CVE-2018-15133-laravel-framework

CVE-2018-15133 - Laravel Framework 5.6.x Vulnerable Lab This repo provides a reproducible Docker lab for CVE-2018-15133 Laravel Framework token unserialize RCE when APPKEY is known. The app is pinned to a vulnerable Laravel 5.6.x version and exposes a simple /poc POST route under the web middlewa...

day06-foxcms-rce

Day06 — RCE estilo FoxCMS CVE-2025-29306 — Laboratorio educativo Este pequeño laboratorio simula la idea central detrás de CVE-2025-29306 : el uso inseguro de unserialize sobre entradas controladas por el atacante que deriva en ejecución remota de código. Se trata de una réplica educativa mínima ...

CVE-2026-29782-OpenSTAManager-RCE

CVE-2026-29782 — OpenSTAManager auth-SQLi → PHP object injection → RCE PoC for remote code execution inOpenSTAManager ≤ 2.10.1. oauth2.php looks up a zzoauth2 row by the attacker-controlled state GET parameter and calls unserialize on its accesstoken column without anallowedclasses restriction...

Node.js-CVE-2017-5941

Demostración de Vulnerabilidad de Deserialización Insegura en NodeJS Node.js es un entorno de ejecución de código abierto utilizado para implementar funcionalidad de servidor en JavaScript. Un paquete de software específico dentro de Node.js contiene una función vulnerable que maneja la...

RCE-NodeJs

node-serialize — CVE-2017-5941 Nota: Este documento es solo con fines defensivos y educativos. No incluye instrucciones para crear exploits o RCE. Resumen: node-serialize 0.0.4 y versiones antiguas similares puede suponer un riesgo debido a la deserialización no confiable: valide siempre los dato...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 es una vulnerabilidad crítica de inyección de objetos PHP no autenticada con CVSS 9.8 en el plugin Everest Forms de WordPress CVE-2026-3296 — Escáner de Inyección de Objetos PHP en Everest Forms Plugin: Everest Forms – Formulario de contacto, formulario de pago,...

CVE-2026-71981

Cypht CVE-2026-71981 PoC This is a PoC for CVE-2026-71981 Insecure deserializaion RCE. Result of executed command is printed in response from logout request after the tags. Use --print-all to also print the whole response. Versions vulnerable: v2.12.2 Install dependencies and execute This script...

PHP-binary-bugs

Advisory of Exploits AI POP Builder Collection of PHP binary bugs advisory Unfixed GMP Type confusion in unserialize Idea: bypass delayed wakeup and exploit unfixed GMP type confusion bug in PHP = 5.6.40 POC source: GMPtypeconfPOC.php Advisory CVE-2022-31626 analysis Idea: heap buffer overflow in...

CVE-2025-61505

CVE-2025-61505 – Inyección de objetos PHP en e107 CMS 2.x Reportado: 18 de septiembre de 2025 CVE asignado: 9 de octubre de 2025 Publicado: 02 de febrero de 2026 ID CVE: CVE-2025-61505 Descubridor: Anas Abderrahman Benbarek Resumen Se descubrió una vulnerabilidad de Inyección de Objetos PHP...

CVE-2026-52777

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6...

CVE-2026-52777

CVE-2026-52777 affects YesWiki (a PHP wiki system) prior to version 4.6.6 . The vulnerability is an authenticated PHP object injection in BazarImportAction via an unrestricted unserialize() call in tools/bazar/services/CSVManager.php::importEntry(), which lacks the ['allowed_classes' => false]...

CVE-2026-52777 YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6...

CVE-2026-52777 YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6...

CVE-2026-61686

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

CVE-2026-61686

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1 , the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize() after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP s...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, enabling PHP object injection when a high-privilege user imports a malicious file and a suitable gadget chain exists on the blog. The vulnerability is rated CVSS 3.3 (LOW) with high attack complexity...

CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

EUVD-2026-69650

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981

Cypht versions before 2.12.2 contain a PHP object injection vulnerability in the logout handler. The back_query GET parameter accepts a base64-encoded serialized payload that is passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exp...