GeoVision GV-ASManager 6.1.0.0 – Broken Access Control
# Exploit Title: Broken Access Control in GeoVision GV-ASManager
multiple
multiple 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
ABB Cylon FLXeon 9.3.4 – Remote Code Execution (Authenticated)
# Exploit Title: ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated)
GeoVision GV-ASManager 6.1.1.0 – CSRF
# Exploit Title: GeoVision GV-ASManager 6.1.1.0 - CSRF
ABB Cylon FLXeon 9.3.4 – Remote Code Execution (RCE)
# Exploit title: ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE)
Netman 204 – Remote command without authentication
# Exploit Title: Netman 204 - Remote command with out authentication
ABB Cylon Aspect 3.08.02 – PHP Session Fixation
# Exploit title: ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability
CMU CERT/CC VINCE 2.0.6 – Stored XSS
# Exploit Tile: CMU CERT/CC VINCE 2.0.6 - Stored XSS
WebFileSys 2.31.0 – Directory Path Traversal
# Exploit Title: WebFileSys 2.31.0 - Directory Path Traversal in relPath Parameter
ABB Cylon FLXeon 9.3.4 – WebSocket Command Spawning
# ABB Cylon FLXeon 9.3.4 (wsConnect.js) WebSocket Command Spawning PoC
ABB Cylon FLXeon 9.3.4 – Cross-Site Request Forgery
# Exploit title: ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery
ABB Cylon FLXeon 9.3.4 – Default Credentials
ABB Cylon FLXeon 9.3.4 Default Credentials
ABB Cylon FLXeon 9.3.4 – System Logs Information Disclosure
# Exploit Tiltle: ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure
Nagios Log Server 2024R1.3.1 – API Key Exposure
# Exploit Title: Nagios Log Server 2024R1.3.1 - API Key Exposure
CyberPanel 2.3.6 – Remote Code Execution (RCE)
# Exploit Title: CyberPanel 2.3.6 - Remote Code Execution (RCE)
MagnusSolution magnusbilling 7.3.0 – Command Injection
# Exploit Title: MagnusSolution magnusbilling 7.3.0 - Command Injection
Cosy+ firmware 21.2s7 – Command Injection
# Exploit Title: Cosy+ firmware 21.2s7 - Command Injection
K7 Ultimate Security K7RKScan.sys 17.0.2019 – Denial Of Service (DoS)
# Exploit Title: K7 Ultimate Security K7RKScan.sys 17.0.2019 - Denial Of Service (DoS)
Cisco Smart Software Manager On-Prem 8-202206 – Account Takeover
# Exploit Title: Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover
Zohocorp ManageEngine ADManager Plus 7210 – Elevation of Privilege
# Exploit Title: ManageEngine ADManager Plus Build < 7210 Elevation of
Intelight X-1L Traffic controller Maxtime 1.9.6 – Remote Code Execution (RCE)
# Exploit Title: Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)
GeoVision GV-ASManager 6.1.0.0 – Information Disclosure
# Exploit Title: Information Disclosure in GeoVision GV-ASManager
Sony XAV-AX5500 1.13 – Firmware Update Validation Remote Code Execution (RCE)
# Exploit Title: Sony XAV-AX5500 Firmware Update Validation Remote Code Execution
InfluxDB OSS 2.7.11 – Operator Token Privilege Escalation
# Exploit Title: InfluxDB OSS Operator Privilege Escalation via BusinessLogic Flaw
jQuery 3.3.1 – Prototype Pollution & XSS Exploit
# Exploit Title: jQuery Prototype Pollution & XSS Exploit (CVE-2019-11358 & CVE-2020-7656)
Jasmin Ransomware – Arbitrary File Download (Authenticated)
# Exploit Title: Jasmin Ransomware - (Authenticated) Arbitrary File Download
UNA CMS 14.0.0-RC – PHP Object Injection
# Exploit Title: UNA CMS
Nagios Xi 5.6.6 – Authenticated Remote Code Execution (RCE)
# Exploit Title: Nagiosxi authenticated Remote Code Execution
WordPress User Registration & Membership Plugin 4.1.1 – Unauthenticated Privilege Escalation
# Exploit Title: WordPress User Registration & Membership Plugin
XWiki Platform 15.10.10 – Remote Code Execution
# Exploit Title: XWiki Platform - Remote Code Execution
YesWiki 4.5.1 – Unauthenticated Path Traversal
# Exploit Title: YesWiki < 4.5.2 - Unauthenticated Path Traversal
Apache Tomcat 11.0.3 – Remote Code Execution
# Exploit Title: Apache Tomcat Path Equivalence - Remote Code Execution
WBCE CMS 1.6.3 – Authenticated Remote Code Execution (RCE)
# Exploit Title: WBCE CMS
Watcharr 1.43.0 – Remote Code Execution (RCE)
# Exploit Title : Watcharr 1.43.0 - Remote Code Execution (RCE)
Palo Alto Networks Expedition 1.2.90.1 – Admin Account Takeover
# Exploit Title: Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
Royal Elementor Addons and Templates 1.3.78 – Unauthenticated Arbitrary File Upload
# Exploit Title: WordPress Plugin Royal Elementor Addons
Exclusive Addons for Elementor 2.6.9 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Exclusive Addons for Elementor ≤ 2.6.9 - Authenticated Stored Cross-Site Scripting (XSS)
Kubio AI Page Builder 2.5.1 – Local File Inclusion (LFI)
# Exploit Title: Kubio AI Page Builder
Next.js Middleware 15.2.2 – Authorization Bypass
# Exploit Title: Next.js Middleware Bypass Vulnerability (CVE-2025-29927)
IBM Security Verify Access 10.0.0 – Open Redirect during OAuth Flow
# Exploit Title : IBM Security Verify Access 10.0.0 - Open Redirect during OAuth Flow
Angular-Base64-Upload Library 0.1.20 – Remote Code Execution (RCE)
# Exploit Title: Angular-Base64-Upload Library 0.1.20 - Remote Code Execution (RCE)
Nagios Log Server 2024R1.3.1 – Stored XSS
# Exploit Title: Stored XSS Vulnerability in Nagios Log Server (Privilege Escalation to Admin)
ollama 0.6.4 – Server Side Request Forgery (SSRF)
# Exploit Title: ollama 0.6.4 - SSRF
Vite 6.2.2 – Arbitrary File Read
# Exploit Title: Vite Arbitrary File Read - CVE-2025-30208
ABB Cylon Aspect 3.07.02 – File Disclosure
# Exploit Title : ABB Cylon Aspect 3.07.02 - File Disclosure
SAP NetWeaver – 7.53 – HTTP Request Smuggling
# Exploit Title: SAPGateBreaker Exploit - CVE-2022-22536 - HTTP Request Smuggling Through SAP's Front Door
ABB Cylon Aspect 3.08.01 – Remote Code Execution (RCE)
# Exploit Title : ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)
Progress Telerik Report Server 2024 Q1 (10.0.24.305) – Authentication Bypass
# Exploit Title: Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass
Sonatype Nexus Repository 3.53.0-01 – Path Traversal
# Exploit Title: Sonatype Nexus Repository 3.53.0-01 - Path Traversal
KubeSphere 3.4.0 – Insecure Direct Object Reference (IDOR)
# Exploit Title: KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR)
Gitea 1.24.0 – HTML Injection
# Exploit Title: Gitea 1.24.0 - HTML Injection