MikroORM 7.0.13 – SQL Injection
# Exploit Title: MikroORM 7.0.13 - SQL Injection
multiple
multiple 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Prodigy Commerce 3.3.0 – Local File Inclusion
# Exploit Title: Prodigy Commerce 3.3.0 - Local File Inclusion
Langflow 1.3.0 – Remote Code Execution
# Exploit Title: Langflow 1.3.0 - Remote Code Execution
Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution
# Exploit Title: Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution
ImageMagick – Infinite Loop in the MIFF decoder can lead to CPU exhaustion
# Exploit Title: ImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion
ZTE Routers – Unauthenticated Denial of Service
# Exploit Title: ZTE Routers - Unauthenticated Denial of Service
ZTE ZXHN H188A V6 – Authentication Bypass
# Exploit Title: ZTE ZXHN H188A V6 - Authentication Bypass
ZTE H298A / H108N – Unauthenticated Credential Exposure
# Exploit Title: ZTE H298A / H108N - Unauthenticated Credential Exposure
Wing FTP Server 8.1.3 – Authenticated Remote Code Execution
# Exploit Title: Wing FTP Server 8.1.3 - Authenticated Remote Code Execution
CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
# Exploit Title: CubeCart < 6.7.0 - Reflected Cross-Site Scripting
strongSwan 5.9.13 – DoS
# Exploit Title: strongSwan 5.9.13 - DoS
EspoCRM 9.3.3 – SSRF
# Exploit Title: EspoCRM 9.3.3 - Authenticated SSRF via Alternative IPv4 Notation
OpenCATS 0.9.7.4 – SQL Injection
# Exploit Title: OpenCATS 0.9.7.4 - SQL Injection
Apache HTTP Server 2.4.66 – ‘mod_http2’ Double-Free Denial of Service
# Exploit Title: Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service
D-Link DSL2600U – ‘rom-0’ Admin Password Disclosure
# Exploit Title: D-Link DSL2600U - 'rom-0' Admin Password Disclosure
WordPress Temporary Login Plugin 1.0.0 – ‘temp-login-token’ Authentication Bypass to Account Takeover
# Exploit Title: Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover
Cockpit 359 – RCE
# Exploit Title: Cockpit 359 - RCE
BookStack 25.12.1 – Denial of Service
# Exploit Title: BookStack 25.12.1 - Denial of Service
solaredge – (CSRF-OOB-Injection)
# Titles: solaredge - (CSRF-OOB-Injection)
FUXA 1.2.9 – RCE
# Exploit Title: FUXA 1.2.9 - RCE
WordPress Plugin Supsystic Contact Form 1.7.36 – SSTI
# Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI
Apache HertzBeat 1.8.0 – Remote Code Execution
# Exploit Title: Apache HertzBeat 1.8.0 - Remote Code Execution
ePati Antikor NGFW 2.0.1301 – Authentication Bypass
# Exploit Title: ePati Antikor NGFW 2.0.1301 - Authentication Bypass
PJPROJECT 2.16 – Heap Bufferoverflow
# Exploit Title: PJPROJECT 2.16 - Heap Bufferoverflow
Ninja Forms Uploads – Unauthenticated PHP File Upload
# Exploit Title: Ninja Forms Uploads - Unauthenticated PHP File Upload
glances 4.5.2 – command injection
#!/usr/bin/env python3
coreruleset 4.21.0 – Firewall Bypass
# Exploit Title: coreruleset 4.21.0 - Firewall Bypass
telnetd 2.7 – Buffer Overflow
# Exploit Title: telnetd 2.7 - Buffer Overflow
Ghost CMS 6.19.0 – SQLi
# Exploit Title: Ghost CMS 6.19.0 - SQLi
LuaJIT 2.1.1774638290 – Arbitrary Code Execution
-- Exploit Title: LuaJIT 2.1.1774638290 - Arbitrary Code Execution
Bludit CMS 3.18.4 – RCE
# Exploit Title: Bludit CMS 3.18.4 - RCE
NocoBase 2.0.27 – VM Sandbox Escape
# Exploit Title: NocoBase 2.0.27 - VM Sandbox Escape
ThingsBoard IoT Platform 4.2.0 – Server-Side Request Forgery (SSRF)
# Exploit Title: ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)
Linksys E1200 2.0.04 – Authenticated Stack Buffer Overflow (RCE)
# Exploit Title: Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE)
MindsDB 25.9.1.1 – Path Traversal
# Exploit Title: MindsDB 25.9.1.1 - Path Traversal
Traccar GPS Tracking System 6.11.1 – Cross-Site WebSocket Hijacking (CSWSH)
# Exploit Title: Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
FUXA 1.2.8 – Authentication Bypass + RCE Exploit
# Exploit Title: FUXA 1.2.8 - Authentication Bypass + RCE Exploit
Google Chrome 145.0.7632.75 – CSSFontFeatureValuesMap
# Exploit Title: Google Chrome 145.0.7632.75 - CSSFontFeatureValuesMap
Repetier-Server 1.4.10 – Path Traversal
# Exploit Title: Repetier-Server 1.4.10 - Path Traversal
HUSTOJ Zip-Slip v26.01.24 – RCE
# Exploit Title: HUSTOJ Zip-Slip v26.01.24 - RCE
BusyBox 1.37.0 – Path Traversal
# Exploit Title: BusyBox 1.37.0 - Path Traversal
JUNG Smart Visu Server 1.1.1050 – Dos
# Exploit Title: JUNG Smart Visu Server 1.1.1050- Dos
SumatraPDF 3.5.2 – Remote Code Execution
# Exploit Title: SumatraPDF 3.5.2 - Remote Code Execution
NiceGUI 3.6.1 – Path Traversal
# Exploit Title: NiceGUI 3.6.1 - Path Traversal
Frigate NVR 0.16.3 – Remote Code Execution
# Exploit Title: Frigate NVR 0.16.3 - Remote Code Execution
Js2Py 0.74 – RCE
Exploit Title: Js2Py 0.74 - RCE
Camaleon CMS v2.9.0 – Path Traversal
# Exploit Title: Camaleon CMS v2.9.0 - Path Traversal
Cybersecurity AI (CAI) Framework 0.5.10 – Command Injection
# Exploit Title: Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection
Erugo 0.2.14 – Remote Code Execution (RCE)
# Exploit Title: Erugo <= 0.2.14 - Authenticated Remote Code Execution (RCE)