CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2024-12877-Exploit

GO-TO CVE – CVE-2024-12877-Exploit Week 66 | Author: Ali Soltani soltanali0 Welcome to Week 66 of the GO-TO CVE series , where we dissect vulnerabilities, analyze root causes, and demonstrate practical exploitation techniques in a safe, educational context. 🚨 Overview CVE-2024-12877 is a PHP Obje...

CVE-2025-1974

Exploit for Ingress NGINX - IngressNightmare This project provides an exploit targeting critical unauthenticated Remote Code Execution RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively referred to as IngressNightmare. In the original research, the Wiz team did not...

Mintinstall-object-injection

TR Linux mint yazılım yöneticisi v 7.9.5/9 yanlış yapılandırmadan dolayı obje enjeksiyonu ve keyfi kod çalıştırmamıza neden olmaktadır. EN Linux mint software manager v 7.9.5/9 causes us to execute object injection and arbitrary code due to incorrect configuration mintinsall TR Mint yazılım...

js2py-Sandbox-Escape-CVE-2024-28397-RCE

CVE-2024-28397 js2py Sandbox Escape Exploit A collection of exploit scripts targeting the js2py sandbox escape vulnerability CVE-2024-28397 that allows arbitrary code execution through Python object introspection. 🔍 Vulnerability Overview The js2py library contains a critical sandbox escape...

CVE-2025-49113

Python Script for CVE-2025-49113 Usage: python exploit.py https://ubuntu.com/security/CVE-2025-49113 Description: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in...

WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin VK Google Job Posting Manager versions = 1.3.1...

WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Spell Check versions = 12.1...

WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Event Planner versions = 1.5.7...

WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sunshine Photo Cart versions = 3.7.1...

WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Ultimate Exporter versions = 3.0...

WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Feed PRO for WooCommerce versions = 13.5.7...

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pay with Vipps for WooCommerce versions = 6.2.0...

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peter Tang in WordPress Plugin Advanced Post Manager versions = 4.5.5...

CVE-2026-103442

CVE-2026-103442: CentralAuth MergeAccount 객체 주입 보고자: Marco Paciaroni BomboBombone. CentralAuth는 마이그레이션 상태를 디코딩할 때 브라우저가 제공한 merge-session 키를 허용했습니다. centralauth-merge 권한을 가진 사용자는 PHP 객체 그래프를 생성하는 키로 대체할 수 있었습니다. 보고서의 Guzzle FileCookieJar 체인은 객체에 의해 선택된 파일을 작성합니다. 영향을 받는 런타임에서 사용 가능한 가젯 체인은 이 객체 주...

CVE-2026-103441

CVE-2026-103441: Wikibase 직렬화된 엔티티 객체 주입 보고자: Marco Paciaroni BomboBombone. 공개된 action=parse API가 PHP로 직렬화된 Wikibase 엔티티를 허용했습니다. 제한 없는 객체 생성은 호출자가 선택한 경로를 unlink하는 Smarty 소멸자에 도달할 수 있었습니다. 영향을 받는 Wikimedia 배포 환경에서 사용 가능한 PHP 가젯 체인은 이 객체 주입 경로를 원격 코드 실행으로 확장할 수 있습니다. 개념 증명 이 스크립트는 임시 디렉터리에 일회용 카나...

HTTP-Request-for-PHP-object-injection-attack-on-CVE-2023-41892

This type of attack attempts to exploit the PHP application's deserialization process to execute arbitrary code or carry out unintended actions on the server. Mitigation Strategies To defend against PHP object injection and similar attacks, consider the following strategies: Disable PHP Object...

CVE-2024-23339

CVE-2024-23339 취약점 개요 CVE-2024-23339 CVSS : 6.5 Jan 23, 2024 ProtoType Pollution in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utilit...

CVE-2025-32463-Sudo-Chroot-Escape

CVE-2025-32463-Sudo-Chroot-Escape Description This repository contains a Python-based Proof of Concept PoC for CVE-2025-32463, a local privilege escalation vulnerability in the sudo versions 1.9.14 through 1.9.17. When a user has sudo privileges to run a command within a chroot environment -R fla...

Modules

모듈 Havoc 프레임워크에서 사용되는 모듈입니다. Powerpick Havoc 프레임워크용 Powerpick 구현입니다. InvokeAssembly Havoc 프레임워크용 InvokeAssembly 구현입니다. Template 이것은 모듈의 기본 템플릿입니다. 이를 사용하여 Havoc 프레임워크용 자체 모듈을 작성할 수 있습니다. SituationalAwareness 다양한 Situational Awareness 비콘 오브젝트 파일 번들입니다. Situational Awareness BOF에서 가져왔습니다. RemoteOps...