jQuery 3.3.1 – Prototype Pollution & XSS Exploit
# Exploit Title: jQuery Prototype Pollution & XSS Exploit (CVE-2019-11358 & CVE-2020-7656)
Exploits
Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
- 类型
- 漏洞条目
- 总量
- 24,950
- 页码
- 10
InfluxDB OSS 2.7.11 – Operator Token Privilege Escalation
# Exploit Title: InfluxDB OSS Operator Privilege Escalation via BusinessLogic Flaw
Sony XAV-AX5500 1.13 – Firmware Update Validation Remote Code Execution (RCE)
# Exploit Title: Sony XAV-AX5500 Firmware Update Validation Remote Code Execution
GeoVision GV-ASManager 6.1.0.0 – Information Disclosure
# Exploit Title: Information Disclosure in GeoVision GV-ASManager
Apache Tomcat 11.0.3 – Remote Code Execution
# Exploit Title: Apache Tomcat Path Equivalence - Remote Code Execution
YesWiki 4.5.1 – Unauthenticated Path Traversal
# Exploit Title: YesWiki < 4.5.2 - Unauthenticated Path Traversal
XWiki Platform 15.10.10 – Remote Code Execution
# Exploit Title: XWiki Platform - Remote Code Execution
DataEase 2.4.0 – Database Configuration Information Exposure
# Exploit Title: DataEase 2.4.0 - Database Configuration Information Exposure
Palo Alto Networks Expedition 1.2.90.1 – Admin Account Takeover
# Exploit Title: Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
Watcharr 1.43.0 – Remote Code Execution (RCE)
# Exploit Title : Watcharr 1.43.0 - Remote Code Execution (RCE)
Backup and Staging by WP Time Capsule 1.22.21 – Unauthenticated Arbitrary File Upload
# Exploit Title: WordPress Backup and Staging Plugin ≤ 1.21.16 - Arbitrary File Upload to RCE
WBCE CMS 1.6.3 – Authenticated Remote Code Execution (RCE)
# Exploit Title: WBCE CMS
Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 – SQL Injection
# Exploit Title: Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection
IBM Security Verify Access 10.0.0 – Open Redirect during OAuth Flow
# Exploit Title : IBM Security Verify Access 10.0.0 - Open Redirect during OAuth Flow
Next.js Middleware 15.2.2 – Authorization Bypass
# Exploit Title: Next.js Middleware Bypass Vulnerability (CVE-2025-29927)
Kubio AI Page Builder 2.5.1 – Local File Inclusion (LFI)
# Exploit Title: Kubio AI Page Builder
Exclusive Addons for Elementor 2.6.9 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Exclusive Addons for Elementor ≤ 2.6.9 - Authenticated Stored Cross-Site Scripting (XSS)
Royal Elementor Addons and Templates 1.3.78 – Unauthenticated Arbitrary File Upload
# Exploit Title: WordPress Plugin Royal Elementor Addons
Microchip TimeProvider 4100 (Configuration modules) 2.4.6 – OS Command Injection
# Exploit Title: Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection
Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting ...
Angular-Base64-Upload Library 0.1.20 – Remote Code Execution (RCE)
# Exploit Title: Angular-Base64-Upload Library 0.1.20 - Remote Code Execution (RCE)
ABB Cylon Aspect 3.07.02 – File Disclosure
# Exploit Title : ABB Cylon Aspect 3.07.02 - File Disclosure
Vite 6.2.2 – Arbitrary File Read
# Exploit Title: Vite Arbitrary File Read - CVE-2025-30208
ABB Cylon Aspect 3.07.01 – Hard-coded Default Credentials
# Exploit Title : ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials
Microsoft Office 2019 MSO Build 1808 – NTLMv2 Hash Disclosure
# Exploit Title: Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure
Webmin Usermin 2.100 – Username Enumeration
# Exploit Title: Webmin Usermin 2.100 - Username Enumeration
ollama 0.6.4 – Server Side Request Forgery (SSRF)
# Exploit Title: ollama 0.6.4 - SSRF
Nagios Log Server 2024R1.3.1 – Stored XSS
# Exploit Title: Stored XSS Vulnerability in Nagios Log Server (Privilege Escalation to Admin)
AppSmith 1.47 – Remote Code Execution (RCE)
# Exploit Title: AppSmith 1.47 - Remote Code Execution (RCE)
Elaine’s Realtime CRM Automation 6.18.17 – Reflected XSS
# Exploit Title: Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
ABB Cylon Aspect 3.08.01 – Remote Code Execution (RCE)
# Exploit Title : ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)
ABB Cylon Aspect 3.08.01 – Arbitrary File Delete
# Exploit Title : ABB Cylon Aspect 3.08.01 - Arbitrary File Delete
SAP NetWeaver – 7.53 – HTTP Request Smuggling
# Exploit Title: SAPGateBreaker Exploit - CVE-2022-22536 - HTTP Request Smuggling Through SAP's Front Door
Solstice Pod 6.2 – API Session Key Extraction via API Endpoint
# Exploit Title: Solstice Pod API Session Key Extraction via API Endpoint
XWiki Standard 14.10 – Remote Code Execution (RCE)
# Exploit Title: CVE-2023-48292 Remote Code Execution Exploit
Litespeed Cache 6.5.0.1 – Authentication Bypass
# Exploit Title: Litespeed Cache 6.5.0.1 - Authentication Bypass
CodeCanyon RISE CRM 3.7.0 – SQL Injection
# Exploit Title: CodeCanyon RISE CRM 3.7.0 - SQL Injection
Sonatype Nexus Repository 3.53.0-01 – Path Traversal
# Exploit Title: Sonatype Nexus Repository 3.53.0-01 - Path Traversal
Rejetto HTTP File Server 2.3m – Remote Code Execution (RCE)
# Exploit Title: Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE)
Progress Telerik Report Server 2024 Q1 (10.0.24.305) – Authentication Bypass
# Exploit Title: Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass
MoziloCMS 3.0 – Remote Code Execution (RCE)
# Exploit Title: MoziloCMS 3.0 - Remote Code Execution (RCE)
KubeSphere 3.4.0 – Insecure Direct Object Reference (IDOR)
# Exploit Title: KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR)
X2CRM 8.5 – Stored Cross-Site Scripting (XSS)
# Exploit Title: X2CRM 8.5 - Stored Cross-Site Scripting (XSS)
NVIDIA Container Toolkit 1.16.1 – Time-of-check Time-of-Use (TOCTOU)
# Exploit Title: Container Breakout with NVIDIA Container Toolkit
Microsoft Windows – NTLM Hash Leak Malicious Windows Theme
# Exploit Title: CVE-2024-21320 - NTLM Hash Leak via Malicious Windows Theme
Aztech DSL5005EN Router – ‘sysAccess.asp’ Admin Password Change (Unauthenticated)
# Exploit Title: Aztech DSL5005EN Router - 'sysAccess.asp' Admin Password Change (Unauthenticated)
TeamPass 3.0.0.21 – SQL Injection
# Exploit Title: TeamPass SQL Injection
Jasmin Ransomware – SQL Injection Login Bypass
# Exploit Title: Jasmin Ransomware SQL Injection Login Bypass
JUX Real Estate 3.4.0 – SQL Injection
# Exploit Title: JUX Real Estate 3.4.0 - SQL Injection
FluxBB 1.5.11 – Stored Cross-Site Scripting (XSS)
# Exploit Title: FluxBB 1.5.11 Stored xss