CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE Exploit Tool CVE-2023-41425 This Python-based offensive security tool automates the exploitation of a Remote Code Execution RCE vulnerability in WonderCMS 4.3.2 , specifically CVE-2023-41425. It streamlines the process of crafting a malicious ZIP theme module and delivering a...

OpenEMR-RCE

OpenEMR RCE exploit / PoC OpenEMR --shell --user --password --debug exploit.rb semi-auto --root-url --user --password --payload --lhost --lport --debug exploit.rb auto --root-url --user --password --lhost --lport --debug exploit.rb -H | --help Options: -r , --root-url Root URL base path including...

php2shell-CVE-2026-109618-CVE-2026-109619-PoC

php2shell — CVE-2026-109618 / CVE-2026-109619 Critical Advisory CVSS v4.0: 9.2 - Critical: On October 20, details of two pre-auth Remote Code Execution RCE flaws in the PHP core leaked online ahead of coordinated disclosure. Exploitation allows arbitrary command execution straight from the web...

D-RAT_VB.NET_MySQL_PHP

D-RATVB.NETMySQLPHP D-RAT VB.NET+MySQL+PHP The project is composed of "D-RAT" server and client "D-STUB" Programming for the client and server languages: "VB.NET Framework 2" Database: "MySQL" Web page: "PHP" https://www.youtube.com/watch?v=opBbmQ5BRFk...

CVE-2022-48197

CVE-2022-48197 Since Yahoo is no longer updating the project per this announcement: https://yahooeng.tumblr.com/post/96098168666/important-announcement-regarding-yui, I've decided to disclose the vulnerabilities here: The application has a lot of reflected XSS vulnerabilities in pretty much most...

php2shell-scanner

php2shell-scanner A command-line tool for detecting CVE-2026-109618 and CVE-2026-109619 in PHP applications. How It Works The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1...

CVE-2019-11043

PoC CVE-2019-11043 A Python implementation of the CVE-2019-11043 exploit The exploit recorded as CVE-2019-11043 takes advantage of a bug in the implementation of PHP-FPM in conjunction with a NGINX server. In certain configurations, a regular expression in the FastCGI pathinfo causes the FPM modu...

0-click-RCE-Exploit-for-CVE-2024-51791

CVE-2024-51791 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 This repository contains a proof-of-concept exploit for CVE-2024-51791, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress forms plugin, leading to...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Reflected Cross Site Scripting Vulnerability A reflected Cross Site Scripting vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. https://vulners.com/cve/CVE-2021-37833...

CVE-2023-42326

pfSense 2.7.0 Command Injection Exploit CVE-2023-42326 This Python script is a Proof-of-Concept PoC exploit for the command injection vulnerability CVE-2023-42326 in pfSense 2.7.0. The vulnerability allows authenticated attackers to inject and execute arbitrary commands via the...

CVE-2016-16113-POC

Get RCE - Bludit CMS Exploit | | / / \ / | | \ \ / / ' | | | | ' | | | | | \ V /| | | | || | | | | | | | ,|/ / || ||/|| || ||| An automated exploitation tool that combines CVE-2019-17240 Authentication Bypass and CVE-2019-16113 Arbitrary File Upload to achieve remote code execution on...

CVE-2020-13756-env

CVE-2020-13756 Vulnerable Environment Vulnerable test environment for CVE-2020-13756 - Sabberworm PHP CSS Parser Remote Code Execution. Vulnerability Details Field| Value ---|--- CVE| CVE-2020-13756 Product| Sabberworm PHP CSS Parser Vulnerable Versions| getSelectorsBySpecificity' ' . $GET'n'; //...

CVE-2019-11043

CVE-2019–11043: PHP-FPM Nginx Remote Code Execution Vulnerability Vulnerability Description and Impact CVE-2019–11043 is a remote code execution RCE vulnerability. It affects PHP-FPM, which is a FastCGI Process Manager that is commonly used with Nginx web servers. The flaw arises from inadequate...

tpadmin-CVE-2026-2113-poc

tpadmin-CVE-2026-2113-poc A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload. Vulnerability Description A critical Remote Code Execution vulnerability exists in H-ui.admin system's WebUploader preview component. The...

textpattern-exploit-rce

Textpattern = 4.8.3 Remote Code Execution Authenticated Textpattern until version 4.8.3 allows authenticated users to upload any PHP file. This script automates the process and allows to delete the uploaded file. Usage python3 exploit.py -t TARGET -u USER -p PASSWORD -c COMMAND -f FILENAME -d -t:...

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-4439...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

CVE-2015-10141

CVE-2015-10141 Exploit Title: xdebug Unauthenticated Command Execution Exploit Author: D3Ext Vendor Homepage: https://xdebug.org/ Sofware Link: https://pecl.php.net/package/xdebug/2.5.5/windows Version: 2.5.5 Tested on: Kali Linux 2025 CVE: CVE-2015-10141 Explanation An unauthenticated OS command...

CVE-2024-29895

CVE-2024-29895 Cacti CVE-2024-29895 POC A command injection vulnerability allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m Usage: app -m http://site.com/ -c...

WordPress Gravity Forms 3.1.2 PHP Object Injection

WordPress Gravity Forms version 3.1.2 and prior contain an unauthenticated PHP object injection vulnerability in Post Custom Field List inputs with content templates enabled. The included proof of concept identifies forms and fields and submits a supplied serialized payload...