SecurityNotFound

404 Page Not Found Webshell 📼 Clone me! Clone or download the project: git clone --depth=1 https://github.com/CosasDePuma/SecurityNotFound.git 📦 "Installation" The src/404.php file should be located on the target server and it must have the ability to execute .php files. Here is an example of som...

CVE-2026-124428

Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, t...

CVE-2026-124428 Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg

Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, t...

PT-2026-139944

Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, t...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

CVE-2023-41362_MyBB_ACP_RCE

CVE-2023-41362 - MyBB ACP RCE Exploit for CVE-2023-41362 Blog post: https://blog.sorcery.ie/posts/mybbacprce...

cve-2020-0688

cve-2020-0688 cve-2020-0688 Login with a user with an email address privliage is nothing to worry about. Grab - VIEWSTATEGENERATOR from page source Grab - the value of ASP.NETSessionId cookie for viewstateuserkey value Download YSO Here ysoserial.exe -p ViewState -g TextFormattingRunProperties -c...

CVE-2026-123489

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123490

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account ...

CVE-2026-123490

Craft CMS versions 5.8.17 through 5.11.2 are vulnerable to a privilege escalation vulnerability. The issue resides in the getOwners() function, which fails to cleanse query configurations when applying caller criteria. This allows authenticated control panel users to execute arbitrary static PHP ...

EUVD-2026-118290

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account ...

CVE-2026-123489 Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123489

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 are vulnerable to a blind SQL injection vulnerability. The root cause is that the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without stripping SQL-bearing properties like order...

EUVD-2026-118289

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123490: craftcms cms: Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller…

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account ...

CVE-2026-123489: craftcms cms: Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the…

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

AhMyth-Android-RAT

AhMyth Android Rat Beta Version It consists of two parts : Server side : desktop application based on electron framework control panel Client side : android application backdoor Getting Started You have two options to install it 1 From source code Prerequisite : Electron to start the app Java to...

cyberpanel

🛠️ CyberPanel Web Hosting Control Panel powered by OpenLiteSpeed, designed to simplify hosting management. 🔧 Features & Services 🔐 Different User Access Levels via ACLs. 🌌 Auto SSL for secure websites. 💻 FTP Server for file transfers. 🕒 Light-weight DNS Server PowerDNS. 🔐 phpMyAdmin to manage...

silverboxcc

Reverse engineered android malware called Red Alert V2.0. At the time of analysis, there were no longer any C2 servers running and so we were unable to observe any traffic between the malware and the C2 server. So we figured out the C2 protocol and wrote this control panel. Bot's traffic from the...