CVE-2026-104356-pictshare-weak-delete-code

CVE-2026-104356 — Predictable deletecode via rand in PictShare Authorized security research. PoC for defensive and educational use only. PictShare generates the deletecode authorization token with getRandomString, which draws every character from PHP's non-cryptographic rand. Because rand is not ...

CVE-2023-46304

CVE-2023-46304 Authenticated Remote Code Execution in VTiger Open Source CRM v7.5 Summary A vulnerability exists in the Users module in the current release of VTiger CRM Open Source version 7.5.0 which allows an authenticated attacker to write and execute arbitrary PHP code to config.inc.php...

php_filter_chains_oracle_exploit_for_CVE-2023-6199

PHP filter chains: file read from error-based oracle. Updated Script to exploit CVE-2023-6199 A CLI to exploit parameters affected by the file read caused by the the error-based oracle of PHP filter chains. It can be used to leak the content of a local file when passed to vulnerable functions, su...

CVE-2018-17553

CVE-2018-17553 CVE-2018-17553 PoC Navigate CMS version 2.8 and prior This proof of concept was put together when working on the Black Pearl box from TCM. I couldn't find anyone that put out a PoC other than just using Metasploit. As I'm avoiding Metasploit in my hacking journey to then go back an...

RCE-QloApps-CVE-2024-40318

RCE-QloApps-CVE-2024-40318 A remote code execution RCE attack allow an attacker run code on a computer. The ability to execute code could lead to deploying additional malware or stealing sensitive data or even harm the server. The remote code execution was discover in Qloapps version 1.6.0.0 whil...

p0wny-shell

p0wny@shell: -- Shell PHP monofile p0wny@shell: è una shell PHP monofile molto basilare. Può essere usata per eseguire rapidamente comandi su un server quando si esegue il pentesting di un'applicazione PHP. Usala con cautela: questo script rappresenta un rischio per la sicurezza del server...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Proof-of-Concept A Proof-of-Concept PoC exploit for CVE-2018-16763 Fuel CMS - Preauthenticated Remote Code Execution. Description This Python 3 program serves as a PoC for the CVE-2018-16763 vulnerability in the Fuel CMS content management system. Specifically, the vulnerability...

CVE-2024-2054

CVE-2024-2054 Aplicación web administrativa de Artica-Proxy: deserialización insegura RCE Una prueba de concepto de exploit para la aplicación web administrativa ARTICA PROXY CVE-2024-2054 Entrada del blog Más detalles aquí:...

CVE-2024-50970

CVE-2024-50970 Description A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

CVE-2022-35914

CVE-2022-35914 PoC References https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc Credit to Sébastien Copin for the PoC I adapted here Check out my full writeup here: https://link.medium.com/tBwDlpQl3Ib Usage pip install -r...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Unauthenticated PHP Object Injection Description The Lis Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.1 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2022-29359

School Club Application System Issue: Unauthenticated Stored Cross-Site Scripting to HTML injection to RCE Author: Zak Clifford Date: 12.04.2022 Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html Software:...

CVE-2023-50564

CVE-2023-50564 For educational purposes only. This script abuses CVE-2023-50564 to upload a reverse-php shell to the target server. You can use a shell like this one. Just zip the php file and pass the zip to this script. Example python3 cve-2023-50564.py -u http://idonot.exist -f shell.zip -p...

CVE-2025-26198

🛡️ CVE Disclosure: CVE-2025-26198 — SQL Injection in CloudClassroom-PHP-Project Disclosure Date: 18 June 2025 CVE ID: CVE-2025-26198 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in CloudClassroom-PHP-Project v1.0, specifically within the loginlinkadmin.php...

better-poc-for-CVE-2018-15133

Better PoC for CVE-2018-15133 An automated PoC for CVE 2018-15133 All credits goes to kozmic who made the original PoC of CVE 2018-15133 This is just an automation script i made while doing some lab box having this vulnerability because i didnt want to make a new deserialized object with phpggc...

CVE-2024-7094

CVE-2024-7094 CVE-2024-7094 Vulnerability checker Vulnerability type: PHP Code Injection...

CVE-2024-32830-poc

CVE-2024-32830-poc PoC code to download files with CVE-2024-32830 getimagesize bypass To bypass the getimagesize restriction, we can create a simple image/vnd.wap.wbmp image for PHP. The check for the filetype is very simple: //...

CVE-2024-25600

MODIFIED CVE-2024-25600 original - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT WordPress Bricks Builder RCE Exploit A Python exploit for CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution vulnerability. Description This tool exploits a critical vulnerability in WordPress...

CVE-2026-48908-by-yora

🔐 CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder — Unauthenticated File Upload / Potential RCE Developed byyora 📌 About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...

CVE-2026-94676

The Tainacan Community Tainacan WordPress plugin is vulnerable to PHP Object Injection due to the deserialization of untrusted data . This vulnerability affects versions from n/a through 1.3.0 . An attacker could potentially exploit this to perform unauthorized actions. No specific exploit links ...