113748 matches found
EUVD-2026-116143
A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function sessionregenerateid of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit ha...
CVE-2026-73328
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as...
CVE-2026-121443
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '' to trigger an uncaught ValueError from strpos in...
CVE-2026-73328
The Volmarg Personal Management System (through version 2.1.0 ) contains an unrestricted file upload vulnerability in the /upload/send/ endpoint. This flaw allows authenticated users to upload malicious PHP files by submitting base64 encoded content with a .php filename into the web root. Success...
EUVD-2026-115908
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as...
CVE-2026-73328 Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as...
CVE-2026-73328 Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as...
EUVD-2026-115865
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '' to trigger an uncaught ValueError from strpos in...
CVE-2026-121443
The svg-sanitizer library (versions 1.1.0 before 1.1.1 ) is vulnerable to a Denial of Service (DoS) attack. A remote attacker can crash requests by submitting malformed SVG input containing an unclosed tag, such as a single '
CVE-2026-121443 svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '' to trigger an uncaught ValueError from strpos in...
novahot
novahot novahot is a webshell framework for penetration testers. It implements a JSON-based API that can communicate with trojans written in any language. By default, it ships with trojans written in PHP, ruby, and python. Beyond executing system commands, novahot is able to emulate interactive...
thrift: Apache Thrift: Denial of Service via infinite loop
A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...
MasterPHP2SHELL
PHP2Shell Unified Multi-Repo Orchestrator CVE-2026-109618 +...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-finder A non-destructive, probabilistic finder for...
CVE-2026-121443: darylldoyle svg-sanitizer: svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash…
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '' to trigger an uncaught ValueError from strpos in...
CVE-2026-121502: mathurvishal CloudClassroom-PHP-Project: A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and migh...
CVE-2026-121501: mathurvishal CloudClassroom-PHP-Project: A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project
A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function sessionregenerateid of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit ha...
CVE-2026-73328: volmarg personal-management-system: Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows…
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as...
kadimus
kadimus LFI Scan & Exploit Tool kadimus is a tool to check for and exploit LFI vulnerabilities, with a focus on PHP systems. Features: Check all url parameters /var/log/auth.log RCE /proc/self/environ RCE php://input RCE data://text RCE expect://cmd RCE Source code disclosure Command shell...
StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores
TL;DR: Between September 9 and September 13, 2026, we detected a coordinated campaign exploiting Magento and Adobe Commerce stores across Western Europe, North America, and the Asia-Pacific region. The activity used /paypal/transparent/response/, an endpoint tied directly to StyleSmuggler...