CVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
☆59Oct 22, 2026Updated this week
Alternatives and similar repositories for php2shell-poc
Users that are interested in php2shell-poc are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆45Updated this week
- PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain)…☆110Updated this week
- This repository documents the VectorFreed RCE chain and includes a PoC for CVE-2026-96889.☆19Oct 15, 2026Updated last week
- Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabb…☆107Updated this week
- PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE☆169Updated this week
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)☆788Updated this week
- Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)☆59Aug 10, 2026Updated 2 months ago
- CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit rese…☆1,758Updated this week
- A proof-of-concept PDF file designed for authorized security testing of PDF upload functionality and PDF viewer behavior, including XSS a…☆78Aug 28, 2026Updated last month
- Pre-auth RCE via FilteredObjectInputStream MarshalledObject bypass in Apache Log4j 2☆39Aug 26, 2026Updated last month
- CVE-2026-50522 PoC☆44Aug 15, 2026Updated 2 months ago
- ☆16Jun 28, 2026Updated 3 months ago
- ☆63May 1, 2026Updated 5 months ago
- Detection for CVE-2025-61675, CVE-2025-61678 & CVE-2025-66039☆47Dec 15, 2025Updated 10 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Evil Twin Attack Bash script☆13Feb 21, 2016Updated 10 years ago
- ☆60Jul 15, 2026Updated 3 months ago
- ☆74Jul 15, 2026Updated 3 months ago
- CVE-85884 POC☆35Oct 13, 2026Updated last week
- ☆15Feb 5, 2026Updated 8 months ago
- A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.☆1,404Updated this week
- Updated Exploit - pfBlockerNG <= 2.1.4_26 Unauth RCE (CVE-2022-31814)☆23Jul 23, 2024Updated 2 years ago
- ☆13Oct 2, 2026Updated 3 weeks ago
- Three LLMs review your design plan in parallel — paste 30 lines into your CLAUDE.md, no install needed.☆15May 2, 2026Updated 5 months ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- ☆20May 3, 2024Updated 2 years ago
- Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP e…☆986Updated this week
- Captcha local resolver (by humans)☆15Jun 14, 2024Updated 2 years ago
- ☆23Jul 6, 2026Updated 3 months ago
- A Python-based HTTP security header analyzer that identifies weak or missing policies (CSP, HSTS, XFO, etc.) and generates OWASP-aligned …☆13Nov 14, 2025Updated 11 months ago
- XSSor is a semi-automatic reflected and persistent XSS detector extension for Burp Suite. The tool was written in Python by Barak Tawily,…☆63Feb 22, 2021Updated 5 years ago
- Credential and sensitive-data exposure triage for file shares☆16Aug 8, 2026Updated 2 months ago
- Full-stack authentication system (React + Node.js + MySQL) with JWT, session handling and role-based access control.☆19Mar 15, 2026Updated 7 months ago
- URL Fuzzer☆24Nov 22, 2024Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A simple Go program that detects whether the current Windows system is running inside a Hyper-V virtual machine environment(Guest) using …☆11Oct 27, 2024Updated last year
- Curated Linux LPE corpus — 28 modules from 2016 to 2026, with detection rules. One command, safest-first root: skeletonkey --auto --i-kno…☆26Aug 31, 2026Updated last month
- CVE-2023-6063 (WP Fastest Cache < 1.2.2 - UnAuth SQL Injection)☆29Nov 15, 2023Updated 2 years ago
- CVE-2026-50343 InstallService StaticPluginMap EoP - standard user to SYSTEM☆48Jul 16, 2026Updated 3 months ago
- A monitoring platform for dark web sites and onions that can be flexibly configured to monitor any onion site.☆43Mar 16, 2026Updated 7 months ago
- ☆41Mar 12, 2025Updated last year
- CVE-2026-41940 latest cPanel & WHM 0day - 70 million websites are possible to expose by Chirag Artani☆26Apr 29, 2026Updated 5 months ago