CVE-2018-8897

CVE-2018-8897 Demostración de explotación de la vulnerabilidad POP SS CVE-2018-8897, que conduce a ejecución de código no firmado con privilegios de kernel. KVA Shadowing debe estar deshabilitado y la actualización de seguridad correspondiente debe desinstalarse. Esto puede no funcionar con ciert...

pop-mov-ss-exploit

This repository does not have a README...

ForceAdmin

💪 ForceAdmin 💪 ForceAdmin es un creador de payloads en C que genera infinitos pop-ups de UAC hasta que el usuario permite ejecutar el programa. Los comandos ingresados se ejecutan a través de PowerShell llamando a cmd.exe y deben usar sintaxis de batch. Este ataque fuerza a ejecutar como...

CVE-2026-82222-MassExploit

CVE-2026-82222 — GiveWP WordPress Plugin Unauthenticated RCE -red.svg Critical Unauthenticated Remote Code Execution CVSS 9.8 — GiveWP ≤ 4.16.7.1 This tool exploits CVE-2026-82222 , a vulnerability in the WordPress GiveWP plugin that allows unauthenticated attackers to execute arbitrary commands ...

CVE-2021-43503

Advertencia La vulnerabilidad ha sido revocada Override Esto trata sobre CVE-2021-43503, no pude replicar esta vulnerabilidad a través de exp Requisitos PHP 7.1. Composer registrar=$b; namespace Illuminate\Queue\Capsule class Manager protected $manager; public function construct$c...

Laravel-vul

Laravel-vul Cadena POP de Laravel 5 descubierta mediante auditoría personal, ID de vulnerabilidad: CVE-2021-43503 Detalles en issues...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Inyección de Objetos PHP sin Autenticación Descripción El plugin VRPConnector para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 2.0.1 inclusive mediante la deserialización de entrada no confiable. Esto permite que atacantes no...

CVE-2026-78175

Tutor LMS (WordPress eLearning plugin) is vulnerable to PHP Object Injection in versions up to and including 4.0.7 via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler. The handler relies solely on a nonce without capability checks, and a flaw in how esc_sql() h...

CVE-2024-5932

PoC for CVE-2024-5932 Credit goes to: https://github.com/EQSTLab/CVE-2024-5932 https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-5932/ This PoC is provided for educational purposes only. I do not take any responsibility for the improper use of this code, especially in...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 - Inyección de Objetos PHP No Autenticada Descripción El plugin Partners para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 0.2.0 inclusive, a través de la deserialización de entrada no confiable. Esto permite que atacantes no...

CVE-2026-11363

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2019-9081_PoC

CVE-2019-9081poc Poc para CVE-2019-9081, este CVE es solo una nueva cadena POP. El proyecto es una aplicación Laravel 5.7.x vulnerable preconstruida con un punto de entrada para la vulnerabilidad POI en la URI /deserialize solicitud POST. Configuración del laboratorio: Iniciando la aplicación...

CVE-2019-9081_PoC

CVE-2019-9081poc PoC para CVE-2019-9081, este CVE es solo una nueva cadena POP. El proyecto es una aplicación Laravel 5.7.x vulnerable preconstruida con un punto de entrada para la vulnerabilidad POI en la URI /deserialize solicitud POST. Configuración del laboratorio: Iniciando la aplicación...

CVE-2020-28032_PoC

CVE-2020-28032PoC PoC para CVE-2020-28032 Es solo una cadena POP en WordPress RequestsUtilityFilteredIterator Object callback:protected = system storage:ArrayIterator:private = Array 0 = id uid=1000nth347 gid=1000nth347...

CVE-2026-82222

CVE-2026-82222 — GiveWP Author: Rx019 CVSS: 10.0 Critical Type: Unauthenticated PHP Object Injection → Remote Code Execution Plugin: GiveWP give — Donation Plugin and Fundraising Platform Affected: Patched: 4.16.8 Description GiveWP stores a donor's lastname in the PHP session without sanitizatio...

PHP-binary-bugs

Advisory of Exploits AI POP Builder Collection of PHP binary bugs advisory Unfixed GMP Type confusion in unserialize Idea: bypass delayed wakeup and exploit unfixed GMP type confusion bug in PHP = 5.6.40 POC source: GMPtypeconfPOC.php Advisory CVE-2022-31626 analysis Idea: heap buffer overflow in...

CVE-2026-10196

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196

The Mail Mint WordPress plugin (Email Marketing, Newsletter, Email Automation & WooCommerce Emails) is affected by an unauthenticated PHP Object Injection in all versions up to and including 1.31.0 . The root cause is deserialization of untrusted input in the handle_form_submission function, whic...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress (versions up to 2.12.1 ) is vulnerable to PHP Object Injection via the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary serialized data as order metadata during a public checkout, then trigger...