PHP Session Serialization Desynchronization Remote Code Execution

PHP web applications that dynamically switch session serialization handlers between phpserialize and php may be susceptible to session desynchronization and injection attacks. An unauthenticated attacker can abuse the PHPSESSIONUPLOADPROGRESS mechanism to inject specially crafted session data tha...

Exploit for CVE-2026-115560

CVE-2026-115560 — PHP Session Upload Progress serializehandle...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell !Authorhttps://img.shields.io/badge/Author-l3tc...

PHP 8.5.11 Session Upload Progress Detection

A CrowdSec AppSec rule blocks multipart POST requests containing PHP's PHPSESSIONUPLOADPROGRESS field as defense in depth for affected PHP versions...

PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619

PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619 By Trellix Advanced Research Center · October 22, 2026 What happened On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and...

Exploit for CVE-2026-109618

Cloudflare custom rule php2shell - UNOFFICIAL, PROVISIONAL...

Path Traversal in ImpressCMS

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

CVE-2022-24977

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

Remote code execution

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

CVE-2022-24977

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

CVE-2022-24977

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

CVE-2022-24977

ImpressCMS has a directory traversal vulnerability (CVE-2022-24977) affecting versions before 1.4.2. The flaw allows unauthenticated remote code execution by traversing origName or imageName, triggering unsafe interaction with CKEditor processImage.php. In PHP environments that support upload_pro...