MetInfo CMS <= 8.1 - Remote Code Execution

MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests. id: CVE-2026-29014 info: name: MetInfo CMS = 8....

Dolibarr <=22.0.4 - Local File Inclusion

Dolibarr = 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files. id: CVE-2026-34036 info: name:...

ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)

ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzzfile.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter, exploit requires attacker to send malicious URL and...

Php-mod/curl Library <2.3.2 - Cross-Site Scripting

Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the postfilepathupload.php key parameter and the POST data to postmultidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other...

PHPGurukul Hospital Management System - Cross-Site Scripting

PHPGurukul Hospital Management System in PHP 4.0 contains multiple cross-site scripting vulnerabilities. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2020-5191 info: name: PHPGurukul Hospital Management System -...

Xerte Online Toolkits <= 3.15 - Remote Code Execution

Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication CVE-2026-34413, because the access-control redirect for unauthenticated users does not call exit/die and execution continues server-side. This is...

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

Tutor LMS WordPress plugin 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output. id: CVE-2026-19092...

OpenCATS - Command Injection

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard. id: CVE-2026-277...

Cacti cmd_realtime.php - Command Injection

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. In cmdrealtime.php line 119, the $pollerid used ...

Seo By 10Web < 1.2.7 - Cross-Site Scripting

The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id:...

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

KindEditor 4.1.11 - Cross-Site Scripting

KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter. id: CVE-2019-7543 info: name: KindEditor 4.1.11 - Cross-Site Scripting author: pikpikcu severity: medium description: KindEditor 4.1.11 contains a cross-site scripting vulnerability via the...

PHPGurukul Hospital Management System 4.0 - SQL Injection

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain sensitive database information. id: CVE-2020-22165 info: name: PHPGurukul Hospital Management System 4.0 - SQL Injection...

MapTiler Tileserver-php v2.0 - Unauthenticated File Read

MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests id: CVE-2025-44137 info: name: MapTiler Tileserver-php v2.0 -...

Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible printphpinformation.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PH...

Dockwatch <= 0.6.567 - OS Command Injection

Dockwatch through 0.6.567 contains an unauthenticated command injection caused by missing exit after authentication redirect in loader.php and unsanitized input in ajax/compose.php, letting remote attackers execute arbitrary shell commands, exploit requires seeding a session flag via incomplete...

WordPress Core - PHP Template Path Traversal

An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. id: CVE-2026-87902 info: name: WordPress...

CVE-2024-4577-RCE

PHP CGI 参数注入 CVE-2024-4577 远程代码执行 📜 描述 在 PHP 8.1.（8.1.29 之前）、8.2. （8.2.20 之前）、8.3.（8.3.8 之前）版本中，当在 Windows 上使用 Apache 和 PHP-CGI 时，如果系统设置为使用某些代码页，Windows 可能会使用“最佳适配”行为来替换传递给 Win32 API 函数的命令行中的字符。PHP CGI 模块可能会将这些字符错误解释为 PHP 选项，从而允许恶意用户向正在运行的 PHP 二进制文件传递选项，进而泄露脚本源代码、在服务器上执行任意 PHP 代码等。 “XAMPP...

phpstress

phpstress Prueba de concepto de Night Lion Security de denegación de servicio / probador de estrés para sitios web PHP que se ejecutan en sistemas Apache y NGINX PHP-FPM y PHP-CGI Usando una conexión estándar de cable/DSL, este ataque puede inundar la CPU y RAM de un servidor web Linux usando...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - 远程代码执行 RCE 由 kaal 开发的漏洞利用程序 漏洞利用程序 1. HotelDruidExploit.py 此漏洞利用程序将创建一个新房间，并以我们的 PHP 负载作为房间名称。 用法： $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2. HotelDruidExploitRoom.py 此漏洞利用程序在您已知房间名称时有效。 用法： $ ./HotelDruidExploitRoom.p...