Laravel-CVE-2018-15133

CVE-2018-15133 - Vulnerabilidad de deserialización de la APPKEY de Laravel WhiteHat School tercera promoción, clase 28, Lee Yebin - Virtualización: configuración de Docker vulnerable https://github.com/yeahhbean/Laravel-CVE-2018-15133 Resumen Este proyecto es un entorno basado en Docker creado pa...

CVE-2025-54068

CVE-2025-54068 Una herramienta diseñada para explotar CVE-2025-54068 y la ejecución remota de comandos si se conoce la APPKEY del proyecto Livewire. Esta herramienta es una versión recodificada del proyecto original de Synacktiv : Livepyre — https://github.com/synacktiv/Livepyre El concepto centr...

laravel-poc-CVE-2018-15133

Laravel Remote Code Execution when APPKEY is leaked PoC CVE-2018-15133 This repository contains a simple Laravel 5.6.29 application on PHP 7.2.10 with one basic noop route added in routes/web.php see Dockerfile and Proof of Concept exploit cve-2018-15133.php for CVE-2018-15133 that should...

laravel-crypto-killer

Laravel crypto killer Una herramienta diseñada para explotar malas implementaciones de los mecanismos de descifrado en aplicaciones Laravel. Esta herramienta fue diseñada inicialmente para crear payloads dirigidos a la función decrypt de Laravel del paquete Illuminate\Encryption. También puede...

CVE-2024-55555

Laravel Crypto Killer Mass Scanner CVE-2024-55555 This script performs a mass scan of Laravel-based applications vulnerable to CVE-2024-55555, an unauthenticated remote code execution RCE vulnerability in Invoice Ninja. It automates the process of detecting sites using weak or known APPKEY values...

nounours

Nounours Nounours es una herramienta diseñada para probar APPKEYs a escala en aplicaciones Laravel. Desarrollado por Damien Picard. Descripción Nounours fue escrito para probar combinaciones de APPKEY y cifrados de Laravel encontrados en fuentes abiertas. El objetivo es tener un bucle de fuerza...

laravel_cookie_killer

Laravel cookie killer Una herramienta utilizada para cifrar/descifrar cookies de Laravel basada en python3 Requisitos previos Para usar la herramienta, necesitas extraer el valor base64 de APPKEY contenido en el archivo .env que se encuentra en la raíz del proyecto Laravel. La sesión también debe...

CVE-2018-15133-laravel-framework

CVE-2018-15133 - Laboratorio Vulnerable de Laravel Framework 5.6.x Este repositorio proporciona un laboratorio Docker reproducible para CVE-2018-15133 RCE por deserialización de token en Laravel Framework cuando se conoce APPKEY. La aplicación está fijada a una versión vulnerable de Laravel 5.6.x...

Livepyre

Livepyre Una herramienta diseñada para explotar CVE-2025-54068 y la ejecución remota de comandos si se conoce la APPKEY del proyecto Livewire. Autores de la herramienta: @remsio @Worty. Ayuda root@kitploit: $ ./Livepyre.py -h usage: Livepyre.py -h -u URL -f FUNCTION -p PARAM -H HEADERS -P PROXY -...

EUVD-2021-9150

Malicious code in bioql PyPI...

Exploit for CVE-2024-55555

Laravel Crypto Killer Mass Scanner CVE-2024-55555 This scri...

CVE-2025-54366

Summary: FreeScout prior to v1.8.186 is affected by a deserialization vulnerability in the /conversation/ajax endpoint. The issue arises when processing attachments_all and attachments via the insecure Helper::decrypt() function, which deserializes user-controlled data without proper validation. ...

CVE-2025-54366 FreeScout's deserialization of untrusted data leads to Remote Code Execution

FreeScout is a lightweight free open source help desk and shared inbox built with PHP Laravel framework. In versions 1.8.185 and below, there is a critical deserialization vulnerability in the /conversation/ajax endpoint that allows authenticated users with knowledge of the APPKEY to achieve remo...

CVE-2024-29185

FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the phppath parameter is being executed as an OS command by the shellexec function, without validating it. This allows an...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55556

A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55556

A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...

CVE-2024-55556

A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...