95675 matches found
DEBIAN-CVE-2026-77634
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
DEBIAN-CVE-2026-77635
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...
ChamiloLMS-CVE-2023-4220
Exploit ChamiloLMS CVE-2023-4220 Exploit Python per CVE-2023-4220 , una vulnerabilità di upload arbitrario di file non autenticato che interessa Chamilo LMS = 1.11.24. La vulnerabilità si trova nel componente BigUpload di Chamilo. Sulle installazioni vulnerabili, il gestore di upload permette di...
CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
CVE-2026-77634
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
CVE-2025-50867
Existe uma vulnerabilidade de injeção SQL no endpoint takeassessment2.php do CloudClassroom-PHP-Project 1.0, onde o parâmetro POST Q5 é incorporado diretamente em instruções SQL sem sanitização. Tipo de Vulnerabilidade : SQL Injection Fornecedor do Produto :...
cve-2023-30253
CVE-2023-30253 विवरण Dolibarr 17.0.1 से पहले के संस्करण में, एक प्रमाणित उपयोगकर्ता अपरकेस हेरफेर के माध्यम से दूरस्थ कोड निष्पादन की अनुमति देता है: इंजेक्ट किए गए डेटा में ?PHP को ?php के बजाय उपयोग करना। दस्तावेज़ीकरण CVE-2023-30253 GitHub Advisory: GHSA-9wqr-5jp4-mjmh सेटअप root@kitploit: git...
Joomla-CVE-2015-8562-PHP-POC
Joomla-CVE-2015-8562-PHP-POC Una proof of concept per la vulnerabilità CVE-2015-8562 di Joomla Introduzione Questa PoC è una copia quasi 1:1 dell'implementazione Python di Gary ospitata su exploit-db. Utilizzo È molto semplice da installare: root@kitploit: git clone...
CVE-2026-40877
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...
CVE-2026-40877 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...
CVE-2026-40877 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...
CVE-2026-40877
Combodo iTop , a web-based IT service management tool, is vulnerable to PHP object injection in its user preference functionality prior to version 3.2.3 , which can lead to remote code execution . The attack vector is network-based with low complexity and requires low privileges and user interact...
CVE-2023-1405
CVE-2023-1405 Formidable Forms = 6.1.2 - Iniezione di Oggetti PHP non autenticata Descrizione: Il plugin Formidable Forms per WordPress è vulnerabile all'Iniezione di Oggetti PHP nelle versioni fino alla 6.1.2 inclusa, tramite deserializzazione di input non fidato proveniente dall'invio dei modul...
CVE-2025-67435-PoC
CVE-2025-67435 शोधकर्ता : Chowdhury Faizal Ahammed PluckCMS Zip Slip दूरस्थ कोड निष्पादन भेद्यता रिपोर्ट कार्यकारी सारांश यह रिपोर्ट PluckCMS में पाई गई एक गंभीर सुरक्षा भेद्यता का दस्तावेजीकरण करती है जो प्रमाणित हमलावरों को Zip Slip आक्रमण वेक्टर के माध्यम से दूरस्थ कोड निष्पादन प्राप्त करने की...
osTicketFileReadIntoRCE
CVE-2026-22200: osTicket – Auslesen beliebiger Dateien bis zur RCE Vollständige Exploit-Kette, die PHP-Filter-Chain-Injection mit CVE-2024-2961 CNEXT kombiniert, um nicht authentifizierte Remote-Code-Ausführung auf verwundbaren osTicket-Installationen zu erreichen. Inhaltsverzeichnis Überblick...
KrayinCRM-RCE-Exploit-CVE-2026-38526
🔓 Krayin CRM v2.2.x - Exploração de Execução Remota de Código Autenticada ⚠️ APENAS PARA TESTES DE SEGURANÇA AUTORIZADOS - O uso não autorizado é ilegal e antiético. 📋 Visão Geral Esta ferramenta de exploração demonstra uma vulnerabilidade crítica de execução remota de código RCE autenticada...
ediop3PHP
ediop3PHP Uno scanner PHP per CVE-2025-1219. In bash senza root...
CVE-2025-6058
🚨 CVE-2025-6058 — WordPress WPBookit ≤ 1.0.4 बिना प्रमाणीकरण के फ़ाइल अपलोड शोषण WordPress WPBookit प्लगइन ≤ 1.0.4 को लक्षित करने वाला बिना प्रमाणीकरण का मनमाना फ़ाइल अपलोड शोषण यह शोषण रिमोट शेल अपलोड और पूर्ण कमांड निष्पादन की अनुमति देता है। लेखक: 0xgh057r3c0n 📌 भेद्यता के बारे में CVE-2025-60...
CVE-2024-51430
CVE-2024-51430 Tipo di vulnerabilità Cross-Site Scripting XSS Descrizione Una vulnerabilità di Cross Site Scripting nel sistema di gestione del laboratorio diagnostico online che utilizza PHP v.1.0 consente a un attaccante remoto di eseguire codice arbitrario tramite il parametro Nome Test sul...