CVE-2026-61511-PoC-Exploit

CVE-2026-61511 – vBulletin 事前認証RCEエクスプロイト＆検証ツール ⚠️ 倫理的な使用のみ – 許可されたセキュリティテスト このリポジトリは許可されたセキュリティ専門家、ブルーチーム、ペネトレーションテスター のみを対象としたツールを提供します。 許可のないコンピュータシステムへのアクセスは、CFAA（米国）、Computer Misuse Act（英国）、TCK 243/244（トルコ）、および世界各国の同様の法律 に基づき違法です。 📖 脆弱性の概要 CVE‑2026‑61511 は、vBulletin の AJAX テンプレートレンダリングエンジンにおけ...

LotusCMS 3.0 - Remote Code Execution

LotusCMS 3.0 is susceptible to remote code execution via the Router function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call and allow remote code execution. id: CVE-2011-0518 info: name: LotusCMS 3.0 - Remote Code Execution author: pikpikcu...

CVE-2026-3395-Lab

CVE-2026-3395 — MaxSite CMS 未認証RCEラボ このリポジトリは教育および研究目的のみで使用してください。 すべてのテストはローカルのDockerラボ環境で行う必要があります。 このセットアップを公開システムや本番システムにデプロイしないでください。 概要 CVE-2026-3395はMaxSite CMSに影響し、管理用AJAXエンドポイントへの未認証アクセスを許可します。runphpプラグインが有効な場合、CMSのフックシステムを通じてユーザー入力をPHPコードとして評価でき、リモートコード実行（RCE）につながる可能性があります。...

majordomo-CVE-2026-27174-poc

majordomo-CVE-2026-27174-poc 这是一个概念验证（PoC），利用 MajorDomo（Major Domestic Module）管理面板的 PHP 控制台功能，实现未经身份验证的远程代码执行。 漏洞 MajorDoMo 的管理面板通过 /admin.php 暴露了一个 PHP 求值控制台。由于 panel.class.php 在身份验证重定向后缺少 exit，AJAX 处理器 incpanelajax.php 会被无条件包含——使得任何未经身份验证的 HTTP 请求都能触达其 eval。 攻击者只需一个 GET 请求即可执行任意 PHP...

CVE-2026-88418

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

CVE-2026-88418

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

EUVD-2026-84857

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

CVE-2026-88418

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

CVE-2026-88418

CMSimple 5.24 is vulnerable to persistent remote code execution because it ships with CSRF protection disabled by default. This flaw causes csrfProtection() to become a no-op on state-changing admin requests and omits the csrf_token hidden field in admin forms. An unauthenticated attacker can tri...

Flextype CMS 1.0.0-alpha.3 Code Execution

Flextype CMS version 1.0.0-alpha.3 contains a stored code execution vulnerability caused by the interaction between globally processed entry expressions, the mutable registry object exposed to expressions, and the PHP entry directive. https://packetstorm.news/download/230567...

...[ More ]

A proof of concept exploit for an unauthenticated remote code execution vulnerability in the Fabrik Joomla component versions prior to 4.6.8. A request-controlled filter eval flag can cause an attacker-supplied filter value to be passed to PHP eval, allowing arbitrary PHP and ultimately shell...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

EUVD-2026-55655

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-14900 Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the jstophp function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formula...

EUVD-2026-46033

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call...

CVE-2026-40187: Improper Neutralization of Special Elements used in an OS Command

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call...

GHSA-8737-2X9G-XJJ7 EGroupware has Authenticated RCE via Malicious eTemplate Upload

Summary An authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call with only double-quote escaping...