CVE-2024-29895

CVE-2024-29895 Cacti CVE-2024-29895 POC Una vulnerabilità di command injection consente a qualsiasi utente non autenticato di eseguire comandi arbitrari sul server quando l'opzione registerargcargv di PHP è On. https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m Uso: app -m...

CVE-2016-10033-PoC

CVE-2016-10033-PoC Escrevi isso para o PentesterLab Se você é do PentesterLab, não trapaceie, é muito melhor aprender. Espero que seja útil para alguém, se não para mim no futuro : Possui shell interativo, e também coisas legais de argparse. Uso root@kitploit: usage: poc.py -h --target TARGET...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Proof-of-Concept Un exploit Proof-of-Concept PoC per CVE-2018-16763 Fuel CMS - Preauthenticated Remote Code Execution. Descrizione Questo programma Python 3 funge da PoC per la vulnerabilità CVE-2018-16763 nel sistema di gestione dei contenuti Fuel CMS. In particolare, la...

cve-2020-9006

CVE-2020-9006: Exploit per il plugin Popup-Builder di Wordpress Uso: root@kitploit: Create and upload payload Also see: php create-serialized-payload.php -h $ php create-serialized-payload.php | curl -F 'sprunge=-' http://sprunge.us http://sprunge.us/XXXXXX Run exploit $ nmap --script...

CVE-2026-76060

An authenticated OS command injection vulnerability in ZoneMinder's event export functionality allows any user with View Events permission to execute arbitrary commands on the server. The exportFile HTTP parameter is passed unsanitized into a shell command executed via PHP's exec() , enabling ful...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2023-50564

CVE-2023-50564 Solo a scopo educativo. Questo script sfrutta CVE-2023-50564 per caricare una reverse shell PHP sul server di destinazione. Puoi utilizzare una shell come questa. Basta zippare il file PHP e passare lo zip a questo script. Esempio root@kitploit: python3 cve-2023-50564.py -u...

snuffleupagus

Snuffleupagus Sicherheitsmodul für PHP7 und PHP8 – beseitigt Bug-Klassen und patcht den Rest virtuell!...

DEBIAN-CVE-2026-81525

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-81525

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2025-65791

CVE-2025-65791 — Befehlsinjizierung in ZoneMinder Übersicht Eine kritische Befehlsinjizierungs -Schwachstelle besteht in ZoneMinder v1.36.34 aufgrund einer unsachgemäßen Eingabevalidierung in der Komponente web/views/image.php. Nicht bereinigte, benutzerkontrollierte Eingaben werden direkt an die...

CVE-2020-0688

CVE-2020-0688 Scanner Questo è un piccolo script sporco per verificare la presenza di server Exchange vulnerabili a CVE-2020-0688 È scritto male ed in PHP. Attenzione: controlla solo se hai installato l'aggiornamento CU attuale. Ciò non significa che hai installato la patch di correzione! Requisi...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Inclusione Locale di File Non Autenticata 📝 Descrizione Il plugin Kubio AI Page Builder per WordPress è vulnerabile all'Inclusione Locale di File in tutte le versioni fino alla 2.5.1 inclusa tramite la funzione kubiohybridthemeloadtemplate. Ciò rende possibile ad...

astrolock

Astrolock Un'applicazione deliberatamente vulnerabile per dimostrare tecniche di contrabbando di payload PHP in file PNG...

PHP-8.1.0-dev_WebShell-RCE

PHP 8.1.0-dev WebShell RCE Non autenticato Codice Exploit per PHP 8.1.0-dev WebShell RCE Non autenticato Risultato atteso: sfruttare la backdoor installata sul server PHP 8.1.0-dev ottenendo così una WebShell per eseguire comandi da remoto. Destinato solo a scopo educativo e a test in ambienti...

PHP_imap_open_exploit

PHPimapopenexploit Bypass delle funzioni exec disabilitate in PHP tramite imapopen Debian e Ubuntu Report originale di CRLF: https://bugs.php.net/bug.php?id=76428...

exploit-CVE-2025-49113

مستودع PoC لـ CVE-2025-49113 نظرة عامة على CVE-2025-49113 CVE-2025-49113 هي ثغرة أمنية حرجة تؤثر على إصدارات Roundcube Webmail الأقدم من 1.5.10 و1.6.11. تم اكتشافها في عام 2025، وتسمح هذه الثغرة بتنفيذ التعليمات البرمجية عن بُعد RCE عبر إلغاء تسلسل كائنات PHP PHP Object Deserialization في نقطة...

CVE-2024-25600

CVE-2024-25600 MODIFICADO original - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT Exploit RCE do WordPress Bricks Builder Um exploit em Python para a CVE-2024-25600 - vulnerabilidade de Execução Remota de Código no WordPress Bricks Builder. Descrição Esta ferramenta explora uma...

CVE-2017-5638

CVE-2017-5638 CVE: 2017-5638 in diversi formati La maggior parte di essi richiederà di inserire l'URL e potresti voler cambiare il comando Per favore invia pull request se riesci a fare in modo che sia possibile inserire un URL e un comando! PHP - Esempio...