CVE-2019-15107

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Github link:
https://github.com/ArtemCyberLab/Project-Exploitation-of-Webmin-Authentication-Vulnerability

CVE-2018-7422

A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.

Github link:
https://github.com/ndr-repo/CVE-2018-7422

CVE-2025-6934

None

Github link:
https://github.com/0xgh057r3c0n/CVE-2025-6934

CVE-2025-27591

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Github link:
https://github.com/umutcamliyurt/CVE-2025-27591

CVE-2025-49667

None

Github link:
https://github.com/Yuri08loveElaina/CVE-2025-49667

CVE-2025-8088

None

Github link:
https://github.com/pexlexity/WinRAR-CVE-2025-8088-Path-Traversal-PoC

CVE-2024-28397

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

Github link:
https://github.com/waleed-hassan569/CVE-2024-28397-command-execution-poc

CVE-2019-12185

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

Github link:
https://github.com/Drew-Alleman/CVE-2019-12185

CVE-2025-8875

None

Github link:
https://github.com/rxerium/CVE-2025-8875-CVE-2025-8876

CVE-2015-10141

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.

Github link:
https://github.com/n0m4d22/PoC-CVE-2015-10141-Xdebug