CVE-2023-46474

PMB =7.5.3 - Esecuzione di codice remota tramite caricamento di file senza restrizioni CVE-2023-46474 Vettore CVSS v3.1| Punteggio CVSS v3.1 ---|--- AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H| 9.1 Scoperta nell'ambito di un test di penetrazione da Marcus Reynaud di Devensys Cybersecurity Descrizione Lo...

CVE-2025-29306

CVE-2025-29306 Vulnérabilité d'injection de paramètres de service dans le système de gestion de contenu FOXCMS Qianhu 1. Introduction de la vulnérabilité FoxCMS est un système de gestion de sites Web open source et gratuit pour un usage commercial, reposant sur une architecture PHP+MySQL. Le...

hashes

Hash magici – "collisioni" di hash PHP Registrati con password 1 e poi accedi con password 2. Se riesci ad accedere, l'archiviazione usa l'algoritmo specificato per calcolare l'hash della password e PHP usa == per confrontarle per MD5, SHA-1 e plaintext. MD5, SHA-1, SHA-224, SHA-256 e altri Per M...

HTB-Pterodactyl-Writeup

Отчет о тесте на проникновение — HackTheBox: Pterodactyl Дата: 8 апреля 2026 г. Цель: Pterodactyl HackTheBox Сложность: Средняя ОС: Linux openSUSE Leap 15.6 Тестер: V0idW1re Краткое описание Машина Pterodactyl на HackTheBox представила реалистичный сценарий атаки, включающий неправильно...

CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC

CVE-2024-25600 — WordPress Bricks Builder RCE PoC Nicht authentifizierte Remote-Code-Ausführung-Sicherheitslücke in WordPress Bricks Builder id uid=33www-data gid=33www-data groups=33www-data...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Vulnerabilità RCE non autenticata in Fuel CMS 1.4.1. Il parametro filter nell'endpoint /fuel/pages/select/ viene passato senza sanitizzazione a una chiamata eval nel backend PHP, consentendo l'esecuzione arbitraria di codice tramite un...

PHP_8.1.x_Exploit

🚀 PHP CVE Autopilot Rilevamento e sfruttamento automatici di vulnerabilità critiche di PHP CVE-2024-4577 bypass, CVE-2025-14177, CVE-2025-14180, CVE-2025-14178 PHP8.1.xExploit.sh è uno strumento di valutazione della sicurezza a file singolo, zero configurazione che rileva automaticamente endpoint...

CVE-2025-56399

CVE-2025-56399 Exploit di Massa CVE-2025-56399 – Esecuzione di codice remoto in laravel-file-manager v3.3.1. Sfrutta una configurazione errata in Laravel File Manager per caricare e verificare una shell PHP tramite upload di file non autenticato. Installazione Scarica il repository root@kitploit:...

php_filter_chain_generator

مولّد سلسلة فلاتر PHP أداة سطر أوامر لتوليد سلسلة فلاتر PHP؛ احصل على RCE دون رفع ملف إذا كنت تتحكم بالكامل في المعامل المُمرَّر إلى require أو include في PHP! الاستخدام المساعدة root@kitploit: $ python3 phpfilterchaingenerator.py --help usage: phpfilterchaingenerator.py -h --chain CHAIN...

CVE-2023-36845

CVE-2023-36845 Juniper JunOS J-Web PHP externe Variablenmodifikation CVE-2023-36845 Exploit...

CVE-2015-6967-EXPLOIT

CVE-2015-6967-EXPLOIT CVE-2015-6967 PoC Exploit Dieses Python-Skript nutzt eine Schwachstelle in Nibbleblog CVE-2015-6967 aus, um eine Reverse-Shell auf ein verwundbares Ziel hochzuladen. Das Skript nimmt Benutzereingaben für die Ziel-URL, Benutzeranmeldedaten und Ihre Host-IP/Port entgegen und...

CVE-2024-4577

CVE-2024-4577 Exploit para php-cgi...

TimeAfterFree

TimeAfterFree PHP 8 Sandbox Escape PoC, der einen disablefunctions-Bypass auf Unix-ähnlichen Systemen demonstriert. Dieser Exploit nutzt einen Use-After-Free-Fehler, um disablefunctions zu umgehen und Systembefehle auszuführen. Die verwendeten Exploitation-Techniken zum Leaken von Heap-Pointern u...

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4...

CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Pr...

CVE-2026-37068

An arbitrary file write vulnerability in Veno File Manager Project 4.4.9 affects the endpoint /vfm-admin/index.php?section=translations&action=update. An authenticated user holding the super administrator role can overwrite any PHP file in the application by sending a specially crafted POST reque...

PT-2026-82739

Name of the Vulnerable Software and Affected Versions MongoDB client library for PHP affected versions not specified Description The MongoDB client library for PHP fails to properly sanitize special elements within application-supplied namespace identifiers used to construct target namespaces for...

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5...

CVE-2024-1874

CVE-2024-1874 CVE-2024-1874 के लिए प्रूफ ऑफ कॉन्सेप्ट कमांड इंजेक्शन Array-ish $command Parameter of procopen के माध्यम से CVE-2024-1874 फिक्स को बायपास करना CVE: PHP संस्करण 8.1. 8.1.29 से पहले, 8.2. 8.2.20 से पहले, 8.3. 8.3.8 से पहले, CVE-2024-1874 का फिक्स तब काम नहीं करता जब कमांड नाम में...

CVE-2022-31629-poc

CVE-2022-31629 पीओसी PHP बग रिपोर्ट कैसे परीक्षण करें इंस्टॉल root@kitploit: git clone https://github.com/SilNex/CVE-2022-31629-poc cd ./CVE-2022-31629-poc docker-compose up -d परीक्षण https://localhost:8110 : v8.1.10 https://localhost:8111 : v8.1.11 Chrome HSTS समस्या thisisunsafe को hsts पृष्ठ ...