[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":58,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":65,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":71,"vulnerability-29935":78},[4,15,23,31,38],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","secondary","php2shell-rce",{"title":16,"slug":17,"text":18,"link":19,"external":20,"targets":21,"cta":19,"variant":13,"campaign_id":14},"PHP2Shell & Node2Shell detection - pricing page","php2shell-rce-pricing","PHP2Shell & Node2Shell detection live in every paid plan (unlimited rescans for patch validation)",null,false,[22],"\u002Fpricing",{"title":24,"slug":25,"text":26,"link":8,"external":9,"targets":27,"cta":12,"variant":13,"campaign_id":25},"Node2Shell detection - Vuln DB homepage, product, CVE page","node2shell","🚨 Detect Node2Shell \u002F HTTP2Shell with any paid plan. Get proof",[28,29,30],"\u002Fvulnerabilities-exploits","\u002Fproduct","\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",{"title":32,"slug":33,"text":34,"link":8,"external":9,"targets":35,"cta":37,"variant":13,"campaign_id":14},"PHP2Shell detection - NetScan on the NS page","php2shell-rce-netscan","🚨 Detect Node2Shell + PHP2Shell with NetScan (from $96\u002Fmo for 16 assets)",[36],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick NetScan",{"title":39,"slug":14,"text":40,"link":8,"external":9,"targets":41,"cta":12,"variant":13,"campaign_id":14},"PHP2Shell detection - top pages, pricing CTA","🚨 Detect Node2Shell + PHP2Shell with any paid plan. Get proof",[42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",["Island",59],{"key":60,"params":61,"result":63},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":62},"{}",{"head":64},{},["Island",66],{"key":67,"params":68,"result":69},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":62},{"head":70},{},["Island",72],{"key":73,"params":74,"result":76},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":75},"{\"text-color\":\"gray\"}",{"head":77},{},{"id":79,"detectable_with":80,"vuln_details":87,"vuln_id":97,"name":98,"published":99,"updated":19},29935,{"tool":81,"engine":84},{"id":82,"name":83},1,"Network Scanner",{"id":85,"name":86},2,"Nuclei",{"id":79,"codename":19,"description":19,"severity":88,"risk_description":89,"public_description":90,"public_recommendation":91,"recommendation":19,"references":92,"cvssv3":19,"epss_score":19,"epss_percentile":19,"cve":19,"in_cisa_catalog":20,"date":19,"software_type":19,"vendor":95,"product":96,"ptt_exploit_capabilities":19},"critical","The risk exists that an attacker can use the vulnerability identified to perform further attacks on the server.","NUUO Crystal Server 3.19.0.85 exposes an unauthenticated file upload handler at upload.php that echoes the client-supplied multipart filename and passes it directly to copy() as the destination, with no authentication, extension, MIME or path validation. An anonymous POST writes an attacker-named PHP file into the served document root, and a single GET triggers the lighttpd fastcgi mapping to execute it, yielding remote code execution as the product's PHP service account.","Restrict access to upload.php, require authentication, and enforce extension, MIME and destination-path validation on uploads. Apply vendor updates when available.",[93,94],"https:\u002F\u002F0day-rubbish.com\u002Fblog\u002Fnuuo-crystal-server-unauth-upload-php-webroot-write-rce","https:\u002F\u002Fgithub.com\u002FExploit-Garbage\u002F0day-Rubbish","nuuo","crystal-server","NETSCAN-NUCLEI-VULNERABILITIES-NUUO-UNAUTH-RCE","NUUO Crystal Server - Unauthenticated File Upload Remote Code Execution","2026-10-30T00:00:00Z"]