cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor

A threat actor named MrRot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments. The attack exploits CVE-2026-41940, a vulnerability impacting cPanel and WebHost Manager WHM that could result ...

CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE

Summary ci4ms Backup::restore extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the backup create permission to write files to arbitrary filesystem locations Zip Slip and achieve remote code execution by dropping a PHP file under the...

ctf-writeups-Doli1

🛡️ Doli 1 — CTF Writeup VulnHub VAPT Report For...

Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers

Threat actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers and to achieve remote code execution, according to findings from the Microsoft Defender Security Research Team. "Instead of exposing command execution through URL parameters or request...

CVE-2026-24848

OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument method in EtherFaxActions.php allows authenticated users to write arbitrary content to arbitrary locations on the server filesystem. This vulnerabilit...

📄 WordPress StoreKeeper for WooCommerce 14.4.4 Shell Upload

A critical security vulnerability exists in the StoreKeeper for WooCommerce WordPress plugin that allows unauthenticated attackers to upload arbitrary files, including PHP web shells, leading to complete system compromise. Version 14.4.4 is affected...

odfs_rce_poc

Online Discussion Forum Site 1.0 - Remote Code Execution PoC...

PT-2025-52212

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 25.100.301 Description Remote Code Execution is possible because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. The supplier...

EUVD-2006-5465

Malware in sbrugna...

EUVD-2005-4009

Malware in sbrugna...

EUVD-2008-4480

Malware in sbrugna...

EUVD-2010-4748

Malware in sbrugna...

EUVD-2005-4008

Malware in sbrugna...

EUVD-2010-4808

Malware in sbrugna...

EUVD-2020-21327

Malware in sbrugna...

EUVD-2006-5466

Malware in sbrugna...

EUVD-2010-4749

Malware in sbrugna...

EUVD-2020-16566

Malware in sbrugna...

EUVD-2005-4010

Malware in sbrugna...

EUVD-2005-4007

Malware in sbrugna...