CVE-2018-19422-SubrionCMS-RCE

CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 Authenticated Remote Code Execution /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Exploit Usage Commands: Windows/Linux: $ sudo python3...

CVE-2023-49103

CVE-2023-49103 PoC for the CVE-2023-49103 Overview This Python script is designed to efficiently process a large list of URLs to check for the presence of phpinfo output. It uses multi-threading to handle a large number of URLs concurrently, significantly speeding up the process. The script also...

CVE-2017-9798

CVE-2017-9798 This small script checks a shared hosting environment for CVE-2017-9798 and exits with a return code of 1 if a vulnerable .htaccess file has been found...

Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting

The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. id: CVE-2017-18496 info: name: Htaccess by BestWebSoft 1.7.6 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. impact: |...

htshells

HTSHELLS - Self contained web shells and other attacks via .htaccess files. Attacks are named in the following fashion, module.attack.htaccess and grouped by attack type in directories. Pick the one you need and copy it to a new file named .htaccess, check the file to see if it needs editing befo...

htshells

HTSHELLS - Web shells autocontenidos y otros ataques mediante archivos .htaccess. Los ataques se nombran de la siguiente manera: module.attack.htaccess y se agrupan por tipo de ataque en directorios. Elige el que necesites y cópialo a un archivo nuevo llamado .htaccess; revisa el archivo para ver...

svn-extractor

Svn-Extractor Many a times web application pen-testers are encountered with the presence of .svn folders. For those not aware .svn folder is used by SVN version control system to perform its operations. For a blackbox pentest this folder contains huge amount of information. Some of the key areas...

CVE-2025-67887

🛡️ Fix for the "vulnerability" CVE-2025-67887/86 in the 1C-Bitrix Translate module 1C-Bitrix Security The Information Security and Incident Monitoring Center of 1C-Bitrix informs Information appeared in Telegram channels about a vulnerability in the "Translate" module allegedly allowing...

CVE-2017-9798

Check for CVE-2017-9798 This small script checks a shared hosting environment for CVE-2017-9798 and exits with a return code of 1 if a vulnerable .htaccess file has been found. Example usage python check.py --path /var/customers/webs/...

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM command Example: ./poc.sh http://192.168.5.16:8090 admin admin id...

CVE-2023-47400

CVE-2023-47400 Proof of Concept for the CVE-2023-47400 Authenticated PHP Remote Code Execution via Arbitrary file write on Nagios XI 5.11.0 !Note This poc is based on the technical advisory published by NCC group...

CVE-2018-11736

Exploit de RCE PHP CVE-2018-11736 Pluck CMS Aviso ⚠️: Este exploit fue desarrollado en Rust principalmente como un ejercicio introductorio de aprendizaje de programación. Disculpa cualquier falta de rigor técnico o patrones de código no idiomáticos. Además, este no es un descubrimiento mío; me bas...

CVE-2026-19708 File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

Astra Linux – Vulnerability in Apache2

A privilege management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server versions from 2.4.67 onwards. Users are recommended to upgrade to version 2.4.68, which fixes thi...

CVE-2026-54611

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

EUVD-2026-73561

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611

InstantCMS , a free and open-source content management system, contains a Remote Code Execution vulnerability in its component installer in versions prior to 2.18.2 . A remote authenticated attacker can upload a malicious component; although the component is not formally installed, the uploaded P...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...