CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
☆296Oct 30, 2026Updated last week
Alternatives and similar repositories for php2shell
Users that are interested in php2shell are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.☆1,570Updated this week
- Heap OOB write in MariaDB JSON_SCHEMA_VALID() → persistent privilege escalation (lab-assisted)☆16May 6, 2026Updated 6 months ago
- CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit rese…☆1,962Oct 28, 2026Updated 2 weeks ago
- Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP e…☆1,080Oct 22, 2026Updated 3 weeks ago
- Nodejs漏洞 CVE-2026-111497 POC☆17Oct 24, 2026Updated 2 weeks ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- ☆28Oct 25, 2026Updated 2 weeks ago
- php2shell WordPress RCE proof of concept (PHP 8.3.35 / WordPress 7.1.2)☆34Oct 23, 2026Updated 2 weeks ago
- Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness☆81Oct 25, 2026Updated 2 weeks ago
- CVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis☆93Oct 22, 2026Updated 3 weeks ago
- The home to the popular script named Voidware☆18Feb 10, 2025Updated last year
- CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656☆106Oct 21, 2026Updated 3 weeks ago
- ☆13Mar 6, 2025Updated last year
- A PoC tool for the Pass-ta-key Golden Attack, covering the extraction of the Google Password Manager Security Domain Secret from Chrome p…☆55Updated this week
- Keycloak reset-credentials flow bypass☆19Sep 28, 2026Updated last month
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discover…☆104Oct 23, 2026Updated 2 weeks ago
- Scanner for PHP2Shell (CVE-2026-109618/109619): URL blackbox, local device and SSH.☆102Oct 23, 2026Updated 2 weeks ago
- PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE☆198Oct 26, 2026Updated 2 weeks ago
- CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core☆124Jul 18, 2026Updated 3 months ago
- ☆23Sep 10, 2026Updated 2 months ago
- ☆99Oct 22, 2026Updated 3 weeks ago
- High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)☆1,001Oct 24, 2026Updated 2 weeks ago
- Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix.☆16Aug 30, 2026Updated 2 months ago
- fully autonomous credential intelligence platform that discovers, │ │ extracts, correlates, verifies, and reports exposed secrets acro…☆18May 10, 2026Updated 6 months ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Operational information regarding the 2026 php2shell vulnerabilities☆367Updated this week
- 403 Access Bypass Tester☆127Oct 13, 2026Updated 3 weeks ago
- ASLR-bypassing RCE PoC for PHP's session.upload_progress chain (CVE-2026-109618 / CVE-2026-109619). Single file, no gdb, no /proc - addre…☆12Oct 21, 2026Updated 3 weeks ago
- Engagement Manager is a web application for tracking offensive security engagements. It features a modern UI, built with Next.js, Prisma,…☆25Updated this week
- wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain☆815Aug 11, 2026Updated 3 months ago
- A bug bounty tool for bypassing 401/403 access restrictions and testing endpoint accessibility.☆55Sep 28, 2026Updated last month
- Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to…☆13Sep 23, 2026Updated last month
- Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)☆59Aug 10, 2026Updated 3 months ago
- ☆12Dec 16, 2025Updated 10 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Autonomous Windows POC developer from patchwatch diff reports☆160Jul 30, 2026Updated 3 months ago
- Kerberos manipulation library in pure Python☆27Oct 25, 2026Updated 2 weeks ago
- Silent;Call — Pre-authentication remote root on Cisco CUCM 15.x (CVSS 10.0)☆30Aug 4, 2026Updated 3 months ago
- The agentic pentesting environment that lives on your machine. AI agent teams, visual workflows and your own tools, 100% local.☆137Nov 4, 2026Updated last week
- CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress☆31Oct 28, 2026Updated 2 weeks ago
- Fuzzing Framework for Modules in Apache HTTPD Server☆22Jun 13, 2026Updated 4 months ago
- Scan, fuzz, and assess OT protocols from one CLI.☆46Updated this week
Are these results useful?