PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
#!/usr/bin/env python3
Exploits
Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
- 类型
- 漏洞条目
- 总量
- 25,052
- 页码
- 1
ProSoft RLX-IFH24E v2.2.44 – Unsigned Firmware Upgrade Package Executed as Root
Title: ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
Parasoft Continuous Testing Platform 10.7.5 – JSP command execution
Title: Parasoft Continuous Testing Platform 10.7.5- JSP command execution
Exasol Database 7.1.30 – command execution
Title: Exasol Database 7.1.30 - command execution
Edimax BR-6478AC firmware v2.20 – authenticated command injection
Title: Edimax BR-6478AC firmware v2.20 - authenticated command injection
Automotive Shop Management System 1.0 – SQLi
# Titles: Automotive Shop Management System 1.0 - SQLi
Open eClass 3.15 – RCE
# Exploit Title: Open eClass 3.15 - RCE
Keycloak 26.7.2 – Unauthenticated Account Takeover
# Exploit Title: Keycloak 26.7.2 - Unauthenticated Account Takeover
Synametrics Syncrify 6.2 – command execution
Title: Synametrics Syncrify 6.2 - command execution
South River Technologies Titan MFT Server 26.0.0 – code execution
Title: South River Technologies Titan MFT Server 26.0.0 - code execution
pizzafy-1.0 – SQLi
# Title: pizzafy-1.0 - SQLi
POMS oretnom23v1.0 – SQLi vulnerabilities
# Title: POMS oretnom23v1.0 - SQLi vulnerabilities
InvoicePlane 1.7.1 – RCE
# Exploit Title: InvoicePlane 1.7.1 - RCE
SuiteCRM 8.10.1 – Authenticated SSRF
# Exploit Title: SuiteCRM 8.10.1 - Authenticated SSRF
Krayin CRM 2.2.4 – IDOR
# Exploit Title: Krayin CRM 2.2.4 - IDOR
Ecava_ntegraXor IGX_16.0.701.10 – RCE
Title: Ecava IntegraXor IGX 16.0.701.10 - RCE
Food-Ordering 1.0 – LFI
# Title: Food-Ordering 1.0 - LFI
WordPress 7.0.2 – Path Travesal
# Exploit Title: WordPress 7.0.2 - Path Travesal
TigerGraph_Community_Edition 4.2.4 – arbitrary file write
Title: TigerGraph_Community_Edition 4.2.4 - arbitrary file write
Teltonika_RutOS 00.07.06.21 – command injection
Title: Teltonika_RutOS 00.07.06.21 - command injection
MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 – RCE
#!/usr/bin/env python3
Metabase 0.61.0 – Authenticated Remote Code Execution
# Exploit Title: Metabase 0.61.0 - Authenticated Remote Code Execution
FreePBX 17.0.2 – Remote Code Execution (RCE)
# Exploit Title: FreePBX 17.0.2 - Remote Code Execution
Marimo 0.20.4 – RCE
Title: Marimo 0.20.4 - RCE
Fullhan FH8626V100 – Multiple Vulnerabilities
# Exploit Title: Fullhan FH8626V100 - Multiple Vulnerabilities
Langflow 1.10.0 – RCE
# Exploit Title: Langflow 1.10.0 - RCE
Ghost_CMS 6.19.0 – Remote Code Execution
# Exploit Title: Ghost_CMS 6.19.0 - Remote Code Execution
PodcastGenerator 3.2.9 – Stored XSS
# Exploit Title: PodcastGenerator 3.2.9 - Stored XSS
Bludit CMS 3.20.0 – Reflected Cross-Site Scripting
# Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting
EVerest 2025.9.0 – DoS
# Exploit Title: EVerest 2025.9.0 - DoS
EasyAppointments 1.5.1 – Blind SQL Injection
# Exploit Title: EasyAppointments 1.5.1 - Blind SQL Injection
miniOrange 5.4.3 – Unauthenticated Auth Bypass
# Exploit Title: miniOrange 5.4.3 - Unauthenticated Auth Bypass
Grav CMS 2.0.7 – RCE
#!/usr/bin/env python3
Bludit CMS – Stored XSS
# Exploit Title: Bludit CMS - Stored XSS
Payload CMS 3.72.0 – Blind SQL Injection
# Exploit Title: Payload CMS 3.72.0 - Blind SQL Injection
Wolf CMS 0.8.3.1 – RCE v
# Exploit Title: Wolf CMS 0.8.3.1 - RCE
Langflow 1.8.4 – Path Traversal to Remote Code Execution
# Exploit Title: Langflow 1.8.4 - Path Traversal to Remote Code Execution
Linksys E1200_2.0.04 – Unauthenticated OS Command Injection
# Exploit Title: Linksys E1200_2.0.04 - Unauthenticated OS Command Injection
CubeCart 6.7.4 – Cross-Site Scripting
# Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting
CubeCart 6.7.4 – Stored XSS
# Exploit Title: CubeCart 6.7.4 - Stored Cross-Site Scripting
CubeCart 6.7.4 – SQL
# Exploit Title: CubeCart 6.7.4 - SQL
CubeCart 6.7.4 – SQL injection
# Exploit Title: CubeCart 6.7.4 - SQL injection
C-MOR 6.0104 – Cross-Site Scripting (XSS)
# Exploit Title: C-MOR 6.0104 - Cross-Site Scripting (XSS)
C-MOR 6.0104 – Directory Traversal
# Exploit Title: C-MOR 6.0104 - Directory Traversal
CVE-2026-42167 – ProFTPD mod_sql post-authentication SQLi – RCE
#!/usr/bin/env python3
Linuxfabrik monitoring_plugins_6.0.0 – SSRF
# Exploit Title: Linuxfabrik monitoring_plugins_6.0.0 - SSRF
Nodemailer 9.0.0 – File Read/ SSRF
# Exploit Title: Nodemailer 9.0.0 - File Read/ SSRF
flyto-core 2.26.7 – Arbitrary File Write
# Exploit Title: flyto-core 2.26.7 - Arbitrary File Write
NanaZip 6.5 – DoS
# Exploit Title: NanaZip 6.5 - DoS