Tools

dirac231/cve-2024-40498

Blind SQL Injection to RCE in a PHP open source application

febinrev/tinyfilemanager-2.4.3-exploit

A Path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager Project's Tiny File Manager <= 2.4.6…

zalehack/joomla_rce_cve-2015-8562

All versions of the Joomla! below 3.4.6 are known to be vulnerable. But exploitation is possible with PHP versions below 5.5.29, 5.6.13 and below 5.5.

ch4120n/cve-2026-3891

PoC for CVE-2026-3891 – Unauthenticated File Upload RCE in Pix for WooCommerce ≤ 1.5.0. Automated nonce retrieval, PHP upload, and command execution.

jfs-jfs/cve-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with…

sp624/cve-2024-31509

SQL Injection in computer-laboratory-management-system-using-php-and-mysql - LMS - PHP v1.0

randomrobbiebf/cve-2024-52433

My Geo Posts Free <= 1.2 - Unauthenticated PHP Object Injection

efekaanakkar/cve-2024-35511

Men Salon Management System Using PHP and MySQL

randomrobbiebf/cve-2024-52430

Lis Video Gallery <= 0.2.1 - Unauthenticated PHP Object Injection

mbadanoiu/cve-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail

sangsenimanwartefak/cve-2025-6440

Exploit for CVE-2025-6440: unauthenticated arbitrary file upload in WooCommerce Designer Pro WordPress plugin, enabling RCE via malicious PHP upload.

syfi/panaceasoft-0day-exploit

PanaceaSoft [all products] 0day exploit

h4md153v63n/cve-2022-40348_intern-record-system-cross-site-scripting-v1.0-vulnerability-unauthenticated

CVE-2022-40348: Intern Record System - 'name' and 'email' Cross-site Scripting (Unauthenticated)

d0n601/cve-2026-7537

MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter

lichaser/cve-2024-12484

CVE-poc