phpwarden

phpwarden A unified PHP security platform. One tool, one...

WordPress Prime Mover – Backup and Migration plugin <= 2.2.1 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Civitasmass in WordPress Plugin Migrate WordPress Website & Backups – Prime Mover versions = 2.2.1...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell - CVE-2026-109618 / CVE-2026-109619 Alat riset keam...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP-FPM CVE-2026-109618 research lab This repository is a sel...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell Unauthenticated remote code ex...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Adobe Commerce

CVE-2026-75650 -- "StyleSmuggler" unauthenticated RCE in Magen...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell — WordPress Pre-Auth RCE CVE-2026-109618 / CVE-2026...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

🛡️ PHP2Shell Vulnerability Scanner & Hardening Toolkit Aud...

Exploit for CVE-2026-115560

PHP CVE 2026-115560 CHECKER V 1.0 !Pythonhttps://img.shiel...

elFinder <= 2.1.47 - Command Injection

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. The vulnerability occurs when performing image operations on JPEG files, where the filename is passed to the exiftran utility without proper sanitization, allowing command injection. id: CVE-2019-9194 info: name:...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP session.uploadprogress Heap Use-After-Free - Pre-Auth RCE v...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP session.uploadprogress File Poisoning + LFI -- Pre-Auth RCE...

EUVD-2026-109578

A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-116097

A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

VulnCheck KEV: CVE-2026-11565

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146100 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

F5 Networks BIG-IP : PHP vulnerabilities (K000163821)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.7 / 17.5.1.11 / 21.1.0.4 / Hotfix- BIGIP-17.1.3.6.0.9.20-ENG / Hotfix-BIGIP-17.5.1.10.0.37.35-ENG. It is, therefore, affected by multiple vulnerabilities as referenced in the K000163821 advisory. CVE-2026-109618also...

PHP Stale Internal Request-State Vulnerability

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution...

PT-2026-125506

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

JANUS: Synthesizing Cross-Layer Defenses against Web Deserialization Attacks

Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit diverse exploit variants that evade defenses tailored to a known exploit. Existing defenses typically operate at a single enforcement point with limited visibility into the full...