113811 matches found
Exploit for Improperly Controlled Sequential Memory Allocation in Php
Through Burp use -k since the script won't trust Burp's CA by...
CVE-2026-113673
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell — tek komutluk sarmalayıcı CVE-2026-109618 / CVE-20...
EUVD-2026-109216
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
php2shell-pcaps
PHP2Shell PCAPs Packet captures from the php2shell vulnerabil...
CVE-2026-115806
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-poc CVE-...
CVE-2026-115806 Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...
CVE-2026-115806 Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...
CVE-2026-115806
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 2.2.1 . The flaw exists in the recursiveUnserializeReplace() routine within the migration search-and-replace functionality. An unauthenticated attacker can inject ...
EUVD-2026-109213
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
🛡️ PHP2Shell Sentinel PHP Runtime Vulnerability Assessment...
Exploit for CVE-2026-115560
CVE-2026-115560 — PHP Session Upload Progress serializehandle...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php-stale-global-uaf Someone on the internet can talk to your...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php-oom-longjmp Someone on the internet can talk to your PHP...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
CVE-2026-109619 — PHP stale session global state → RCE A work...
Exploit for CVE-2026-102785
█████╗ ███╗ ██╗ ████████╗ ██╗ ██████╗ ██████╗ ██████...
PHP Session Serialize Handler Confusion
PHP contains a session upload progress serialization handler confusion condition when an application changes its configured handler to php at runtime before sessionstart while upload progress remains enabled. The proof of concept demonstrates attacker-controlled unserialization in a local lab...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143718)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143718 advisory. phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143716)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143716 advisory. When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the...