cve-2026-82222-poc

CVE-2026-82222 GiveWP & %는 사용할 수 없으며, 공백은 $IFS로 변환됩니다. 탐지에 실패하면 양식 ID를 전달하세요. 활성화된 게이트웨이를 스크립트가 찾지 못하면 -g를 전달하세요. 기부 요청은 종종 HTTP 500을 반환하거나 타임아웃됩니다. 이는 정상입니다. 세션 쓰기가 먼저 발생합니다. system 출력은 디스크의 파일이 아닌 다음 요청/?giveaction=viewreceipt 등에 포함됩니다. 나머지 옵션은 python cve-2026-82222.py -h를 참조하세요. 공격 체인 1. POST...

PHP-CGI-Argument-Injection-Exploit

🎬 This YouTube video 1️⃣ Target Check Determine the Metasploitable IP from Kali: ip a For example: Kali: 192.168.56.101 Metasploitable2: 192.168.56.102 Let's check the port and service: nmap -p 80 192.168.56.102 You can also check in the browser: http://192.168.56.102/ 2️⃣ Start Metasploit...

CVE-2022-24637

Vulnerable Application Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with ' and get IPAddress, e.g 172.22.0.2 Database...

CVE-2025-44136

CVE-2025-44136 Unauthenticated XSS in MapTiler Tileserver-php v2.0. Description MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to...

CVE-2009-4623

CVE-2009-4623 Advanced Comment System 1.0 Reverse Shell Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACSpath parameter to 1 index.php and 2 admin.php in advancedcommentsystem/. NOTE: this...

CVE-2017-9841-EXPLOIT

CVE-2017-9841 - PHPUnit Remote Code ExecutionRCE This vulnerability affects PHPUnit versions before 4.8.28 and all 5.x versions before 5.6.3. It allows attackers to execute arbitrary PHP code on servers where PHPUnit is exposed. The issue exists in the eval-stdin.php file located in PHPUnit's...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

0-click-RCE-Exploit-for-CVE-2024-51793

CVE-2024-51793 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 This repository contains a proof-of-concept exploit for CVE-2024-51793, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress plugin, leading to remote...

CVE-2026-17544

CVE-2026-17544 — PHP bcmath OOB 쓰기 → 범용 메모리 전용 RCE CVE-2026-17544 에 대한 무기화된 개념 증명PoC으로, PHP의 재작성된 bcmath 확장bcstr2num에서 발생하는 out-of-bounds 쓰기 취약점입니다. 이는 공개적으로 알려진 DoS 전용 크래시를 완전하고 보편적이며 메모리 전용인 원격 코드 실행 프리미티브 로 변환하며, 동시에 disablefunctions 및 openbasedir을 모두 우회합니다. 승인된 연구 / 교육용으로만 사용하십시오. 자신이 소유했거나...

Test-7-2-1-PHP-CVE-2018-5711

This repository does not have a README...

CVE-2021-40904

CVE-2021-40904 - RCE via CheckMk's Dokuwiki embedded application Application: CheckMK Management Web Console Software Revision: From 1.5.0 to 1.5.0p25 Attack type: RCE Solution: Upgrade to version 1.6 or higher. Summary: The web management console of CheckMk Raw Edition versions 1.5.0 to 1.5.0p25...

CVE-2021-44967

CVE-2021-44967: LimeSurvey RCE Description This Proof-of-Concept POC can be used to exploit CVE-2021-44967 to upload and execute a malicious LimeSurvey PHP plugin as administrator to obtain a reverse shell. A Remote Code Execution RCE vulnerabilty exists in LimeSurvey 5.2.4 via the upload and...

CVE-2023-46818

CVE-2023-46818 - ISPConfig PHP Code Execution | Exploit High Remote Code Execution in ISPConfig PoC implementation. Resume ISPConfig versions /admin/languageedit.php — ISPConfig vulnerable endpoint 🚀 Launching the Exploit Run the exploit script CVE-2024-47533.py. python3 CVE-2023-46818.py -u -U -...

CVE-2019-9081_PoC

CVE-2019-9081poc Poc for CVE-2019-9081, this CVE is just a new POP chain. The project is a pre-built vulnerable Laravel 5.7.x application with an entry point for POI vulnerability at URI /deserialize POST-request. Lab setup: Starting the vulnerable application: $ git clone...

FOXCMS-CVE-2025-29306-POC

FOXCMS Parameter Injection RCE – CVE-2025-29306 This repository contains a Python-based PoC for a Remote Code Execution RCE vulnerability affecting FOXCMS v1.2, a Chinese open-source content management system. CVE-ID: CVE-2025-29306 Affects: FOXCMS v1.2 Type: Service Parameter Injection → Code...

TeamPass

Teampass Self-hosted password management your whole team can trust Folder-level access control · authenticated AES-256-GCM encryption · compliance evidence Your secrets never leave your infrastructure. 🌐teampass.net · 📖Documentation · 💬Discussions · 🐳Docker Hub Contents About Who it's for Securit...

lua-ffi-libinjection

Name lua-resty-libinjection - LuaJIT FFI bindings for libinjection Status This library is in active development and is production ready Description This library provides FFI bindings for libinjection, a SQL/SQLi and XSS tokenizer and analyzer. Installation Install this library as you would any...

CVE-2024-4577

This is POC of CVE 2024-4577 This exploit allows attacker to perform RCE in PHP Versions such as PHP 8.3 8.3.8 PHP 8.2 8.2.20 PHP 8.1 8.1.29 Arguments you can check from code! To read more about this particular exploit check nist.gov...

CVE-2026-82222-MassExploit

CVE-2026-82222 — GiveWP WordPress 플러그인 인증 없이 원격 코드 실행 치명적인 인증 없는 원격 코드 실행 CVSS 9.8 — GiveWP ≤ 4.16.7.1 이 도구는 WordPress GiveWP 플러그인의 취약점인 CVE-2026-82222 을 악용하며, 인증되지 않은 공격자 가 PHP 객체 주입POP 체인 역직렬화 공격을 통해 서버에서 임의의 명령을 실행할 수 있게 합니다. ⚠️ 취약점 개요 속성| 값 ---|--- CVE ID| CVE-2026-82222 CVSS 점수| 9.8 치명적 CWE|...

php-exploit_cve-2022-31630

CVE-2022-31630 – Proof of Concept Exploit Warning: This code is made only for educational purposes and testing in an isolated laboratory environment. Use on other systems without permission is illegal and irresponsible. 📌 Description CVE-2022-31630 is an Out-of-Bounds OOB Read vulnerability in th...