webshell

webshell | English | Türkiye Este es un proyecto de recopilación de webshells. Quien da una rosa se queda con el aroma en la mano; si descargan este proyecto, por favor, envíen también shells. Este proyecto incluye varios scripts de uso común. como: asp, aspx, php, jsp, pl, py Si envían webshells...

CVE-2021-30461

Productos afectados VoIPmonitor 24.60 Cómo ejecutar RCE python3 CVE-2021-30461.py -t ipaddress Shell en el navegador: http://x.x.x.x/namrlblgel.php?a=whoami Referencia https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/...

WordPress Media Library Folders plugin <= 8.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Media Library Folders versions = 8.4.1...

suhosin

Suhosin Suhosin pronunciado 'su-ho-shin' es un sistema de protección avanzado para instalaciones de PHP. Fue diseñado para proteger servidores y usuarios de fallos conocidos y desconocidos en las aplicaciones PHP y en el núcleo de PHP...

WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Content Egg versions = 6.3.1...

CVE-2024-4577

CVE-2024-4577 声明 本工具仅用于个人安全研究学习。由于传播、利用本工具而造成的任何直接或者间接的后果及损失，均由使用者本人负责，工具作者不为此承担任何责任。 PHP NAME: PHP-CGI - 命令执行 USAGE: global options command command options arguments... COMMANDS: help, h Shows a list of commands or help for one command GLOBAL OPTIONS: --targeturl url, -u url 读取单个目标的url...

CVE-2024-48762

CVE-2024-48762 Description Command injection vulnerability in /usr/www/application/models/settingscamera.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. POC GET /settings/applyfirmware/;idtest123.txt;/false HTTP/1.1 Host: XXXX Response HTTP/1.1 20...

CVE-2018-16370

CVE-2018-16370 En PESCMS Team 2.2.1, los atacantes pueden subir y ejecutar código PHP arbitrario a través de /Public/?g=Team&m=Setting&a=upgrade colocando un archivo .php en un archivo ZIP. Más detalles en https://github.com/lazyphp/PESCMS-TEAM/issues/2...

CVE-2025-56399

CVE-2025-56399 – Authenticated Remote Code Execution in laravel-file-manager v3.3.1 🧭 Overview An authenticated Remote Code Execution RCE vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. By...

CVE-2024-54761

BigAnt Office Messenger 5.6.06 RCE via SQL Injection SQL injection vulnerability in BigAnt Messenger causes RCE vulnerability. Follow the steps to exploit. Usage: CVE-2024-54761.py -h -r RHOST -p RPORT -u USERNAME -P PASSWORD options: -h, --help show this help message and exit -r, --rhost RHOST...

CVE-2025-49132-poc

CVE-2025-49132-poc I made this poc for CVE-2025-49132, as it was interesting to make and it's part of a challenge over at my cyber platform deepreview ! This CVE takes advantage of a file inclusion vulnerability that can be escalated to a Remote Code Execution with the pearcmd.php script. This is...

CVE-2019-19369

CVE-2019-19369 - FusionPBX = 4.5.10 Authenticated RCE Authenticated attackers can use PHP-Editor function in FusionPBX versions = 4.5.10 to edit one of the existing PHP pages to insert a PHP payload. By navigating to the changed file we are able to gain a shell as www-data. Discovered by...

DolibabyPhp

DolibabyPhp An authenticated RCE exploit for Dolibarr ERP/CRM CVE-2023-30253. Installation You can either install the package from the PyPi repository with pip or git clone the source directly from GitHub. pip install dolibabyphp Usage Usage: dolibabyphp OPTIONS TARGETURL USERNAME PASSWORD COMMAN...

CVE-2026-6271

CVE-2026-6271 — Career Section WordPress Plugin RCE Scanner Plugin: Career Section career-section CVE ID: CVE-2026-6271 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Vulnerability Type: Unauthenticated Arbitrary File Upload → Remote Code Execution Affected...

CVE-2024-10410

Código fuente Online Hotel Reservation System en PHP/MySQLi con Código Fuente | SourceCodester Descripción Se encontró una vulnerabilidad de alto riesgo en Online Hotel Reservation System, que afecta a la función de carga del archivo /marimar/admin/modroom/controller.php. La operación de evasión ...

CVE-2024-4577

CVE-2024-4577 Exploit for php-cgi...

CVE-2025-29017

CVE-2025-29017 - Internet Banking System 2.0.0 Remote Code Execution via Profile Picture Upload Description A Remote Code Execution RCE vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profilepic parameter within pagesviewclient.php...

CVE-2025-39601

🚨 CVE-2025-39601 - CSRF a RCE en el plugin Custom CSS, JS & PHP de WordPress WordPress Custom CSS, JS & PHP plugin CSRF PoC - WordPress Custom CSS, JS & PHP plugin By : Nxploited | Khaled Alenazi form action="http://...

PHP-CGI-RCE-Scanner

PHP CGI RCE CVE-2024-4577 Scanner Just a tool for educational purposes. No legal responsibility. Scanning CVE-2024-4577 vulnerability with a url list. Not only sending exploit, but also checking PHP version and whether php-cgi exists. Make it more informative to know why or why not exploit succes...

CVE-2025-29306

CVE-2025-29306 FOXCMS黔狐内容管理系统服务参数注入漏洞 一、漏洞简介 FoxCMS是一套可免费商用且开源的网站管理系统,采用PHP+MySQL架构。 FOXCMS黔狐内容管理系统存在服务参数注入漏洞，攻击者可利用该漏洞获取服务器控制权。 二、漏洞影响 FOXCMS黔狐内容管理系统 V1.2 三、复现过程 POC http://xx/images/index.html?id=%24%40printphpinfo 输入Poc访问漏洞页面 发现phpinfo命令执行后的信息...