadenas de filtros PHP con CVE-2024-2961 CNEXT para la Ejecución Remota de Código no autenticada en instalaciones vulnerables de osTicket. Tabla de Contenidos Visión General Detall...

CVE-2025-62429

CVE-2025-62429 PoC - clipbucket RCE Prueba de Concepto para RCE mediante Inyección de Código PHP en updatelaunch.php Divulgación: Originalmente reportado por mí a través de GHSA-3h9c-7j8r-xc3v ⚠️ Solo para uso autorizado de pentesting/investigación. Información de la Vulnerabilidad...

tpadmin-CVE-2026-2113-poc

tpadmin-CVE-2026-2113-poc A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload. Vulnerability Description A critical Remote Code Execution vulnerability exists in H-ui.admin system's WebUploader preview component. The...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Authenticated Administrator+ Arbitrary File Upload via 'mdjmemailuploadfile' Parameter The WordPress MDJM Event Management plugin version 1.7.8.3 and prior contains an arbitrary file upload vulnerability that allows authenticated administrators to upload maliciou...

CVE-2026-7222-XSS

Stored Cross-Site Scripting XSS in Coaching Management System Leads to Account Takeover Product Coaching Management System in PHP Code-Projects.org https://code-projects.org/coaching-management-system-in-php-with-source-code/ Affected Components /modules/student/complaint.php Complaint Submission...

exploit_cms_fuel

Fuel CMS 1.4.1 - Exploit de Ejecución Remota de Código RCE Este repositorio contiene una implementación en Python 3 de un exploit para Fuel CMS versión 1.4.1. El script aprovecha CVE-2018-16763 , una vulnerabilidad donde la validación insuficiente de entrada en los parámetros filter y preview...

CVE-2019-11043

CVE-2019–11043: PHP-FPM Nginx Remote Code Execution Vulnerability Vulnerability Description and Impact CVE-2019–11043 is a remote code execution RCE vulnerability. It affects PHP-FPM, which is a FastCGI Process Manager that is commonly used with Nginx web servers. The flaw arises from inadequate...

CVE-2026-1357

CVE-2026-1357 -- WPvivid RCE Unauthenticated Remote Code Execution RCE in WPvivid Backup & Migration 800%2C000-brightgreen?style=for-the-badge" alt="Installs" Critical flaw impacting over 800,000–900,000+ WordPress sites Unauthenticated arbitrary PHP upload → full server compromise 🌩️ Overview...