CVE-2026-55810 Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2...

CVE-2026-55810 Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2...

CVE-2026-55809 Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-12535

The Drupal Formatter Field module (versions 0.0.0 to 2.0.0 ) is vulnerable to Object Injection due to the Improperly Controlled Modification of Dynamically-Determined Object Attributes . The module stores data as PHP-serialized strings , which can be exploited if an attacker writes malicious data...

CVE-2026-54736

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first...

CVE-2026-9726 Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce Basket allows Object Injection. This issue affects Drupal AlternativeCommerce Basket versions: from 0.0.0 to 2.1.17...

GHSA-M5F5-28QR-9G9R prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

Impact A PHP Object Injection vulnerability affects the PrestaShop module psfacetedsearch. The module rebuilds the selected search filters from the request URL. The value of a slider filter price or weight is taken from the URL without sufficient validation, then stored in an internal filter-bloc...

CVE-2026-61450

Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author any admin.pages user, or anyone able to write to user/pages to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method...

EUVD-2026-42903

Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author any admin.pages user, or anyone able to write to user/pages to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method...

PHP Session Hijack / Fixation Audit

Audits PHP session configuration, session.savepath permissions, active session files, and fixation-related ini settings from a PHP webshell session. !/usr/bin/env python3 -- coding: utf-8 -- import os import time from kittysploit import from lib.post.php.helpers import PhpPostHelper class...

WordPress Profile Builder Pro PHP object injection detection

Detects Profile Builder Pro = 3.14.5 unauthenticated PHP object injection via wppbrequestuserspins admin-ajax args parameter. Optionally sends a safe stdClass probe; HTTP 500 indicates deserialization of attacker input. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple...

Imunify360 / ModSecurity Bypass Probe

Tests a battery of PHP execution and signature payloads through the current webshell channel to identify WAF/Imunify/ModSecurity blocking and likely bypass angles. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe WAF / Imunify360 / ModSecurity filters through the active PHP session. Runs...

Apache .htaccess Persistence

Writes a persistence payload into an Apache .htaccess file. The file acts as a CGI/PHP shell triggered on HTTP access htshells / wireghoul technique. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import os import re from kittysploit import from...

WordPress Theme/Plugin Dropper

Installs PHP persistence in a WordPress site via must-use plugin, custom plugin, or theme functions.php append. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

WordPress Profile Builder Pro <= 3.14.5 - PHP Object Injection RCE

Unauthenticated PHP object injection in Profile Builder Pro via the wppbrequestuserspins admin-ajax action args parameter. Full RCE requires a POP gadget chain; this module chains The Events Calendar Monolog ProcessHandler Monolog/RCE10 when that plugin is present. !/usr/bin/env python3 -- coding...

Joomla SP LMS <= 4.1.3 - PHP Object Injection RCE (CVE-2026-48909)

Exploits CVE-2026-48909 in JoomShaper SP LMS comsplms = 4.1.3: unauthenticated PHP object injection via the lmsOrders cookie on the cart view, chaining Joomla FormattedtextLogger to write a webshell. RCE requires Joomla 5.2.2. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotatio...

PHP Auto-Prepend Combo (.htaccess + .user.ini)

Detects Apache/modphp vs PHP-FPM/Nginx stack from a PHP session and deploys persistence via .htaccess, .user.ini, or both best-effort auto selection. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.php.helpers import PhpPostHelper class ModulePost, PhpPostHelper:...

PHP mail() / sendmail RCE Chain

Checks mail availability and sendmailpath, then attempts sendmail argument injection -X to write a PHP file into a writable directory. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.php.helpers import PhpPostHelper class ModulePost, PhpPostHelper: info = "name":...

Joomla SP LMS CVE-2026-48909 (PHP object injection) detection

Detects JoomShaper SP LMS comsplms = 4.1.3 affected by unauthenticated PHP object injection via the lmsOrders cookie CVE-2026-48909. Full RCE requires Joomla 5.2.2 FormattedtextLogger gadget chain. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

Nginx + PHP-FPM Backdoor

Deploys a hidden PHP webshell and an Nginx snippet conf.d or sites-enabled routing requests to PHP-FPM. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...