php_filter_chain_oracle_poc

phpfilterchainoraclepoc Overview The Synacktiv team published an in-depth research article, PHP Filter Chains: File Read from Error-Based Oracle , initially disclosed at DownUnder CTF 2022. This research was based on a challenge by @hashkitten, where players were tasked with leaking the /flag fil...

PHP-binary-bugs

Exploits AI POP Builder 권고 PHP 바이너리 버그 권고 모음 unserialize에서 패치되지 않은 GMP 타입 혼동 아이디어: 지연된 wakeup을 우회하고 PHP = 5.6.40의 패치되지 않은 GMP 타입 혼동 버그를 악용 POC 소스: GMPtypeconfPOC.php 권고 CVE-2022-31626 분석 아이디어: mysqlnd의 힙 버퍼 오버플로, PHP = 7.4.29 POC 소스: ./cve202231626remoteexploit/exploitpoc.py 권고 연락처 Telegram 프로젝트...

Roundcube_CVE-2025-49113

RCE in Roundcube CVE-2025-49113 - My Obsidian note .md date time Status: Completed Lab: Easy Tags: RCE | PHP | LABTHM | EXPLOIT | CVE by KRPT Paulo G. Werneck - Linkedin - in.com/pgw-script Impact : remote command execution post-login CVSS 9.9 Affected versions : ≤ 1.5.10 / 1.6.10 Patched : 1.5.1...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

CVE-2023-4220

Chamilo LMS Unauthenticated Remote Code Execution Exploit CVE-2023-4220 Overview This repository contains a Bash script that exploits an unauthenticated remote code execution RCE vulnerability in Chamilo LMS via arbitrary file write. The vulnerability is identified as CVE-2023-4220. This exploit...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP 객체 주입 PoC Cotonti의 CommentsWidget 구현에서 확인된 PHP 객체 주입 문제에 대한 안전한 로컬 개념 증명입니다. 취약점 프로젝트: Cotonti 영향받는 구성 요소: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — 신뢰할 수 없는 데이터의 역직렬화 CVE/후보: CAN-2026-2035973 / CVE-2026-71294 연구자: Harsh Raj Singhania 취약한 코드 경로는 ci GET 파라미터...

CVE-2024-4577

CVE-2024-4577 Environment Setup Files and PHP Files --poc-- Invoke-WebRequest -Method POST -Headers @"Content-Type" = "application/x-www-form-urlencoded" -Body "" -Uri "http://localhost/test.php?%ADd+allowurlinclude%3D1+%ADd+autoprepend file%3Dphp://input"...

CVE-2025-34100-demo

CVE-2025-34100-demo Demo web server !NOTE Please note that this is just the PHP files for the website, to understand the CVE better and create a more effective PoC, visit https://nvd.nist.gov/vuln/detail/CVE-2025-34100 These files will not cause the CVE, but rather are the entry point to exploit...

CVE-2024-4577

CVE-2024-4577 Vulnerability Checker This script is designed to check for the vulnerability described by CVE-2024-4577, which involves exploiting certain PHP configurations to execute arbitrary code remotely. It sends a POST request to specified endpoints on a list of domains and checks if the...

CVE-2024-10449-patch

Patch for CVE-2024-10449 https://nvd.nist.gov/vuln/detail/CVE-2024-10449 Steps: Download the patched loginAction.php file from this repository https://raw.githubusercontent.com/g-u-i-d/CVE-2024-10449-patch/refs/heads/main/loginAction.php and replace the vulnerable version with this one. Edit the...

CVE-2024-4577

Just for researching Poc For Default XAMPP curl -v -d "" http://127.0.0.1/php-cgi/php-cgi.exe/?%add+allowurlinclude%3Don+-d+autoprependfile%3Dphp%3A//input+-d+cgi.forceredirect%3D0...

CVE-2024-51430

CVE-2024-51430 Vulnerability Type Cross-Site Scripting XSS Description Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component Vendor of...

CVE-2023-41892_poc

CVE-2023-41892poc Customized this for my own use pocnoauth.py Basic PHP one-liner webshell OS command execution via ?cmd= pocauth.py Simple key-based authentication added webshell SHA-256 hash comparison method Commands can only be executed if the correct key is provided Code modification require...

cve-2024-37762

Описание MachForm до версии 21 подвержен аутентифицированной неограниченной загрузке файлов, что приводит к удаленному выполнению кода. Приложение предоставляет возможность создания формы с функцией загрузки файлов. Хотя по умолчанию принимаемые файлы ограничены общим безопасным набором, создател...

CVE-2015-8351

gwollebuster this script is exploit for wordpress old plugin gwolle usage: ./gwollebuster.py first arguments = your target url of wordpress that installed gwolle second arguments = your ip third arguments = listening port for reverse shell example: ./gwollebuster.py http://vulnpress.com/...

CVE-2026-61511-PoC-Exploit

CVE-2026-61511 – vBulletin 사전 인증 RCE 익스플로잇 및 검증 도구 ⚠️ 윤리적 사용 전용 – 승인된 보안 테스트 이 저장소의 도구는 승인된 보안 전문가, 블루 팀, 침투 테스터 만을 위한 것입니다. 승인되지 않은 컴퓨터 시스템 접근은 CFAA미국, Computer Misuse Act영국, TCK 243/244터키 및 전 세계의 유사 법률 에 따라 불법입니다. 📖 취약점 개요 CVE‑2026‑61511 은 vBulletin의 AJAX 템플릿 렌더링 엔진에서 발생하는 PHP eval 주입 결함입니다. 영향을...

CVE-2012-2122-scanner

Usage: php scanner.php 10.0.0.1/18 block in cidr notation Requirements: php5-cli...

CVE-2016-010033-010045

CVE-2016-010033-010045 Php mail RCE CVE-2016-010033/45 imported to python3 Getting Started These instructions will get you a copy of the project up and running on your local machine for development and testing purposes. See deployment for notes on how to deploy the project on a live system...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics 1.7.3 - Remote Code Execution Exploit v2 Working exploit for Open Web Analytics 1.7.3 - RCE enhenced with pentestmonkey's php reverse shell, Fixed issue of not able to find user in cache. Original soruce exploit can be found on here Usage Add your attacker...