Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21, and 8.0.x below 8.0.8, when using URL validation functionality via the filterVar function with the FILTERVALIDATEURL parameter, a URL with an invalid password field can be accepted as valid. This can cause the code to incorrectly parse the...

CVE-2026-48907

CVE-2026-48907 - Joomla! JCE RCE não autenticada Joomla! JCE extension 2.9.99.5 - Upload Arbitrário de Arquivo PHP e Execução Remota de Código não autenticados 🔎 Consultas em Mecanismos de Busca Shodan...

Magneto-PolyShell

Magento 2 RCE Exploit - Unauthentifizierter Datei-Upload zu RCE ⚠️ Dieses Tool dient ausschließlich zu Bildungs- und autorisierten Sicherheitstests. Unbefugte Nutzung gegen Systeme, die Ihnen nicht gehören, ist illegal. Dieses Exploit zielt auf eine kritische Schwachstelle für nicht...

rips-scanner

RIPS Ein statischer Quellcode-Analysator für Schwachstellen in PHP-Skripten Anforderungen Webserver: Apache oder Nginx empfohlen PHP: aktuelle Version empfohlen Browser: Firefox empfohlen Installation 1. Laden Sie das neueste Release herunter 2. Entpacken Sie die Dateien in das...

BlackThrone

BlackThrone PHP BlackThrone Script Uma alternativa de código aberto ao burp collaborator BlackThrone criado para detectar tráfego WebSocket e HTTP no site principal, fornecendo alguns cabeçalhos de servidor e informações do cliente. BlackThrone é uma ferramenta baseada na web para executar em...

halite

Halite Halite é uma interface de criptografia de alto nível que depende do libsodium para todas as suas operações de criptografia subjacentes. Halite foi criado pela Paragon Initiative Enterprises como resultado de nossos esforços contínuos para melhorar o ecossistema e tornar a criptografia em P...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics 1.7.3 - Exploit di Remote Code Execution v2 Exploit funzionante per Open Web Analytics 1.7.3 - RCE potenziato con la php reverse shell di pentestmonkey, risolto il problema di non riuscire a trovare l'utente nella cache. L'exploit originale può essere trovato qui...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload-Task → Keine Authentifizierung → 3-String-Filter-Bypass Überblick Nicht authentifizierter beliebiger Datei-Upload in DJ-Classifieds für Joomla. Der imageupload-Task-Endpunkt verarbeitet Datei-Uploads ohne Authentifizierung und verlässt sich auf...

zend-crypt

zend-crypt Repository aufgegeben am 2019-12-31 Dieses Repository wurde zu laminas/laminas-crypt verschoben. Zend\Crypt bietet Unterstützung für einige kryptografische Werkzeuge. Einige der verfügbaren Funktionen sind: Verschlüsselung mit anschließender Authentifizierung mittels symmetrischer...

PT-2026-81052

Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions 2.0.63 and earlier Description PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the resulting object and potentially...

PT-2026-80842

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

PT-2026-81058

Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.17.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP unserialize function, potentially allowing an attacker to...

PT-2026-80997

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web-based IT service management tool. The user preference functionality is susceptible to PHP object injection, a condition where untrusted input is passed to the PHP unseriali...

CVE-2026-78055

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /BSIT2.php. The manipulation of the argument course leads to cross site scripting. Remote exploitation of the attack is...

CVE-2026-78054

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.php. Executing a manipulation of the argument course can lead to cross site scripting. The attack may be launched remotely. The exploit has been made availabl...

EUVD-2026-64619

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /BSIT2.php. The manipulation of the argument course leads to cross site scripting. Remote exploitation of the attack is...

CVE-2026-78055 SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /BSIT2.php. The manipulation of the argument course leads to cross site scripting. Remote exploitation of the attack is...

CVE-2026-78055

SourceCodester Class and Exam Timetabling System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the file /BSIT2.php. The flaw is triggered by manipulating the course parameter, allowing a remote attacker to inject malicious scripts that execute in a victim's browser. The attack ...

EUVD-2026-64607

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-78054 SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.php. Executing a manipulation of the argument course can lead to cross site scripting. The attack may be launched remotely. The exploit has been made availabl...