phpfastcache - phpinfo Resource Exposure

phpinfo is susceptible to resource exposure in unprotected composer vendor folders via phpfastcache/phpfastcache. id: CVE-2021-37704 info: name: phpfastcache - phpinfo Resource Exposure author: whoever severity: medium description: phpinfo is susceptible to resource exposure in unprotected compos...

Imcat 4.4 - Phpinfo Configuration

Imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI. id: CVE-2018-20608 info: name: Imcat 4.4 - Phpinfo Configuration author: ritikchaddha severity: high description: Imcat 4.4 allows remote attackers to read phpinfo output via the...

WordPress EasyCart <2.0.6 - Information Disclosure

WordPress EasyCart plugin before 2.0.6 contains an information disclosure vulnerability. An attacker can obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function. id: CVE-2014-4942 info: name: WordPress EasyCart 2.0.6 - Information Disclosur...

FacturaScripts - Unauthenticated phpinfo Disclosure

Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication. id: CVE-2026-42878 info: name:...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

PrestaShop MyPrestaModules - PhpInfo Disclosure

PrestaShop modules by MyPrestaModules expose PHPInfo id: CVE-2023-39677 info: name: PrestaShop MyPrestaModules - PhpInfo Disclosure author: meme-lord severity: high description: | PrestaShop modules by MyPrestaModules expose PHPInfo remediation: | Apply the latest security patches and updates fro...

pcc

PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...

CVE-2023-27372-POC

CVE-2023-27372-POC Resumen Este código es un POC Proof of Concept en Python para detectar si un sitio web objetivo es vulnerable a CVE-2023-27372. Puede ejecutar el código proporcionando una sola URL o un archivo de texto que contenga múltiples URLs. Versiones afectadas: SPIP "; Funcionalidades...

CVE-2023-49103

CVE-2023-49103 PoC para el CVE-2023-49103 Resumen Este script de Python está diseñado para procesar de manera eficiente una gran lista de URLs y verificar la presencia de la salida de phpinfo. Utiliza múltiples hilos multi-threading para manejar un gran número de URLs de forma concurrente,...

PHPCGIScanner

PHP CGI Scanner Captura de pantalla Resumen PHP CGI Scanner es una utilidad de Python 3 diseñada para ayudar a identificar sistemas potencialmente expuestos a CVE-2024-4577. Comprueba las versiones visibles de PHP, los endpoints CGI comunes y las salidas de phpinfo para proporcionar una evaluació...

Trinity-Audio-CVE-Report

Trinity-Audio-CVE-Report Divulgación de CVE-2025-9196 CVE-2025-9196 - Vulnerabilidad en Trinity Audio Este repositorio divulga una vulnerabilidad descubierta en Trinity Audio = 5.20.1,plugin de WordPress desarrollado por sergiotrinity. 🛠 Versión Afectada Producto : Trinity Audio Versión : v5.20.1...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

WP Query Console <= 1.0 - Remote Code Execution

Improper Control of Generation of Code 'Code Injection' vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console- from n/a through 1.0. id: CVE-2024-50498 info: name: WP Query Console = 1.0 - Remote Code Execution author: s4e-io severity: critical...

LFI-Destruction

🔥 LFI-Destruction – Authorized Penetration Testing Framework LFI-Destroyer is a comprehensive, modular Local File Inclusion LFI exploitation framework designed for authorized security professionals. It combines multiple attack techniques into a single, easy‑to‑use tool: SSH & Browser Artifact...

CVE-2024-12542

CVE-2024-12542 linkID = 0.1.2 - Mancanza di autorizzazione per l'esposizione non autenticata di informazioni sensibili Descrizione Il plugin linkID per WordPress è vulnerabile all'accesso non autorizzato ai dati a causa della mancata verifica delle capacità quando include la funzione 'phpinfo' in...

CVE-2024-12535

CVE-2024-12535 Host PHP Info = 1.0.4 - Mancanza di autorizzazione alla divulgazione non autenticata di informazioni sensibili Descrizione Il plugin Host PHP Info per WordPress è vulnerabile all'accesso non autorizzato ai dati a causa della mancanza di un controllo delle capacità quando include la...

CVE-2024-12542-PoC

CVE-2024-12542-PoC Mancanza di autorizzazione all'esposizione non autenticata di informazioni sensibili Descrizione della vulnerabilità Il plugin linkID per WordPress è vulnerabile all'accesso non autorizzato ai dati a causa della mancanza di un controllo delle capacità quando include la funzione...

cve-2023-2523-and-cve-2023-2648

cve-2023-2523 Nota: lo script carica un file phpinfo Utilizzo: I risultati vengono salvati automaticamente nel file result.txt Immagine POC manuale: root@kitploit: POST /E-mobile/App/Ajax/ajax.php?action=mobileuploadsave HTTP/1.1 Host: your-ip Content-Length: 352 Cache-Control: max-age=0...

phpinfo-files-leaks

Badges Licenza MIT Installazione 1. Installa Python3 e pip Istruzioni qui Se non riesci a capire come fare, forse non dovresti usare questo strumento Installa tramite pip root@kitploit: pip install phpinfo-file-leaks Esegui il comando qui sotto per verificare phpinfo-file-leaks -h Configurazioni ...

GHSA-86VW-X4WW-X467 Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

The actionRenderCardPreview method in FieldsController passes the fieldLayoutConfig POST parameter directly to Fields::createLayout without calling Component::cleanseConfig. This allows Yii2 event handler injection via on eventName keys in the config array, leading to arbitrary code execution. Th...