CVE-2025-49113-Roundcube_1.6.10

CVE-2025-49113 – Roundcube 1.6.10 Authenticated Remote Code Execution ⚠️ Disclaimer This repository is intended strictly for educational and research purposes. All demonstrations were performed in a controlled lab environment. Unauthorized testing or exploitation of systems without explicit...

CVE-2025-34085-Multi-target

CVE-2025-34085 Multi-Target RCE Scanner Mass-exploitation scanner for CVE-2025-34085 — an unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin. This tool uploads a PHP payload disguised as an image, renames it via a vulnerable file engine, and triggers shel...

masta-cve-2026-48907

MASTA CVE-2026-48907 Scanner Single-file, self-contained scanner for Joomla! JCE Editor Author: Hussein Mohamed masta ghimau !CAUTION 🚨 DISCLAIMER — READ BEFORE USE THIS IS AN INTRUSIVE SECURITY TESTING TOOL. root@kitploit: THIS TOOL IS FOR AUTHORIZED SECURITY ASSESSMENTS ONLY. Scanning systems y...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Ejecución Remota de Código RCE Exploit por kaal Exploits 1. HotelDruidExploit.py Este exploit creará una nueva habitación con nuestro payload PHP como nombre de habitación. Uso: $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid ...

CVE-2015-8351

gwollebuster this script is exploit for wordpress old plugin gwolle usage: ./gwollebuster.py first arguments = your target url of wordpress that installed gwolle second arguments = your ip third arguments = listening port for reverse shell example: ./gwollebuster.py http://vulnpress.com/...

SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517

SPIP BigUp Unauthenticated RCE Exploit CVE-2024-8517 Description This Python script exploits an unauthenticated Remote Code Execution RCE vulnerability in the BigUp plugin of the SPIP CMS Système de Publication pour l'Internet Partagé. The flaw lies in the listerfichiersparchamps function, which...

0-click-RCE-Exploit-for-CVE-2024-51793

CVE-2024-51793 / Exploit RCE 0-Click Autore: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 Questo repository contiene un exploit proof-of-concept per CVE-2024-51793, una vulnerabilità di upload arbitrario di file non autenticata in un plugin WordPress vulnerabile, che...

0-click-RCE-Exploit-for-CVE-2024-51791

CVE-2024-51791 / 0-Click RCE Exploit Autor: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 Dieses Repository enthält einen Proof-of-Concept-Exploit für CVE-2024-51791, eine nicht authentifizierte Schwachstelle zum beliebigen Hochladen von Dateien in einem angreifbaren...

exploit-CVE-2015-3306

ProFTPd 1.3.5 - modcopy Remote-Befehlsausführung ProFTPD ist ein hochgradig konfigurierbarer FTP-Daemon für Unix und Unix-ähnliche Betriebssysteme. ProFTPD entstand aus dem Wunsch nach einem sicheren und konfigurierbaren FTP-Server. Es wurde von einer großen Bewunderung für den Apache-Webserver...

CVE-2026-39932

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39932

CVE-2026-39932 affects OpenEMR 8.2.0, enabling remote code execution through the document category tree component. The vulnerability arises from an unsanitized eval() in CategoryTree (library/classes/Tree.class.php) that executes PHP payloads injected into the categories table. An authenticated a...

EUVD-2026-52345

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

OS Command Exec, Unix Command Shell, Bind TCP (via socat)

Execute an OS command from PHP. Creates an interactive shell via socat Module Options msf use payload/php/unix/cmd/bindsocattcp msf payloadbindsocattcp show actions ...actions... msf payloadbindsocattcp set ACTION msf payloadbindsocattcp show options ...show and set options... msf...

Exploit for CVE-2026-6433

CVE-2026-6433 — Proof of Concept FlipperCode — Custom CSS,...

CVE-2021-47936

OpenCATS 0.9.4 is affected by a remote code execution vulnerability. Unauthenticated attackers can upload PHP payloads disguised as resume attachments via the careers job application endpoint and then execute commands by accessing the uploaded file. The CVE description in the connected sources co...

Exploit for CVE-2026-36340

CVE-2026-36340 Remote Code Execution RCE Vulnerability in Kr...

CVE-2026-32985 Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution

Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a crafted ZIP archive containing malicious PHP payloads. Attackers can bypass...

CVE-2026-32985

Xerte Online Toolkits

Exploit for CVE-2026-3395

CVE‑2026‑3395 — MaxSite CMS Unauthenticated Remote Code Execut...

📄 SPIP Gadget Chain Insecure Deserialization

SPIP Gadget Chain versions prior to 4.4.9 suffer from a potential PHP object deserialization vulnerability. ============================================================================================================================================= | Title : SPIP Gadget Chain before 4.4.9...