CVE-2025-49113 - Roundcube Remote Code Execution

A proof-of-concept exploit for CVE-2025-49113, a remote code execution vulnerability in Roundcube Webmail.

💬 Description:
This exploit targets a deserialization vulnerability in Roundcube Webmail versions 1.5.0 through 1.6.10. The vulnerability allows an authenticated attacker to execute arbitrary code on the server.

🏴‍☠️ Vulnerable Versions:
⚪️ 1.5.0 - 1.5.9
⚪️ 1.6.0 - 1.6.10

🖇 Requirements:
⚪️ PHP 7.0 or higher
⚪️ cURL extension enabled
⚪️ Target running a vulnerable version of Roundcube

💻 Usage:

php CVE-2025-49113.php <url> <username> <password> <command>

🔼 Example:

php CVE-2025-49113.php http://localhost/roundcube/ admin password "id"

Github

⬇️ Download
🔒 BugCod3

#CVE #PHP #RemoteCode
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

Hi 👋 , friends who want to help us in attacking the .il domain address can provide their type of help in the bot below and contact us.

T.me/BugCod3BOT

Networking Commands

#Network #Command
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

BadMod auto exploit tool

💬 CMS auto detect and exploit.

💻 Installation:

chmod +x INSTALL
./INSTALL

Github

⬇️ Download
🔒 BugCod3

#PHP #Auto #Exploitation
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

Trape (stable) v2.0

💬
Trape is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how large Internet companies could obtain confidential information such as the status of sessions of their websites or services and control their users through their browser, without their knowledge, but It evolves with the aim of helping government organizations, companies and researchers to track the cybercriminals.

📊 Some benefits:
⚪️ LOCATOR OPTIMIZATION
⚪️ APPROACH
⚪️ REST API
⚪️ PROCESS HOOKS
⚪️ PUBLIC NETWORK TUNNEL
⚪️ CLICK ATTACK TO GET CREDENTIALS
⚪️ NETWORK
⚪️ PROFILE

💻 Usage:

cd trape
pip3 install -r requirements.txt
python3 trape.py -h

#Example: python3 trape.py --url http://example.com --port 8080

Github

⬇️ Download
🔒 BugCo3

#Python #Osint #Security #Tracking #Tools
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

GhostRecon

💬
GhostRecon is a passive reconnaissance tool used in cybersecurity and web penetration testing that automates the discovery of subdomains, IP addresses, and ASN (Autonomous System Number) information for a target domain. It leverages publicly available data sources and OSINT techniques to streamline the information gathering process. Additionally, it can identify active IP addresses and detect the presence of Content Delivery Networks (CDNs) and Web Application Firewalls (WAFs) to support security analysis.

📊 What Recon Tool Does:
⚪️ Find All Subdomains
⚪️ Find All URLs ASN
⚪️ Fetching IP
⚪️ Identify Live IPs
⚪️ Detect CDN/WAF

To Buy: T.me/BugCod3BOT

Mirai DDoS source with botnet and all tools and peripherals for sale, urgent sale

To Buy: T.me/BugCod3BOT

RFC-compliant payloads for email and phone number fields

#RFC #Payload
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

Burp Suite MCP Server Extension with scan and crawl features

💬
This an extended MCP Server Extension for BurpSuite proxy with scan and crawl based on the original.
For Building instructions follow below the original README as provided from PortSwigger, for direct use, load the extension provided on your Burp proxy.

📊 Features:
⚪️ Connect Burp Suite to AI clients through MCP
⚪️ Automatic installation for Claude Desktop
⚪️ Comes with packaged Stdio MCP proxy server

💻 Usage:
⚪️ Install the extension in Burp Suite
⚪️ Configure your Burp MCP server in the extension settings
⚪️ Configure your MCP client to use the Burp SSE MCP server or stdio proxy
⚪️ Interact with Burp through your client!

🔼 Installation:
Prerequisites
⚪️ Java
⚪️ Jar Command

cd burp-mcp
./gradlew embedProxyJar
#Open Burp Suite
#Access the Extensions Tab
#Add the Extension

Github

⬇️ Download
🔒 BugCod3

#Burp #Suite #Extension
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

If this post gets support and a lot of reactions, we will prepare and create many more cool tools for you to use and enjoy. 🔥

You can improve our script by replying to your experience to improve it.

Twitter
Bot

T.me/BugCod3

🔥 [remote] Ivanti Endpoint Manager Mobile 12.5.0.0 - Authentication Bypass
Ivanti Endpoint Manager Mobile 12.5.0.0 - Authentication Bypass

🔗 Read / Download

#BugCod3 #security #bugbounty #infosec
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

Google Dork - High % keywords 🚀

inurl:conf | inurl:env | inurl:cgi | inurl:bin | inurl:etc | inurl:root | inurl:sql | inurl:backup | inurl:admin | inurl:php site:example[.]com

#BugCod3 #Google #Dork
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

How this seasoned bug bounty hunter combines Burp Suite and HackerOne to uncover high-impact vulnerabilities
Arman S., a full-time independent security researcher and bug bounty hunter, talked us through how he uses Burp Suite Professional and HackerOne in tandem to find and report high-value security vulner

🔗 Read more

#BugCod3 #security #bugbounty #infosec #portswigger
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

[webapps] Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure
Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure

🔗 Read more

#BugCod3 #security #bugbounty #infosec #exploitdb #exploit #poc
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3