216 matches found
CVE-2024-46377
CVE-2024-46377 PoC for Arbitrary File Upload Vulnerability in Best House Rental Management System 1.0 Overview This Python script demonstrates how to exploit the arbitrary file upload vulnerability in Best House Rental Management System 1.0. The vulnerability allows an attacker to upload a...
CVE-2026-49049
CVE-2026-49049 This repository contains a Python-based scanner and proof-of-concept for a vulnerability in the Joomla Helix3 component. The bug is an arbitrary file write issue that can lead to remote code execution RCE when an attacker is able to write a PHP payload into a web-accessible locatio...
casper-shell
🦇 Casper@shell: - Advanced PHP Web Shell Casper@shell: is an enhanced, more user-friendly version of p0wny shell with many new features. This version aims to be more helpful for quickly performing reconnaissance, exfiltration, or deploying persistence mechanisms. ✨ Features 🖥️ Advanced Terminal...
wwwolf-php-webshell
wwwolf's PHP web shell I frequently encountered issues when using other web shells: They use new PHP syntax features not compatible with the old PHP version running on some targets. They make wrong assumption on the remote URL, breaking PHP code injection or GET parameters unexpected by the serve...
CVE-2024-9441
CVE-2024-9441 Description of the Vulnerability: This code exploits a Remote Code Execution RCE vulnerability that occurs due to improper input sanitization in a PHP-based web application. The specific weakness is in the "forgot password" functionality index.php?c=user&m=forgotpassword, where user...
Jatayu
JATAYU Stealthy Stand Alone PHP Web Shell FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy USAGE GET /test/jatayu.php?fn=1&&cmd=whoami Host : http://test.com Authtoken : bb3b1a1f-0447-42a6-955a-88681fb88499 FUNCTIONS PARAMETER| FUNCTION ---|---...
CVE-2024-56264
CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...
Shelly
Shelly | Simple Backdoor Manager with Python based on weevely Shelly is a simple tool that is written using Python, which functions to remote a website Instalation : $ git clone https://github.com/tegal1337/Shelly $ cd Shelly $ python3 shell.py Requirements : sudo pip install -r requirements.txt...
Shadow-Vault
Shadow Vault 🔐 Shadow Vault is a lightweight PHP web tool designed for system administrators to securely add new user credentials to shadow files on shared hosting environments. It automatically detects existing shadow aging format, uses SHA-512 password hashing, supports multiple write fallback...
CVE-2026-25099
CVE-2026-25099 - Bludit CMS API Unrestricted File Upload to RCE Description Bludit CMS versions before 3.18.4 allow an authenticated attacker with a valid API token to upload files of any type and extension via the POST /api/files/ endpoint. The uploadFile function performs no file extension or...
CVE-2025-60736
CVE-2025-60736: SQL Injection Vulnerability in Online Medicine Guide Executive Summary This document outlines a critical SQL injection vulnerability discovered in the Online Medicine Guide web application. The vulnerability allows unauthorized database access and poses significant security risks ...
b374k
b374k shell 3.2 Este PHP Shell es una herramienta útil para administradores de sistemas o web para realizar gestión remota sin usar cpanel, conectarse mediante ssh, ftp, etc. Todas las acciones se realizan dentro de un navegador web. Características: Gestor de archivos ver, editar, renombrar,...
p0wny-shell
p0wny@shell: -- Shell PHP monofile p0wny@shell: è una shell PHP monofile molto basilare. Può essere usata per eseguire rapidamente comandi su un server quando si esegue il pentesting di un'applicazione PHP. Usala con cautela: questo script rappresenta un rischio per la sicurezza del server...
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remot...
Exploit for Improper Access Control in Ollyo Helix3
CVE-2026-49049 This repository contains a Python-based scanne...
CVE-2026-79987
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
CVE-2026-79987: Use of Externally-Controlled Input to Select Classes or Code
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy...
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 CVSS score: 10.0, has been codenamed StyleSmuggler by Sansec, which...