Joomla SP LMS <= 4.1.3 - PHP Object Injection RCE (CVE-2026-48909)

Exploits CVE-2026-48909 in JoomShaper SP LMS comsplms = 4.1.3: unauthenticated PHP object injection via the lmsOrders cookie on the cart view, chaining Joomla FormattedtextLogger to write a webshell. RCE requires Joomla 5.2.2. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotatio...

LFI Log Poisoning Probe

Chains LFI confirmation with access-log User-Agent poisoning and re-inclusion to validate log-poison → code execution paths. !/usr/bin/env python3 -- coding: utf-8 -- """ LFI log poisoning probe authorized testing only. Confirms a local file inclusion primitive, poisons a web server access log vi...

PHP user.ini Persistence

Deploys a PHP webshell via .user.ini autoprependfile / autoappendfile. Works with PHP-FPM and Apache when userini is enabled. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

PHP mail() / sendmail RCE Chain

Checks mail availability and sendmailpath, then attempts sendmail argument injection -X to write a PHP file into a writable directory. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.php.helpers import PhpPostHelper class ModulePost, PhpPostHelper: info = "name":...

WordPress Profile Builder Pro <= 3.14.5 - PHP Object Injection RCE

Unauthenticated PHP object injection in Profile Builder Pro via the wppbrequestuserspins admin-ajax action args parameter. Full RCE requires a POP gadget chain; this module chains The Events Calendar Monolog ProcessHandler Monolog/RCE10 when that plugin is present. !/usr/bin/env python3 -- coding...

Joomla SP LMS CVE-2026-48909 (PHP object injection) detection

Detects JoomShaper SP LMS comsplms = 4.1.3 affected by unauthenticated PHP object injection via the lmsOrders cookie CVE-2026-48909. Full RCE requires Joomla 5.2.2 FormattedtextLogger gadget chain. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

PHP HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import from modules.transforms.python.protocol.httpchunked import Module as PythonHttpChunkedTransform class...

PHP XOR Stream Transform

XORs the C2 stream with a repeating key and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.xor import Module as PythonXorTransform class ModulePythonXorTransform: """PHP XOR stream transform."""...

PHP HTTPS Mimic Transform

Sends a fake TLS ClientHello then wraps C2 bytes in TLS Application Data records. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpsmimic import CLIENTHELLOBYTES, Module as PythonHttpsTransform, class ModulePythonHttpsTransform:...

PHP Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform: """PHP Base64...

PHP WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PHP WebSocket...

cybersecurity-exam-report

Cybersecurity Exam Project: ProFTPD Exploitation and MySQL Dat...

CVE-2025-11977

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

CVE-2025-11977 HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

EUVD-2025-210450

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

CVE-2026-15070

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inje...

SUSE CVE-2026-59948

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...

[SECURITY] Fedora 44 Update: php-8.5.8-1.fc44

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

EUVD-2026-42736

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the admin.php configuration update process. An attacker can modify administrator settings by tricking a logged-in administrator into submitting a forged POST request, which disables the file...