CVE-2025-49132-PHP-PEAR

CVE-2025-49132: Pterodactyl Panel RCE non autenticata tramite metodo PHP PEAR Indice Panoramica Dettagli sulla vulnerabilità Analisi tecnica Flusso dell’exploit Installazione Utilizzo Esempi Mitigazione Disclaimer Riferimenti Autore Panoramica Questo repository contiene un proof-of-concept PoC pe...

CVE-2020-0688

CVE-2020-0688 Scanner Questo è un piccolo script sporco per verificare la presenza di server Exchange vulnerabili a CVE-2020-0688 È scritto male ed in PHP. Attenzione: controlla solo se hai installato l'aggiornamento CU attuale. Ciò non significa che hai installato la patch di correzione! Requisi...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Inclusione Locale di File Non Autenticata 📝 Descrizione Il plugin Kubio AI Page Builder per WordPress è vulnerabile all'Inclusione Locale di File in tutte le versioni fino alla 2.5.1 inclusa tramite la funzione kubiohybridthemeloadtemplate. Ciò rende possibile ad...

astrolock

Astrolock Un'applicazione deliberatamente vulnerabile per dimostrare tecniche di contrabbando di payload PHP in file PNG...

PHP-8.1.0-dev_WebShell-RCE

PHP 8.1.0-dev WebShell RCE Non autenticato Codice Exploit per PHP 8.1.0-dev WebShell RCE Non autenticato Risultato atteso: sfruttare la backdoor installata sul server PHP 8.1.0-dev ottenendo così una WebShell per eseguire comandi da remoto. Destinato solo a scopo educativo e a test in ambienti...

PHP_imap_open_exploit

PHPimapopenexploit Bypass delle funzioni exec disabilitate in PHP tramite imapopen Debian e Ubuntu Report originale di CRLF: https://bugs.php.net/bug.php?id=76428...

my-cool-demo-php-code

Il Mio Fantastico Codice PHP Demo! Questa repository contiene una cosa notoriamente molto brutta. Cosa sarà mai? Potrebbe essere collegata a un noto CVE ID?...

CVE-2024-4577-rayng

CVE-2024-4577 - Lab di Rilevamento dell'Iniezione di Argomenti PHP CGI Un laboratorio completo di detection engineering per CVE-2024-4577 Iniezione di argomenti PHP CGI. Include box Vagrant preconfigurate, regole Wazuh SIEM e strumenti di exploit per l'addestramento del Blue Team. Cosa è incluso ...

exploit-CVE-2025-49113

مستودع PoC لـ CVE-2025-49113 نظرة عامة على CVE-2025-49113 CVE-2025-49113 هي ثغرة أمنية حرجة تؤثر على إصدارات Roundcube Webmail الأقدم من 1.5.10 و1.6.11. تم اكتشافها في عام 2025، وتسمح هذه الثغرة بتنفيذ التعليمات البرمجية عن بُعد RCE عبر إلغاء تسلسل كائنات PHP PHP Object Deserialization في نقطة...

CVE-2024-25600

CVE-2024-25600 MODIFICADO original - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT Exploit RCE do WordPress Bricks Builder Um exploit em Python para a CVE-2024-25600 - vulnerabilidade de Execução Remota de Código no WordPress Bricks Builder. Descrição Esta ferramenta explora uma...

CVE-2017-5638

CVE-2017-5638 CVE: 2017-5638 in diversi formati La maggior parte di essi richiederà di inserire l'URL e potresti voler cambiare il comando Per favore invia pull request se riesci a fare in modo che sia possibile inserire un URL e un comando! PHP - Esempio...

CVE-2024-7954

CVE-2024-7954 - SPIP 4.2.8 Remote Command Execution RCE Exploit Dieses Skript nutzt eine Remote-Code-Execution-Schwachstelle in SPIP Version 4.2.8 über den porteplumeprevisu-Endpunkt aus. Die Schwachstelle ermöglicht es nicht authentifizierten Angreifern, PHP-Code durch die Vorschau-Wiedergabe...

CVE-2024-4577

CVE-2024-4577 - Injeção de Argumentos em PHP CGI - RCE Resumo CVE-2024-4577 é uma vulnerabilidade crítica de injeção de argumentos no PHP CGI que afeta sistemas Windows que executam PHP em modo CGI. Essa falha permite que atacantes remotos injetem argumentos na linha de comando do PHP por meio de...

CVE-2024-25600

Exploit RCE per Bricks Builder CVE-2024-25600 Questo progetto contiene uno script di exploit basato su Python che mira alla vulnerabilità di esecuzione remota di codice RCE del plugin WordPress Bricks Builder, identificata come CVE-2024-25600. L'exploit consente l'esecuzione remota non autorizzat...

CVE-2019-9081_PoC

CVE-2019-9081poc إثبات المفهوم لـ CVE-2019-9081، هذا CVE هو مجرد سلسلة POP جديدة. المشروع هو تطبيق Laravel 5.7.x ضعيف مسبق البناء مع نقطة دخول لثغرة POI في المسار /deserialize طلب POST. إعداد المختبر: بدء تشغيل التطبيق الضعيف: root@kitploit: $ git clone...

CVE-2026-81525

CVE-2026-81525 is a cross-tenant database retargeting vulnerability in the MongoDB client library for PHP (mongo-php-library and mongo-php-driver). The root cause is insufficient sanitization of dot and NUL characters in application-supplied namespace identifiers, allowing an attacker with low pr...

CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

EUVD-2026-67209

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...