The Exploit Database - CXSecurity.com

Kanboard < = 1.2.50 Authenticated SQL Injection

Mohammed Idrees Banyamer — Wed, 18 Mar 2026 21:17:40 +0000

Topic: Kanboard < = 1.2.50 Authenticated SQL Injection Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Kanboard Authenticated SQL Injection in ProjectPermissionController # CVE: ...

OpenClaw tools.exec.safeBins < = 2026.2.22 Remote Code Execution

Mohammed Idrees Banyamer — Mon, 02 Mar 2026 21:11:47 +0000

Topic: OpenClaw tools.exec.safeBins < = 2026.2.22 Remote Code Execution Risk: Low Text:#!/usr/bin/env python3 # Exploit Title: OpenClaw tools.exec.safeBins < = 2026.2.22 Remote Code Execution # CVE: CV...

Google Chrome < 145.0.7632.75 - CSSFontFeatureValuesMap Use-After-Free

nu11secur1ty — Mon, 23 Feb 2026 22:18:20 +0000

Topic: Google Chrome < 145.0.7632.75 - CSSFontFeatureValuesMap Use-After-Free Risk: High Text:# Exploit Title: Google Chrome < 145.0.7632.75 - CSSFontFeatureValuesMap Use-After-Free # Date: 2026-02-23 # Exploit Author: ...

Siklu EtherHaul Series EH-8010 Remote Command Execution

semaja2 — Sat, 14 Feb 2026 20:31:45 +0000

Topic: Siklu EtherHaul Series EH-8010 Remote Command Execution Risk: High Text:# Exploit Title:Siklu EtherHaul Series EH-8010 - Remote Command Execution # Shodan Dork: "EH-8010" or "EH-1200" # Date: 2025-...

aiohttp 3.9.1 Directory Traversal

Beatriz Fresno Naumova — Thu, 05 Feb 2026 21:43:29 +0000

Topic: aiohttp 3.9.1 Directory Traversal Risk: Medium Text:# Exploit Title: Python aiohttp directory traversal PoC (CVE-2024-23334) # Google Dork: N/A # Date: 2025-10-06 # Exploit Aut...

deephas < = 1.0.7 - Prototype Pollution leading to Arbitrary Code Execution / DoS

Mohammed Idrees Banyamer — Mon, 02 Feb 2026 21:14:04 +0000

Topic: deephas < = 1.0.7 - Prototype Pollution leading to Arbitrary Code Execution / DoS Risk: High Text:#!/usr/bin/env python3 # # Exploit Title: deephas < = 1.0.7 - Prototype Pollution leading to Arbitrary Code Execution / DoS #...

LangChain Core - Serialization Injection to Jinja2 SSTI/RCE

Mohammed Idrees Banyamer — Mon, 26 Jan 2026 19:48:43 +0000

Topic: LangChain Core - Serialization Injection to Jinja2 SSTI/RCE Risk: High Text:# Exploit Title: LangChain Core - Serialization Injection to Jinja2 SSTI/RCE # Date: 2025-12-29 # Exploit Author: Mohammed I...

AVideo Notify.ffmpeg.json.php Unauthenticated Remote Code Execution

Valentin — Sun, 18 Jan 2026 21:49:23 +0000

Topic: AVideo Notify.ffmpeg.json.php Unauthenticated Remote Code Execution Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Birth Chart Compatibility WordPress Plugin 2.0 Full Path Disclosure

Byte Reaper — Sun, 28 Dec 2025 10:40:02 +0000

Topic: Birth Chart Compatibility WordPress Plugin 2.0 Full Path Disclosure Risk: Low Text:/* * Exploit Title : Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure * Author : Byte Reaper *...

dotCMS 25.07.02-1 Authenticated Blind SQL Injection

Matan Sandori — Wed, 17 Dec 2025 23:01:51 +0000

Topic: dotCMS 25.07.02-1 Authenticated Blind SQL Injection Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: dotCMS 25.07.02-1 - Authenticated Blind SQL Injection # Google Dork: N/A # Date: 2...

Mbed TLS 3.6.4 Use-After-Free

Byte Reaper — Tue, 09 Dec 2025 21:45:49 +0000

Topic: Mbed TLS 3.6.4 Use-After-Free Risk: High Text:/* * Exploit Title: Mbed TLS 3.6.4 - Use-After-Free * Google Dork: N/A * Date: 2025-08-29 * Exploit Author: Byte Reaper...

MonstaFTP Unauthenticated File Upload

ibrahimsql — Mon, 01 Dec 2025 16:53:54 +0000

Topic: MonstaFTP Unauthenticated File Upload Risk: Medium Text:# Titles: MonstaFTP Unauthenticated File Upload CVE-2025-34299 # Author: ibrahimsql # Date: 11/21/2025 # Vendor: https://www...

Flowise 3.0.4 Remote Code Execution

nltt0 — Sat, 01 Nov 2025 19:53:49 +0000

Topic: Flowise 3.0.4 Remote Code Execution Risk: High Text:# Exploit Title: Flowise 3.0.4 - Remote Code Execution (RCE) # Date: 10/11/2025 # Exploit Author: [nltt0] (https://github.com...

Swagger UI 1.0.3 Cross-Site Scripting (XSS)

ByteReaper0 — Wed, 29 Oct 2025 20:23:07 +0000

Topic: Swagger UI 1.0.3 Cross-Site Scripting (XSS) Risk: Low Text:/* * Author : Byte Reaper * Telegram : @ByteReaper0 * CVE : CVE-2025-8191 * Title : Swagger UI 1.0.3...

Vvveb CMS 1.0.5 Remote Code Execution

Maksim — Fri, 24 Oct 2025 07:39:11 +0000

Topic: Vvveb CMS 1.0.5 Remote Code Execution Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

SugarCRM unauthenticated Remote Code Execution (RCE)

DANG — Tue, 07 Oct 2025 21:08:12 +0000

Topic: SugarCRM unauthenticated Remote Code Execution (RCE) Risk: High Text:# Exploit Title: SugarCRM unauthenticated Remote Code Execution (RCE) # Exploit Author: DANG # Vendor Homepage: https://www.s...

Belkin F9K1009 F9K1010 2.00.04/2.00.09 Hard Coded Credentials

Byte — Tue, 30 Sep 2025 20:51:34 +0000

Topic: Belkin F9K1009 F9K1010 2.00.04/2.00.09 Hard Coded Credentials Risk: High Text:/* * Title : Belkin F9K1009 F9K1010 2.00.04/2.00.09 - Hard Coded Credentials * Author : Byte Reaper * CVE...

Commvault CLI Argument Injection / Traversal / Remote Code Execution

Piotr Bazydlo — Sun, 21 Sep 2025 17:30:38 +0000

Topic: Commvault CLI Argument Injection / Traversal / Remote Code Execution Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Sitecore XP Post-Authentication File Upload

Piotr Bazydlo — Sun, 14 Sep 2025 16:43:46 +0000

Topic: Sitecore XP Post-Authentication File Upload Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Ultimate Member WordPress Plugin 2.6.6 Privilege Escalation

Gurjot Singh — Thu, 28 Aug 2025 11:18:51 +0000

Topic: Ultimate Member WordPress Plugin 2.6.6 Privilege Escalation Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation # Exploit Author: Gur...

Ghost CMS 5.59.1 Arbitrary File Read

ibrahimsql — Thu, 28 Aug 2025 11:18:21 +0000

Topic: Ghost CMS 5.59.1 Arbitrary File Read Risk: Medium Text:#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ # Exploit Title: Ghost CMS 5.59.1 - Arbitrary File Read # Date: 2023-09-...

DOS Baby POP3 Server 1.04

Érick Sousa — Thu, 28 Aug 2025 11:16:57 +0000

Topic: DOS Baby POP3 Server 1.04 Risk: Medium Text:# Exploit Title: DOS Baby POP3 Server 1.04 # Date: 12/08/2025 # Exploit Author: Érick Sousa (https://www.linkedin.com/in/eri...

Tenda AC20 16.03.08.12 Command Injection

Wed, 20 Aug 2025 19:34:42 +0000

Topic: Tenda AC20 16.03.08.12 Command Injection Risk: Medium Text:/* * Exploit Title : Tenda AC20 16.03.08.12 - Command Injection * Author : Byte Reaper * CVE : CVE-2025-90...

Projectworlds Online Admission System 1.0 SQL Injection

Byte Reaper — Mon, 11 Aug 2025 20:53:04 +0000

Topic: Projectworlds Online Admission System 1.0 SQL Injection Risk: Medium Text:/* * Title : projectworlds Online Admission System 1.0 - SQL Injection * Author : Byte Reaper * CVE ...

JetBrains TeamCity 2023.11.4 Authentication Bypass

ibrahimsql (https://github.com/ibrahimsql) — Mon, 11 Aug 2025 20:50:58 +0000

Topic: JetBrains TeamCity 2023.11.4 Authentication Bypass Risk: High Text:#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ # Exploit Title: JetBrains TeamCity 2023.11.4 - Authentication Bypass # ...

Cisco ISE 3.0 Remote Code Execution

ibrahimsql — Mon, 11 Aug 2025 20:50:08 +0000

Topic: Cisco ISE 3.0 Remote Code Execution Risk: High Text:# Exploit Title: Cisco ISE 3.0 - Remote Code Execution (RCE) # Exploit Author: @ibrahimsql ibrahimsql.com # Exploit Author's ...

Pandora ITSM Authenticated Command Injection

h00die-gr3y — Sun, 10 Aug 2025 21:39:55 +0000

Topic: Pandora ITSM Authenticated Command Injection Risk: High Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE

Anonymous — Fri, 08 Aug 2025 23:13:16 +0000

Topic: Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE Risk: High Text:package main import ( "flag" "fmt" "io" "net/http" "net/url" "os" "strings" ) /* Shenzhen Aitemi M300 Wi-...

Malicious XDG Desktop File

Brendan coles — Tue, 05 Aug 2025 12:00:26 +0000

Topic: Malicious XDG Desktop File Risk: Medium Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Langflow 1.2.x Remote Code Execution (RCE)

Raghad Abdallah Al-syouf — Sun, 03 Aug 2025 15:18:19 +0000

Topic: Langflow 1.2.x Remote Code Execution (RCE) Risk: High Text:#!/usr/bin/env python3 # Exploit Title: Langflow 1.2.x - Remote Code Execution (RCE) # Date: 2025-07-11 # Exploit Author: Ra...

Microsoft Excel LTSC 2024 Remote Code Execution

nu11secur1ty — Thu, 31 Jul 2025 15:32:12 +0000

Topic: Microsoft Excel LTSC 2024 Remote Code Execution Risk: High Text:# Titles: Microsoft Excel LTSC 2024 - Remote Code Execution (RCE) # Author: nu11secur1ty # Date: 06/16/2025 # Vendor: Micros...

Adobe ColdFusion 2023.6 Remote File Read

@İbrahimsql — Mon, 28 Jul 2025 21:37:58 +0000

Topic: Adobe ColdFusion 2023.6 Remote File Read Risk: High Text:# Exploit Title: Adobe ColdFusion 2023.6 - Remote File Read # Exploit Author: @İbrahimsql # Exploit Author's github: https:/...

Malicious Windows Registration Entries (.reg) File

bcoles — Thu, 24 Jul 2025 19:42:45 +0000

Topic: Malicious Windows Registration Entries (.reg) File Risk: Medium Text:## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-...

Microsoft PowerPoint 2019 Remote Code Execution (RCE)

Mohammed Idrees Banyamer — Thu, 24 Jul 2025 19:41:18 +0000

Topic: Microsoft PowerPoint 2019 Remote Code Execution (RCE) Risk: High Text:#!/usr/bin/env python3 # Exploit Title: Microsoft PowerPoint 2019 - Remote Code Execution (RCE) # Author: Mohammed Idrees Ban...

Discourse 3.2.x Anonymous Cache Poisoning

ibrahimsql — Fri, 11 Jul 2025 21:16:20 +0000

Topic: Discourse 3.2.x Anonymous Cache Poisoning Risk: Low Text:#!/usr/bin/env python3 """ Exploit Title: Discourse 3.2.x - Anonymous Cache Poisoning Date: 2024-10-15 Exploit Author: ibra...

VBA Bypass Windows Defender Exploit PoC

nu11secur1ty — Wed, 02 Jul 2025 11:12:26 +0000

Topic: VBA Bypass Windows Defender Exploit PoC Risk: High Text:# CVE-2025-47170 Exploit PoC VBA Bypass Windows Defender - Overview This Python script is a proof-of-concept (PoC) exploit de...

Social Warfare WordPress Plugin 3.5.2 Remote Code Execution (RCE)

Huseyin Mardini — Tue, 01 Jul 2025 18:43:33 +0000

Topic: Social Warfare WordPress Plugin 3.5.2 Remote Code Execution (RCE) Risk: High Text:#!/usr/bin/env python3 # Exploit Title: Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE) # Date: 25-06-2...

PHP CGI Module 8.3.4 Remote Code Execution

ibrahimsql — Tue, 01 Jul 2025 18:42:44 +0000

Topic: PHP CGI Module 8.3.4 Remote Code Execution Risk: High Text:#!/usr/bin/env python3 # Exploit Title: PHP CGI Module 8.3.4 - Remote Code Execution (RCE) # Date: 2025-06-13 # Exploit Au...

Grandstream GSD3710 1.0.11.13 Stack Overflow

Pepelux — Sun, 29 Jun 2025 19:42:24 +0000

Topic: Grandstream GSD3710 1.0.11.13 Stack Overflow Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Grandstream GSD3710 1.0.11.13 - Stack Overflow # Date: 2025-05-29 # Exploit Auth...

Parrot and DJI variants Drone OSes Kernel Panic Exploit

Mohammed Idrees Banyamer — Thu, 26 Jun 2025 21:43:59 +0000

Topic: Parrot and DJI variants Drone OSes Kernel Panic Exploit Risk: Low Text:#!/usr/bin/env python3 # Exploit Title: Parrot and DJI variants Drone OSes - Kernel Panic Exploit # Author: Mohammed Idrees B...