PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2023-41892] CraftCMS RCE

calif.io | vulnerability | CVE-2023-41892 | #rce | #vulnerability-research | #php | #web-security | #web | #craftcms | #cve-2023-41892
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# CraftCMS RCE Chaining a file write into remote code execution on CraftCMS. Thanh Nguyen September 14, 2023 webphp > Craft is a flexible, user-friendly CMS for creating custom digital experiences...
CVE
CVE-2023-41892
Published
Collected

Related coverage

vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · hunt.io
Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)
Two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, leaked pre-patch. We map the exposed PHP footprint and hunt open directories for exploitation.
Back