CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Github link:
https://github.com/SteamPunk424/CVE-2025-49113-Roundcube-RCE-PHP

CVE: CVE-2025-49113
Author: SteamPunk424
NIST: https://nvd.nist.gov/vuln/detail/CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

GitHub: https://github.com/SteamPunk424/CVE-2025-49113-Roundcube-RCE-PHP

CVE: CVE-2020-36708
Author: b1g-b33f
NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-36708

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.

GitHub: https://github.com/b1g-b33f/CVE-2020-36708

CVE: CVE-2025-8671
Author: moften
NIST: https://nvd.nist.gov/vuln/detail/CVE-2025-8671

None

GitHub: https://github.com/moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS

CVE: CVE-2015-6967
Author: innocentx0
NIST: https://nvd.nist.gov/vuln/detail/CVE-2015-6967

Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.

GitHub: https://github.com/innocentx0/CVE-2015-6967-EXPLOIT

CVE-2025-8723

None

Github link:
https://github.com/Nxploited/CVE-2025-8723

CVE-2019-5688

None

Github link:
https://github.com/watsa01/CVE-2019-5688

CVE-2025-8723
Author: Nxploited

None

GitHub Link:
https://github.com/Nxploited/CVE-2025-8723

CVE-2019-5688
Author: watsa01

None

GitHub Link:
https://github.com/watsa01/CVE-2019-5688

CVE-2025-4334
Author: 0xgh057r3c0n

The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.

GitHub Link:
https://github.com/0xgh057r3c0n/CVE-2025-4334

CVE-2013-3900
Author: PREN0MEN

The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka "WinVerifyTrust Signature Validation Vulnerability."

GitHub Link:
https://github.com/PREN0MEN/CVE-2013-3900-PowerShell-PoC

@Dbugs1337 — automated monitoring of dbugs.ptsecurity.com

Unofficial Telegram bot channel that tracks and posts entries from dbugs with information about new vulnerabilities with the PT identifier (like CVE).

CVE-2024-36042
Author: zaaraZiof0

None

GitHub Link:
https://github.com/zaaraZiof0/CVE-2024-36042

CVE-2025-5777
Author: ndr-repo

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

GitHub Link:
https://github.com/ndr-repo/CVE-2025-5777

CVE-2011-2523
Author: seerat-fatima21

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

GitHub Link:
https://github.com/seerat-fatima21/vsftpd-exploit

CVE-2018-7600
Author: SyedGhufranRaza

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

GitHub Link:
https://github.com/SyedGhufranRaza/CVE-2018-7600-Remote-Code-Execution

CVE-2025-32094
Author: perplext

None

GitHub Link:
https://github.com/perplext/echteeteepee

CVE-2023-31126
Author: shoucheng3

None

GitHub Link:
https://github.com/shoucheng3/cov-int

CVE-2021-29447
Author: ArtemCyberLab

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.

GitHub Link:
https://github.com/ArtemCyberLab/Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

CVE-2025-55188
Author: rhllsingh

None

GitHub Link:
https://github.com/rhllsingh/CVE-2025-55188-7z-exploit

CVE-2025-52392
Author: 137f

None

GitHub Link:
https://github.com/137f/Soosyze-CMS-2.0---CVE-2025-52392