CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2024-25641-CACTI-RCE-1.2.26

CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵 Authenticated RCE Cacti version v1.2.26 Summary An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code ...

Magento-CVE-2016-4010

Analysis and Exploitation of Magento Unauthenticated Remote Code Execution Vulnerability CVE-2016-4010 0x00 Preface On May 17, foreign security researcher Netanel Rubin publicly disclosed an unauthenticated remote code execution vulnerability in Magento CVE-2016-4010. This vulnerability actually...

Ads Pro Plugin <= 4.89 - Local File Inclusion

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsatemplate' parameter of the bsapreviewcallback function. This makes it possible for unauthenticated attackers to includ...

OpenCATS - Command Injection

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard. id: CVE-2026-277...

CVE-2023-46304

CVE-2023-46304 Authenticated Remote Code Execution in VTiger Open Source CRM v7.5 Summary A vulnerability exists in the Users module in the current release of VTiger CRM Open Source version 7.5.0 which allows an authenticated attacker to write and execute arbitrary PHP code to config.inc.php...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Prova di concetto POC Basta accedere all'URL con il tuo codice PHP nel parametro "gridValoresPopHidden"...

CVE-2023-5965

PoC for Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Advisory An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. To upload the file go to...

CVE-2021-40964

Tiny File Manager = 2.4.6 - Remote Code Execution Authenticated 🚨 About the Exploit This is a Bash-based authenticated Remote Code Execution RCE exploit for Tiny File Manager versions = 2.4.6, vulnerable under CVE-2021-40964. The script leverages: Weak upload validation and webroot disclosure, An...

CVE-2024-6330

CVE-2024-6330 GEO my WordPress ivv900fnzbln0dem43z7zmzjjgigz...

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress (versions up to and including 2.8.187 ) are vulnerable to Local File Inclusion (LFI) . The root cause is an insecure handling of the 'design_type' parameter , which allows unauthenticated attack...

FOXCMS-CVE-2025-29306-POC

RCE per Iniezione di Parametri in FOXCMS – CVE-2025-29306 Questo repository contiene un PoC basato su Python per una vulnerabilità di Remote Code Execution RCE che colpisce FOXCMS v1.2, un sistema di gestione dei contenuti open-source cinese. ID CVE: CVE-2025-29306 Interessa: FOXCMS v1.2 Tipo:...

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 Fully automated exploit for CVE-2024-25641. When a user is authenticated, Cacti version 1.2.26 is vulnerable to an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import...

CVE-2026-36239

CVE-2026-36239 CVE-2026-36239: Authenticated RCE in PbootCMS v3.2.12 backend sitecopyright Vulnerability Overview: A critical remote code execution RCE vulnerability has been identified in the sitecopyright functionality of the PbootCMS backend administration interface. Specifically, untrusted...

discuz-ml-rce

discuz-ml-rce Sistemi e versioni interessati: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Causa della vulnerabilità: il sistema Discuz!ML non filtra il contenuto del parametro language ricevuto da "l" nei cookie, causando una concatenazione di stringhe che consente l'esecuzione di codice PHP. Nel campo...

CVE-2022-32119

CVE-2022-32119 - Arox-Uneingeschränkter-Datei-Upload Es gibt mehrere uneingeschränkte Datei-Uploads, die zur willkürlichen Ausführung von PHP-Code führen. Authentifizierte angreifbare Seiten: localhost/officeadmin/?pid=54&action=add -----------------------------181967832439954202373233921976...

CVE-2024-4577

CVE-2024-4577 Vulnerabilità di iniezione degli argomenti in PHP INSTALLAZIONE git clone https://github.com/didarul342/CVE-2024-4577.git cd CVE-2024-4577 pip3 install -r requirements.txt UTILIZZO Scan A Target python3 CVE-2024-4577.py -t https://160.153.61.66/ -c "" Scan a list of Targets python3...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Nicht authentifizierte lokale Datei-Inklusion 📝 Beschreibung Das Kubio AI Page Builder Plugin für WordPress ist in allen Versionen bis einschließlich 2.5.1 über die Funktion kubiohybridthemeloadtemplate anfällig für Local File Inclusion. Dadurch können nicht...

CVE-2026-85097

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated...