329729 matches found
CVE-2024-10586-Poc
Vulnerability Information Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated...
Security Bulletin: Two Critical PHP Vulnerabilities
Summary API Connect is vulnerable to critical PHP Vulnerabilities affecting v12 on prem and v10 LTS Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-check A single-file, read-only Bash script that che...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
PHP2Shell CVE-2026-109618, CVE-2026-109619: indicators and l...
PHP-CGI-INTERNAL-RCE
PHP-CGI-INTERNAL-RCE This PoC demonstrates how an attacker can chain Orange Tsai's CVE-2024-4577 with DNS rebinding to achieve remote code execution on internal network infrastructure directly through the victim’s web browser. By bypassing Same-Origin Policy SOP and exploiting vulnerable PHP-CGI...
CVE-2024-4577
CVE-2024-4577 PHP CGI Remote Code Execution Exploit Author: Byte Reaper CVE: CVE-2024-4577 Category: Web Exploitation Target Versions: PHP CGI 8.1, 8.2, 8.3 Target OS: Windows License : MIT Overview This repository contains a proof-of-concept exploit for the CVE-2024-4577 vulnerability in PHP CGI...
CVE-2023-22518
CVE-2023-22518 Exploit for Confluence CVE-2023-22518 backup-restore RCE Endpoint POST /setup/setup-restore.action Requires valid login and admin rights or an auth bypass Files xmlexport-20231127-071916-1.zip – empty Confluence backup. Restoring this will DELETE all data!!! Replace with any backup...
Exploit for CVE-2026-115560
CVE-2026-115560 — PHP session upload progress serialize-handle...
CVE-2019-16759
CVE-2019-16759 vBulletin 5.0 5.5.4 - 'widgetphp ' Unauthenticated Remote Code Execution Interactive-Like Command-Line Console for CVE-2019-16759 Usage: python3 exploit.py Enter the Site with Http/Https and Get the Shell :p...
CVE-2026-113673
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell — tek komutluk sarmalayıcı CVE-2026-109618 / CVE-20...
CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
CVE-2026-113673
The GeoDirectory WordPress plugin versions prior to 2.8.194 is vulnerable to Remote Code Execution (RCE) . The root cause is a failure to properly escape administrator-defined text before it is written into a generated PHP file within the plugin's own folder. This flaw allows high-privilege users...
CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
EUVD-2026-109216
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...
CVE-2021-28476
CVE-2021-28476: a guest-to-host "Microsoft Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys. This is a proof of concept for CVE-2021-28476 "Hyper-V Remote Code Execution Vulnerability", an arbitrary memory read in vmswitch.sys network virtualization service provider patched by Microso...
CVE-2017-11882
CVE-2017-11882 Article Link Office Remote Code Execution Vulnerability Hidden for 17 Years CVE-2017-11882 http://www.cnblogs.com/Hi-blog/p/7878054.html...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
🛡️ PHP2Shell Sentinel PHP Runtime Vulnerability Assessment...