pfsense-rss-file-redirect

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-rss-file-redirect pfsense-rss-file-redirect Class: File read Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org isURL is not HTTP-only. SimplePie fixprotocol rewrites direct file:// to http...

GHSA-6VFX-W7Q3-42GQ AdminNeo SQLite Database-List Drop Arbitrary File Deletion

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values direct...

CVE-2026-19658

CVE-2026-19658 — Give Tributes Unauthenticated PHP Object Injection Python 3 proof-of-concept scanner and donation-chain exploit helper for CVE-2026-19658 in the WordPress add-on Give - Tributes Liquid Web / GiveWP. | ---|--- Platform| WordPress plugin requires GiveWP core Component| Give -...

CVE-2021-44967

CVE-2021-44967: LimeSurvey authenticated RCE Proof of concept for CVE-2021-44967. The script authenticates to LimeSurvey, uploads and activates a PHP plugin, and triggers a reverse shell. Use this only against systems you own or are authorized to test. Requirements Python 3 beautifulsoup4,...

CVE-2026-84753

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-84753 Write-up: https://abraxaslabs.tech/research/CVE-2026-84753 CVE-2026-84753 Mail Mint 1.31.0 - WPFunnels I am @abraxasnull. Loopback lab. The client is CVE-2026-84753-Abraxas-Labs.py. The function is name...

CVE-2026-48908-joomla-sp-page-builder-detection

CVE-2026-48908 — Joomla SP Page Builder Validation and Detection Laboratory validation of CVE-2026-48908 in the Joomla SP Page Builder component, focused on technical evidence, event reconstruction, and defensive detection opportunities. The repository documents a controlled test in which the SP...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

🛡️ Operation Fire Pole: The Heroic Ts PHP2Shell Emergency Shi...

CVE-2026-49049

CVE-2026-49049 This repository contains a Python-based scanner and proof-of-concept for a vulnerability in the Joomla Helix3 component. The bug is an arbitrary file write issue that can lead to remote code execution RCE when an attacker is able to write a PHP payload into a web-accessible locatio...

CVE-2023-6933

Introduction to CVE-2023-6933 Vulnerability Description The "Better Search Replace" plugin for WordPress exhibits a critical vulnerability known as PHP Object Injection. This security flaw is present in all versions up to and including 1.4.4. It arises from the deserialization of untrusted input,...

CVE-2025-34030-PoC

CVE-2025-34030 - sar2html 'plot' parameter RCE CVSS: 10.0 Critical Vulnerability: OS Command Injection Programming Language: PHP Exploit Code: Python References: https://nvd.nist.gov/vuln/detail/CVE-2025-34030 https://www.vulncheck.com/advisories/sar2html-command-injection Description sar2html...

CVE-2026-109619

CVE-2026-109618 / CVE-2026-109619 PHP2Shell RCE ★ CVE-2026-109618 / CVE-2026-109619 PHP session.uploadprogress Pre-Auth RCE PoC ★ Overview PHP2Shell CVE-2026-109618 / CVE-2026-109619 is an unauthenticated Remote Code Execution flaw in PHP under Apache modphp. A crafted multipart/form-data request...

advisory

Security Advisories — bl4dsc4n Public repository containing security advisories, technical analyses, and Proof-of-Concepts PoCs for vulnerabilities independently discovered in open-source software. All vulnerabilities were identified through manual source code review, secure code analysis, and...

opencode-skills

OpenCode Skills A production-grade skill pack for OpenCode...

WordPress PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin PDF Invoice Builder for WooCommerce versions = 7.1.1...

Online-Examination-System

Online-Examination-System a full web platform with 3 roles: Ad...

php-eol-cve-2026-109618-109619

CVE-2026-109618 / CVE-2026-109619 patches for end-of-life PHP 7.3 on EL7, 5.4 / 5.3 on Amazon Linux Unofficial backports of the PHP security team's minimal mitigation for the two critical, unauthenticated remote code execution vulnerabilities announced on 2026-10-21: CVE| Advisory| Summary...

CVE-2024-4577

CVE-2024-4577 Argument injection vulnerability in PHP INSTALL git clone https://github.com/didarul342/CVE-2024-4577.git cd CVE-2024-4577 pip3 install -r requirements.txt USAGE Scan A Target python3 CVE-2024-4577.py -t https://160.153.61.66/ -c "" Scan a list of Targets python3 CVE-2024-4577.py -f...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP Object Injection PoC Safe local proof of concept for the PHP object injection issue identified in Cotonti's CommentsWidget implementation. Vulnerability Project: Cotonti Affected component: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — Deserialization of...

CVE-2019-11043

CVE-2019-11043 Vulnerability Description When Nginx's fastcgisplitpathinfo processes requests containing %0a, it encounters a newline \n causing PATHINFO to be empty. Meanwhile, php-fpm has a logic flaw when handling empty PATHINFO. An attacker can achieve remote code execution through careful...

Php-unit-CVE-2017-9841

phpunit Remote Code Execution Vulnerability CVE-2017-9841 Composer is a PHP package management tool. Using Composer to install extension packages will create a vendor folder in the current directory and place all files in it. Usually this directory should be placed outside the web root so that...