CVE-2019-1759-csrf-js-rce

CVE-2019-1759 Bolt-cms 3.6.10 Csrf - xss - rce Watch the video...

CVE-2018-11736

CVE-2018-11736 PHP RCE Exploit Pluck CMS Disclaimer ⚠️: This exploit was developed in Rust primarily as an introductory programming learning exercise. Please excuse any lack of technical rigor or non-idiomatic code patterns. Also, this is not my discovery; I relied on official reports to write thi...

CVE-2025-65094

CVE-2025-65094: WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation IDOR Overview Field| Details ---|--- CVE ID| CVE-2025-65094 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products WBCE/WBCECMS Details Summary A low-privileged user in WBCE CMS...

CVE-2022-37210

CVE-2022-37210 CVE-2022-37210 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2024-53255

CVE-2024-53255 boid CMS 2.1.1 - reflected Cross-Site Scripting XSS Description: A reflected XSS vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code Steps to exploit: 1- Login to the CMS and Navigate to the delete...

CVE-2025-6384

CVE-2025-6384: Groovy Sandbox Bypass 2 in CrafterCMS Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. Vendor Disclosure: The vendor's disclosure and fix for this...

CVE-2018-14716

CVE-2018-14716 PoC for CVE-2018-14716 Exploit Title: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection Date: 2018-07-20 Software Link: https://github.com/nystudio107/craft-seomatic Exploit Author: Sebastian Kriesten 0xB455 Contact: https://twitter.com/0xB455 CVE: CVE-2018-14716...

SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517

SPIP BigUp: неаутентифицированный RCE-эксплойт CVE-2024-8517 Описание Этот Python-скрипт эксплуатирует уязвимость неаутентифицированного удалённого выполнения кода RCE в плагине BigUp системы управления содержимым SPIP Système de Publication pour l'Internet Partagé. Проблема кроется в функции...

CVE-2022-37204

CVE-2022-37204 CVE-2022-37204 POC Suggested description RESERVED JFinal CMS 5.1.0 is vulnerable to SQL Injection. Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql7.md Vulnerability Type SQL Injection Vendor of Product the development group...

CVE-2019-6249_Hucart-cms

CVE-2019-6249Hucart cms I. Vulnerability Summary Vulnerability Name: CSRF vulnerability in Hucart cms v5.7.4 allows arbitrary addition of administrator accounts Disclosure Date: 2019-01-13 Discovered by: AllenChen [email protected] Product Homepage: http://www.hucart.com/ Software Link:...

CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content

Quick CMS Stored XSS v6.7 Author: Sergio Description: A Cross-Site Scripting XSS vulnerabilitie in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Content - Name in the Pages Menu. Attack Vectors: Scripting A vulnerability in the sanitization of...

spip-cve-2023-27372-rce

SPIP CVE-2023-27372 Unauthenticated RCE Exploit Web Shell Upload This Python script exploits CVE-2023-27372, an unauthenticated remote code execution vulnerability in SPIP CMS versions prior to 4.2.1. It leverages a cache poisoning flaw in the password reset mechanism to upload a web shell and...

CVE-2025-2304_POC

CVE-2025-2304POC CVE-2025-2304 POC - Camaleon CMS Privilege Escalation This POC is used to exploit Camaleon CMS privileges to administrator. The exploit works by injecting role into the password reset function of an authenticated user. Prerequisites & Assumptions You have a user account on the...

CVE-2023-33405

CVE-2023-33405 Open Redirection vulnerability identified on BlogEngine.NET CMS version 3.3.8.0 and earlier If a GET request to default.aspx page contains "years=" within the URL, the application calls a function named "Redirect". This function sets several parameters including year, month, date,...

CVE-2026-8347

CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...

CVE-2021-29440

CVE-2021-29440 Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10 Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this...

CVE-2022-44136-poc

CVE-2022-44136-poc Zenar CMS 9.3 suffers from an ​​unrestricted file upload vulnerability​​ in its file management module, allowing authenticated attackers with minimal privileges to upload arbitrary files, including malicious PHP scripts, to the web server. Due to insufficient file extension...

CVE-2025-61505

CVE-2025-61505 – PHP Object Injection in e107 CMS 2.x Reported: September 18, 2025 CVE Assigned: October 9, 2025 Published: February 02, 2026 CVE ID: CVE-2025-61505 Discoverer: Anas Abderrahman Benbarek Summary A PHP Object Injection vulnerability CWE-502: Deserialization of Untrusted Data was...

CVE-2018-16763

CVE-2018-16763 Fuel CMS 1.4.1 - Remote Code Execution - Python 3.x Original Script : Exploit-DB...

Pluck-Exploitation-by-skdevils

Pluck-Exploitation-by-skdevils Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution RCE Authenticated Date: 13.03.2022 Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 Tested on Ubuntu 20.04.3 LTS CVE: CVE-2022-26965...