Php — PoC Archive

PHP bcmath bccomp() Out-of-Bounds Write (CVE-2026-17544)

Sun, 16 Aug 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2026-17544 / GHSA-x692-q9x7-8c3f. Status: Patched (PHP 8.4.24 / 8.5.9). Affects: PHP (ext/bcmath). Tags: php, bcmath, oob-write, stack-smashing, rce, cwe-787, CVE-2026-17544.

Unauthenticated Arbitrary File Upload RCE in iCagenda for Joomla (CVE-2026-48939)

Sat, 11 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2026-48939. Status: Weaponized (public PoC available, actively exploited in the wild, in CISA KEV since 2026-07-10). Affects: iCagenda — events/calendar extension (component) for Joomla. Tags: joomla, icagenda, file-upload, rce, cwe-434, unauthenticated, remote, kev, cms, php, access-control-bypass.

WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-12057. Status: Weaponized. Affects: WavePlayer (WordPress plugin). Tags: wordpress, waveplayer, arbitrary-file-upload, unauthenticated, rce, webshell, ajax, nonce, php, python.

ThinkPHP 5.0.24 File Inclusion Leading to Remote Code Execution (CVE-2025-63888)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-63888. Status: Weaponized. Affects: ThinkPHP (top10.org / TopThink PHP framework). Tags: thinkphp, php, file-inclusion, lfi, rce, log-poisoning, webshell, cwe-98, cwe-22.

Roundcube Webmail Post-Auth RCE via PHP Object Deserialization (CVE-2025-49113)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.9) — web · CVE-2025-49113. Status: Weaponized. Affects: Roundcube Webmail. Tags: roundcube, webmail, php, deserialization, object-injection, gadget-chain, rce, post-auth, cwe-502.

Pterodactyl Panel Unauthenticated Path Traversal via locale.json Leaking Database Credentials (CVE-2025-49132)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 10) — web · CVE-2025-49132. Status: Weaponized. Affects: Pterodactyl Panel (game server management panel). Tags: pterodactyl, path-traversal, unauthenticated, information-disclosure, credential-leak, database, php, config-exposure, cwe-22.

PPOM for WooCommerce <= 33.0.15 - Unauthenticated Time-Based Blind SQL Injection (CVE-2025-11391)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-11391. Status: Patched. Affects: PPOM for WooCommerce (woocommerce-product-addon plugin). Tags: wordpress, woocommerce, ppom, product-addon, sql-injection, blind-sqli, time-based, cwe-89, python, php.

Monsta FTP Pre-Authentication Remote Code Execution via Arbitrary File Upload (CVE-2025-34299)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — network · CVE-2025-34299. Status: Weaponized. Affects: Monsta FTP (web-based FTP manager). Tags: monsta-ftp, rce, pre-auth, unrestricted-file-upload, cwe-434, php, ftp, docker, nuclei, kev.

Laravel Livewire Remote Code Execution via Known APP_KEY (CVE-2025-54068)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-54068. Status: Weaponized. Affects: Laravel Livewire (versions prior to v3.6.4). Tags: laravel, livewire, php, deserialization, app-key, hmac-forgery, gadget-chain, rce, cwe-502, python.

Laravel `files.*` Wildcard Validation Bypass via Polyglot JPEG+PHP Upload (CVE-2025-27515)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-27515. Status: Weaponized. Affects: Laravel Framework (file upload validation using files.* wildcard rules). Tags: laravel, php, file-upload, validation-bypass, polyglot, jpeg, wildcard-validation, cwe-20, rce, web-shell.

Kubio AI Page Builder <= 2.5.1 Unauthenticated Local File Inclusion (CVE-2025-2294)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-2294. Status: PoC. Affects: Kubio AI Page Builder (WordPress plugin). Tags: wordpress, kubio, page-builder, lfi, local-file-inclusion, unauthenticated, php, python, cwe-98.

Invision Community Theme Editor Template Injection Unauthenticated RCE (CVE-2025-47916)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 10) — web · CVE-2025-47916. Status: Weaponized. Affects: Invision Community, themeeditor front controller (IPS\core\modules\front\system\themeeditor::customCss()). Tags: invision-community, ssti, template-injection, theme-editor, unauthenticated-rce, php, cwe-94, python.

GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-22777. Status: PoC. Affects: GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs). Tags: givewp, wordpress, wordpress-plugin, php-object-injection, deserialization, unserialize, gadget-chain, cwe-502, php, unauthenticated.

"Grocery" PHP Application `search_products_itname.php` `sitem_name` Boolean-Based SQL Injection (CVE-2025-65354)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2025-65354. Status: PoC. Affects: PHP-based "Grocery" web application, Grocery/search_products_itname.php endpoint. Tags: php, sql-injection, boolean-based-blind-sqli, cwe-89, grocery, unauthenticated, python.

ZoneMinder — Second-Order SQL Injection via Event Rename (CVE-2026-27470)