CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC Exploit alt text ExploitDB Dompdf versions 1.2.1 are vulnerable to Remote Code Execution RCE by injecting CSS into the data. The file can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed b...

MSAPer

MSAPer | CVE-2023-3076 - MStore API Automatic Mass Tool for check and exploiting vulnerability in CVE-2023-3076 - MStore API install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use Make sure you already install Parallel! Then do: git clone...

bucky

Project is on temporary hold. Bucky Bucky is an automatic tool designed to discover S3 bucket misconfiguration, Bucky consists up of two modules Bucky firefox addon and Bucky backend engine. Bucky addon reads the source code of the webpages and uses Regular ExpressionRegex to match the S3 bucket...

CVE-2023-50564_Pluck-v4.7.18_PoC

CVE-2023-50564 PoC This repository contains a Proof of Concept for CVE-2023-50564 vulnerability in Pluck CMS version 4.7.18 Description CVE-2023-50564 is a vulnerability that allows unauthorized file uploads in Pluck CMS version 4.7.18. This exploit leverages a flaw in the module installation...

CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

CVE-2026-108750

The OpenDocMan application versions 2.4.0 through 2.10.0 is vulnerable to a decompression bomb (CWE-409) during the upload text extraction process. This flaw allows authenticated users to exhaust PHP memory by uploading small, specially crafted ODT, DOCX, or XLSX files. When processed, the XML en...

EUVD-2026-96915

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

hostscan

hostscan 0.2 Hostscan is a php tool which allows you to scan specific range of hosts, mostly for information gathering and testing for weak passwords. I guess it's a pentest tool, i'd created it to automate some tests that i often do. Since it's PHP, it works quite slowly compared to client-side...

CVE-2026-48909

CVE-2026-48909 — SP LMS PHP Object Injection → RCE Unauthenticated Remote Code Execution via PHP Object Injection in JoomShaper SP LMS comsplms ≤ 4.1.3 for Joomla CMS. Author: Amin İsayev / Proxima Cyber Security Overview SP LMS is a popular Joomla Learning Management System extension by JoomShap...

OpenEMR_Vulnerabilities

OpenEMR Remote Code Execution Vulnerability OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious php codes. PoC git clone https://github.com/EmreOvunc/OpenEMRVulnerabilities.git cd OpenEMRVulnerabilities python3 openemrrcepoc.py -t http://127.0.0.1/openemr -u admin -p...

CVE-2015-6967

CVE-2015-6967 Nibbleblog 4.0.3 - Arbitrary File Upload CVE-2015-6967 requirements python 3 requests usage usage: exploit.py -h --url URL --username USERNAME --password PASSWORD --payload PAYLOAD optional arguments: -h, --help show this help message and exit --url URL, -l URL --username USERNAME, ...

CVE-2023-46818-python-exploit

CVE-2023-46818 exploit This is a python version of the original php script for the vulnerability affecting ispconfig 3.2.11 and previous versions. Original PHP source: https://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html This proof-of-concept is intended for...

CVE-2016-3141

CVE-2016-3141 1. Vulnerability Detail. Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service memory corruption and application crash or possibly have unspecified other impact by triggering a...

vapi

vAPI vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises. Requirements PHP MySQL PostMan MITM Proxy Installation Docker docker-compose up -d Installation Manual Copying the Code cd git clone...

vapi

vAPI vAPI es una Interfaz Programada Adversamente Vulnerable que es una API auto-alojable que simula los escenarios del OWASP API Top 10 en forma de ejercicios. Requisitos PHP MySQL PostMan MITM Proxy Instalación Docker docker-compose up -d Instalación Manual Copiando el Código cd git clone...

tinyfilemanager-wh1z-edition

Tiny File Manager WH1Z-Edition Te presentamos Tiny File Manager WH1Z-Edition, la solución compacta y eficiente para gestionar tus archivos y carpetas con funciones mejoradas de privacidad y seguridad. Se acabaron los días de depender de recursos externos: he reducido el código a su núcleo,...

CVE-2024-4577

Orange Tsi 🍊 This vulnerability was found by Orange Tsai @orange8361 of DEVCORE @d3vc0r3. Make sure to follow his outstanding research, our role was to only recreate and develop the exploit for this issue. Security Alert: CVE-2024-4577 PHP CGI Argument Injection Vulnerability Overview CVE-2024-45...

PHP-Shell-Detector

Detector de Web Shells Web Shell Detector – es un script PHP que te ayuda a encontrar e identificar shells php/cgiperl/asp/aspx. Web Shell Detector cuenta con una base de datos de firmas de "web shells" que permite identificar "web shell" hasta en un 99%. Gracias al uso de las últimas tecnologías...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP & % in the command; spaces become $IFS. Pass a form id if discovery misses. Pass -g if the script cannot find an enabled gateway. The donation request often returns HTTP 500 or times out. That is expected. The session write...

limitrr-php

Light rate limting within PHP using Redis. Limitrr PHP is very heavily inspired by my other library, Limitrr which was created for NodeJS. Check it out here Limitrr PHP allows users to easily integrate rate limiting within their application. Unlike other similar packages, this utility allows the...