113750 matches found
Inject-PHP-to-JPG-Using-Jhead
Inject-PHP-to-JPG-Using-Jhead $ pkg install vim or apt-get install vim $ pkg install jhead or apt-get install jhead $ jhead -h for help $ jhead -purejpg yourfiles.jpg $ jhead -ce yourfiles.jpg Click ESC typed :x to save $ jhead yourfiles.jpg Example : site.com/youfiles.php?cmd=Command Here...
CVE-2024-4577-RCE
PHP CGI Argument Injection CVE-2024-4577 RCE 📜 Description In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command...
lua-ffi-libinjection
Name lua-resty-libinjection - LuaJIT FFI bindings for libinjection Status This library is in active development and is production ready Description This library provides FFI bindings for libinjection, a SQL/SQLi and XSS tokenizer and analyzer. Installation Install this library as you would any...
CVE-2022-31629-poc
CVE-2022-31629 poc PHP Bug report How to test Install git clone https://github.com/SilNex/CVE-2022-31629-poc cd ./CVE-2022-31629-poc docker-compose up -d TEST https://localhost:8110 : v8.1.10 https://localhost:8111 : v8.1.11 Chrome HSTS issue thisisunsafe 를 hsts페이지에서 입력하면됩니다. Typing thisisunsafe ...
discuz-ml-rce
discuz-ml-rce Affected systems and versions: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Vulnerability cause: The Discuz!ML system does not filter the language parameter content received by l in the cookie, leading to string concatenation, thereby executing PHP code. The cookie field will contain an...
astrolock
Astrolock A purposely vulnerable application in order to demonstrate PHP payload smuggling techniques for PNG files...
cve-2026-87902-wordpress-lfi-lab
CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress getpagetemplate unauthenticated LFI → conditional RCE Reproduction lab + URL-list scanner + PoC, built and validated end-to-end against genuine WordPress 7.1.1 vulnerable and 7.1.2 patched on the Docker lab. Advisory:...
nate158g-m-w-n-l-p-d-a-o-e
nate158g-m-w-n-l-p-d-a-o-e This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-frameworkclass MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q This exploit requires Metasploit to have a FQDN and the...
CVE-2025-44108-SXSS
CVE-2025-44108 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...
CLEANSTART-2026-TI45715 Symfony is a PHP framework for web and console applications and a set of reusable PHP components
Security vulnerability affects the nextcloud package. Symfony is a PHP framework for web and console applications and a set of reusable PHP components...
CLEANSTART-2026-OJ49097 Symfony is a PHP framework for web and console applications and a set of reusable PHP components
Security vulnerability affects the nextcloud package. Symfony is a PHP framework for web and console applications and a set of reusable PHP components...
CLEANSTART-2026-TA47271 Symfony is a PHP framework for web and console applications and a set of reusable PHP components
Security vulnerability affects the nextcloud package. Symfony is a PHP framework for web and console applications and a set of reusable PHP components...
CLEANSTART-2026-KR66344 Symfony is a PHP framework for web and console applications and a set of reusable PHP components
Security vulnerability affects the nextcloud package. Symfony is a PHP framework for web and console applications and a set of reusable PHP components...
CLEANSTART-2026-LY70913 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP
Security vulnerability affects the nextcloud package. guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP...
CLEANSTART-2026-GA85489 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP
Security vulnerability affects the nextcloud package. guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP...
CLEANSTART-2026-WR07211 Guzzle is an extensible PHP HTTP client
Security vulnerability affects the nextcloud package. Guzzle is an extensible PHP HTTP client...
CLEANSTART-2026-GH57522 Guzzle is an extensible PHP HTTP client
Security vulnerability affects the nextcloud package. Guzzle is an extensible PHP HTTP client...
CLEANSTART-2026-SK75094 Guzzle is an extensible PHP HTTP client
Security vulnerability affects the nextcloud package. Guzzle is an extensible PHP HTTP client...
CLEANSTART-2026-NQ21805 Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data k...
Security vulnerability affects the nextcloud package. Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead ...
CVE-2024-4577-PHP-RCE
PHP RCE PoC CVE-2024-4577: Argument Injection in PHP-CGI Overview This repository contains scripts to check for the CVE-2024-4577 vulnerability, an argument injection issue in PHP-CGI. You can use the provided Bash, Go, and Python scripts to test a list of domains for this vulnerability. I've als...