CVE-2020-28032_PoC

CVE-2020-28032PoC PoC for CVE-2020-28032 It's just a POP chain in WordPress RequestsUtilityFilteredIterator Object callback:protected = system storage:ArrayIterator:private = Array 0 = id uid=1000nth347 gid=1000nth347...

pop-mov-ss-exploit

This repository does not have a README...

ForceAdmin

💪 ForceAdmin 💪 ForceAdmin is a c payload builder, creating infinate UAC pop-ups until the user allows the program to be ran. The inputted commands are ran via powershell calling cmd.exe and should be using the batch syntax. This attack will force them to run as admin using the old fasioned...

Laravel-vul

Laravel-vul A POP chain discovered during personal audit of Laravel 5, Vulnerability ID: CVE-2021-43503 Details see issues...

CVE-2021-43503

Warning The vulnerability has been revoked Override This is Abount CVE-2021-43503, I can not replicate this vulnerability through exp Requirement PHP 7.1. Composer registrar=$b; namespace Illuminate\Queue\Capsule class Manager protected $manager; public function construct$c $this-manager-method=$...

CVE-2018-8897

CVE-2018-8897 Demo exploitation of the POP SS vulnerability CVE-2018-8897, leading to unsigned code execution with kernel privilages. KVA Shadowing should be disabled and the relevant security update should be uninstalled. This may not work with certain hypervisors like VMWare, which discard the...

PHP-binary-bugs

Advisory of Exploits AI POP Builder Collection of PHP binary bugs advisory Unfixed GMP Type confusion in unserialize Idea: bypass delayed wakeup and exploit unfixed GMP type confusion bug in PHP = 5.6.40 POC source: GMPtypeconfPOC.php Advisory CVE-2022-31626 analysis Idea: heap buffer overflow in...

CVE-2019-9081_PoC

CVE-2019-9081poc Poc for CVE-2019-9081, this CVE is just a new POP chain. The project is a pre-built vulnerable Laravel 5.7.x application with an entry point for POI vulnerability at URI /deserialize POST-request. Lab setup: Starting the vulnerable application: $ git clone...

Linux Distros Unpatched Vulnerability : CVE-2026-114098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree...

CVE-2026-82222-MassExploit

CVE-2026-82222 — GiveWP WordPress Plugin Unauthenticated RCE Critical Unauthenticated Remote Code Execution CVSS 9.8 — GiveWP ≤ 4.16.7.1 This tool exploits CVE-2026-82222 , a vulnerability in the WordPress GiveWP plugin that allows unauthenticated attackers to execute arbitrary commands on the...

CVE-2024-5932

PoC for CVE-2024-5932 Credit goes to: https://github.com/EQSTLab/CVE-2024-5932 https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-5932/ This PoC is provided for educational purposes only. I do not take any responsibility for the improper use of this code, especially in...

CVE-2026-82222

CVE-2026-82222 — GiveWP Author: Rx019 CVSS: 10.0 Critical Type: Unauthenticated PHP Object Injection → Remote Code Execution Plugin: GiveWP give — Donation Plugin and Fundraising Platform Affected: Patched: 4.16.8 Description GiveWP stores a donor's lastname in the PHP session without sanitizatio...

CVE-2026-114098

A flaw was found in Dulwich. This vulnerability allows an attacker to achieve arbitrary code execution by tricking a user into restoring a stash in a specially crafted Git repository. During a stash pop operation, intermediate directory symbolic links symlinks are followed without adequate...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 - Unauthenticated PHP Object Injection Description The Partners plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject...

CVE-2019-9081_PoC

CVE-2019-9081poc Poc for CVE-2019-9081, this CVE is just a new POP chain. The project is a pre-built vulnerable Laravel 5.7.x application with an entry point for POI vulnerability at URI /deserialize POST-request. Lab setup: Starting the vulnerable application: $ git clone...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Unauthenticated PHP Object Injection Description The VRPConnector plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers t...

CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-87761 Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on ever...

CVE-2026-87761

The Adwised Web Push Notification WordPress plugin, in versions through 2.5.7 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a lack of capability or nonce checks when allowing authenticated users to overwrite site-wide configurations, combined with a failure to es...