PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

!/usr/bin/env python3 """PHP2Shell RCE chain for PHP 8.5.11 apache/modphp. Usage: python3 exploit.py --host TARGET --rce 'id/var/www/html/proof.txt' Purpose and vulnerability mechanisms ==================================== This is a pure-HTTP, application-independent research exploit for an...

South River Technologies Titan MFT Server 26.0.0 - code execution

Title: South River Technologies Titan MFT Server 26.0.0 - code execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Windows CVE: pending Description: South River Technologies Titan MFT Server 26.0.0.364, the NextGen generation of the commercial...

Automotive Shop Management System 1.0 - SQLi

Titles: Automotive Shop Management System 1.0 - SQLi Author: nu11secur1ty Date: 10/19/26 Vendor: https://github.com/oretnom23 Software: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Automotive-Shop-Management-System-1.0 Reference: https://portswigger.net/web-security/sql-injecti...

Keycloak 26.7.2 - Unauthenticated Account Takeover

Exploit Title: Keycloak 26.7.2 - Unauthenticated Account Takeover Date: 2026-10-15 Exploit Author: Abel Maldonado | Orevim Vendor Homepage: https://www.keycloak.org/ Software Link: https://github.com/keycloak/keycloak/releases/tag/26.6.2 Version: 26.0.0 - 26.4.14, 26.5.0 - 26.6.5, 26.7.0 - 26.7.1...

Open eClass 3.15 - RCE

Exploit Title: Open eClass 3.15 - RCE Date: Mar 15, 2024 Exploit Author: Georgios Roumeliotis Vendor Homepage: https://www.openeclass.org/ Software Link: https://download.openeclass.org/files/3.15/ Version: 3.15 2024 Tested on: Multiple Platforms CVE : CVE-2024-26503 Github :...

Edimax BR-6478AC firmware v2.20 - authenticated command injection

Title: Edimax BR-6478AC firmware v2.20 - authenticated command injection Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Hardware CVE: pending Description: Edimax BR-6478AC firmware image BR6478ACv2.20.bin, the closed-source dual-band AC1750 SOHO...

Synametrics Syncrify 6.2 - command execution

Title: Synametrics Syncrify 6.2 - command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Synametrics Syncrify 6.2 build 1178, the closed-source incremental backup and file-replication server from Synametrics...

pizzafy-1.0 - SQLi

Title: pizzafy-1.0 - SQLi Author: nu11secur1ty Date: 10/12/2026 Vendor: https://github.com/clararod9 Software: https://www.sourcecodester.com/download-code?nid=18708&title=Pizzafy+Ecommerce+System+using+PHP+and+MySQL Reference: Description: SQLi The email parameter appears to be vulnerable to SQL...

Exasol Database 7.1.30 - command execution

Title: Exasol Database 7.1.30 - command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux Advisory: https://0day-rubbish.com/blog/exasol-database-default-credential-python-udf-os-popen-rce CVE: pending Description: Exasol Database 7.1.3...

Parasoft Continuous Testing Platform 10.7.5 - JSP command execution

Title: Parasoft Continuous Testing Platform 10.7.5- JSP command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Parasoft Continuous Testing Platform CTP from Parasoft United States, a closed-source commercial...

ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root

Title: ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Hardware Advisory: https://0day-rubbish.com/blog/prosoft-rlx-ifh24e-unsigned-upgrade-package-root-rce CVE: pending...

Ecava_ntegraXor IGX_16.0.701.10 - RCE

Title: Ecava IntegraXor IGX 16.0.701.10 - RCE Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Windows =============================================================================== Target product: Ecava IntegraXor IGX vendor: Ecava Sdn Bhd, Malaysia...

Food-Ordering 1.0 - LFI

Title: Food-Ordering 1.0 - LFI Author: nu11secur1ty Date: 9/23/2026 Vendor: https://kato-james.42web.io/?i=2 Software: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba Reference: https://portswigger.net/web-security/file-upload Description: A...

InvoicePlane 1.7.1 - RCE

Exploit Title: InvoicePlane 1.7.1 - RCE Date: 2026-04-10 Exploit Author: Mustafa Murat Akgül Vendor Homepage: https://invoiceplane.com/ Software Link: https://github.com/InvoicePlane/InvoicePlane Version: 1.7.1 Patched: 1.7.2 CVE: CVE-2026-40297 Advisory: GHSA-ffq5-mw9f-mv6j Tested on: Linux/Ubun...

Krayin CRM 2.2.4 - IDOR

Exploit Title: Krayin CRM 2.2.4 - IDOR Google Dork: inurl:"/admin/login" "Krayin" Date: 27/09/2026 Exploit Author: bl4dsc4n Vendor Homepage: https://github.com/krayin/laravel-crm Software Link: https://github.com/krayin/laravel-crm/archive/refs/tags/v2.2.4.zip Version: ≤ 2.2.4 Tested on: docker +...

Teltonika_RutOS 00.07.06.21 - command injection

Title: TeltonikaRutOS 00.07.06.21 - command injection Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Hardware """ Teltonika RutOS -- ipsec.lua instancesstatus logread command injection PoC...

POMS oretnom23v1.0 - SQLi vulnerabilities

Title: POMS oretnom23v1.0 - SQLi vulnerabilities Author: nu11secur1ty Date: 10/01/2026 Vendor: https://github.com/oretnom23 Software: https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html Reference:...

TigerGraph_Community_Edition 4.2.4 - arbitrary file write

Title: TigerGraphCommunityEdition 4.2.4 - arbitrary file write Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux TigerGraph Community Edition 4.2.4 -- default credentials + arbitrary file write - SSH RCE Vulnerability summary: TigerGraph Communit...

SuiteCRM 8.10.1 - Authenticated SSRF

Exploit Title: SuiteCRM 8.10.1 - Authenticated SSRF Exploit Author: Max Gabriel https://github.com/EntroVyx Vendor Homepage: https://suitecrm.com/ Software Link: https://github.com/SuiteCRM/SuiteCRM Version: str: """Validate and normalize the SuiteCRM base URL.""" parsed = urlparsevalue if...

WordPress 7.0.2 - Path Travesal

Exploit Title: WordPress 7.0.2 - Path Travesal Google Dork: N/A Date: 2026-09-22 Exploit Author: Robert Ressl https://ressl.ch Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/download/releases/ Version: WordPress 7.0.2 patched in 7.1.2 and 7.0.6; backports to every =...

MikroTrick_ 7.24_ 7.24.2_ 7.0.0_ 7.23.4_ 6.0.0_ 6.49.21 - RCE

!/usr/bin/env python3 Exploit Title: MikroTik RouterOS = 7.23.3 - Unauthenticated SSH Session Policy-Mask Swap Full Admin Date: 2026-09-17 Exploit Author: DigiProSec Vendor Homepage: https://mikrotik.com Software Link: https://mikrotik.com/download Version: RouterOS 6.49.21, 7.0 7.23.4, 7.24.0...

CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE

!/usr/bin/env python3 Exploit Title: ILIAS save$this-filename - fileputcontents$filename, jsonencode$cookies. Attacker-chosen path + JSON-embedded PHP = webshell. Tested: ILIAS 10.9 on Rocky Linux 9 Apache + PHP-FPM 8.2, MariaDB bac...

FreePBX 17.0.2 - Remote Code Execution (RCE)

Exploit Title: FreePBX 17.0.2 - Remote Code Execution Date: 2026-08-12 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.freepbx.org/ Software Link: https://github.com/FreePBX/freepbx Version: FreePBX 15.x 15.0.66, 16.x 16.0.89, 17.x 17.0.3 Tested on: Linux Debian/Ubuntu with...

Metabase 0.61.0 - Authenticated Remote Code Execution

Exploit Title: Metabase 0.61.0 - Authenticated Remote Code Execution Date: 2026-08-12 Exploit Author: Gutierre0x80 Vendor Homepage: https://www.metabase.com/ Software Link: https://github.com/metabase/metabase Version: = 0.58.0 = 0.59.0 = 0.60.0 = 0.61.0 Example: python3 exploit.py...

Marimo 0.20.4 - RCE

Title: Marimo 0.20.4 - RCE Date: August 2nd, 2026 Exploit Author: Jason Bernier Vendor Homepage: https://marimo.io/ Software Link: https://github.com/marimo-team/marimo Version: str: """Send command to target and receive output""" try: if not conn: print"- No active connection" return ""...

Ghost_CMS 6.19.0 - Remote Code Execution

Exploit Title: GhostCMS 6.19.0 - Remote Code Execution Date: 08/07/2026 Exploit Author: Maksim Rogov Vendor Homepage: https://ghost.org/ Software Link: https://ghost.org/ Version: = 0.7.2, 'Ghost CMS Remote Code Execution', 'Description' = %q This module exploits a Remote Code Execution RCE...

Langflow 1.10.0 - RCE

Exploit Title: Langflow 1.10.0 - RCE Exploit Author: Richard Howe Vendor Homepage: https://www.langflow.org/ Software Link: https://www.langflow.org/desktop Version: str: endpoint = '/api/v1/autologin' headers = 'Content-Type': 'application/json', try: resp = getbaseurl + endpoint except Exceptio...

PodcastGenerator 3.2.9 - Stored XSS

Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software Link: https://github.com/PodcastGenerator/PodcastGenerator Version: 3.2.9 Tested on: Windows 11 / XAMPP CVE : CVE-2025-7033...

Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting Date: 2026-08-11 Exploit Author: Ranjit Kumar Singh Vendor Homepage: https://www.bludit.com/ Software Link: https://github.com/bludit/bludit/archive/refs/tags/3.20.0.zip Version: 3.0.0 through 3.20.0 all versions before commit...

EVerest 2025.9.0 - DoS

Exploit Title: EVerest 2025.9.0 - DoS Date: 2026-08-11 Exploit Author: Ranjit Kumar Singh Vendor Homepage: https://github.com/EVerest/everest-core Software Link: https://github.com/EVerest/everest-core/archive/refs/tags/2025.9.0.tar.gz Version: everest-core 2025.10.0 Tested on: Ubuntu 22.04 /...

Fullhan FH8626V100 - Multiple Vulnerabilities

Exploit Title: Fullhan FH8626V100 - Multiple Vulnerabilities Date: 31-03-2026 Exploit Author: Amir Aliu Vendor Homepage: https://www.fullhan.com/ Software Link: N/A - OEM/whitelabel IP camera module, rebranded under numerous vendor/brand names Version: Firmware v201222.1007 Device Model AJL30PG08...

Bludit CMS - Stored XSS

Exploit Title: Bludit CMS - Stored XSS Date: 2026-07-30 Exploit Author: Saud Alenazi Vendor Homepage: https://www.bludit.com Software Link: https://github.com/bludit/bludit/releases/tag/3.22.0 Version: 3.22.0 Tested on: Windows 10 x64 Description: sanitizeSVG strips script/on but does not remove...

EasyAppointments 1.5.1 - Blind SQL Injection

Exploit Title: EasyAppointments 1.5.1 - Blind SQL Injection Google Dork: N/A backend login required Date: 07/27/2026 Exploit Author: Michael Chesang Vendor Homepage: https://easyappointments.org Software Link: https://github.com/alextselegidis/easyappointments/releases Version: = 1.5.1 REQUIRED...

miniOrange 5.4.3 - Unauthenticated Auth Bypass

Exploit Title: miniOrange 5.4.3 - Unauthenticated Auth Bypass Google Dork: inurl:/wp-content/plugins/miniorange-saml-20-single-sign-on/ Date: 2026-07-27 Exploit Author: zer0dayf Vendor Homepage: https://plugins.wordpress.org/miniorange-saml-20-single-sign-on/ Software Link:...

Grav CMS 2.0.7 - RCE

!/usr/bin/env python3 Exploit Title: Grav CMS 2.0.7 - Remote Code Execution Date: 2026-07-27 Exploit Author: zer0dayf Vendor Homepage: https://getgrav.org/ Software Link: https://github.com/getgrav/grav Version: Grav CMS 2.0.7 Tested on: Ubuntu 22.04 / PHP 8.2 CVE : CVE-2026-65008 """...

Payload CMS 3.72.0 - Blind SQL Injection

Exploit Title: Payload CMS 3.72.0 - Blind SQL Injection Google Dork: N/A Date: 2026-08-01 Exploit Author: cardosource Vendor Homepage: https://payloadcms.com/ Software Link: https://github.com/payloadcms/payload Version: requests.Response: url: str = "http://localhost:3000/api/posts"...

Wolf CMS 0.8.3.1 - RCE v

Exploit Title: Wolf CMS 0.8.3.1 - RCE Date: 02-08-2026 Exploit Author: Balachandar Gowrisankar Software Link: https://github.com/wolfcms/wolfcms Version: -u -p Example Usage: python exploit.py http://127.0.0.1:8080/ -u admin -p admin import requests import argparse from bs4 import BeautifulSoup...

CubeCart 6.7.4 - SQL injection

Exploit Title: CubeCart 6.7.4 - SQL injection Date: 2026-06-08 Exploit Author: Mikail Kocadağ Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE: CVE-2026-54647 Advisory / References:...

CubeCart 6.7.4 - Stored XSS

Exploit Title: CubeCart 6.7.4 - Stored Cross-Site Scripting Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE: CVE-2026-54645 Advisory / References:...

Langflow 1.8.4 - Path Traversal to Remote Code Execution

Exploit Title: Langflow 1.8.4 - Path Traversal to Remote Code Execution Google Dork: N/A Date: 2026-07-20 Exploit Author: cardosource Vendor Homepage: https://www.langflow.org/ Software Link: https://github.com/langflow-ai/langflow Version: Dictstr, Any: return "target": target.rstrip'/', "lhost"...

Linksys E1200_2.0.04 - Unauthenticated OS Command Injection

Exploit Title: Linksys E12002.0.04 - Unauthenticated OS Command Injection Date: 2026-07-22 Exploit Author: JarrettgxzSec Vendor Homepage: www.linksys.com Version: FW " printf"! Example: python3 sys.argv0 192.168.1.100 192.168.1.1 8080" sys.exit1 ATTACKERIP = sys.argv1 TARGETIP = sys.argv2...

C-MOR 6.0104 - Cross-Site Scripting (XSS)

Exploit Title: C-MOR 6.0104 - Cross-Site Scripting XSS Google Dork: N/A Date: 2026-07-23 Exploit Author: Samir Shamdin Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link: https://www.c-mor.com/ Version: = 6.0104 Tested on: C-MOR Video Surveillance V6.0104 CVE: CVE-2026-51133 1...

C-MOR 6.0104 - Directory Traversal

Exploit Title: C-MOR 6.0104 - Directory Traversal Google Dork: N/A Date: 2026-07-23 Exploit Author: Fadi Kaakahji Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link: https://www.c-mor.com/ Version: Aufnahmen Kamera 5../../../../../../../../../../../../../../../../etc/passwd,...

CubeCart 6.7.4 - Cross-Site Scripting

Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting Attribute Injection in gui.class.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE:...

CubeCart 6.7.4 - SQL

Exploit Title: CubeCart 6.7.4 - SQL Bypass in maintenance.index.inc.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE: CVE-2026-54646 Advisory / References...

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

!/usr/bin/env python3 """ CVE-2026-42167 — ProFTPD modsql post-authentication SQL injection - RCE postauthstorrce.py --host --port 21 \ --user --password \ --shell-host --shell-port 4444 SUMMARY ------- ProFTPD's modsql logs FTP activity through user-supplied SQL. Its escaping helper isescapedtex...

flyto-core 2.26.7 - Arbitrary File Write

Exploit Title: flyto-core 2.26.7 - Arbitrary File Write Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/flytohub/flyto-core Software Link: https://github.com/flytohub/flyto-core Version: flyto-core = 2.26.7 fixed 2.26.8; incomplete fix of GHSA-29...

Nodemailer 9.0.0 - File Read/ SSRF

Exploit Title: Nodemailer 9.0.0 - File Read/ SSRF Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/nodemailer/nodemailer Software Link: https://www.npmjs.com/package/nodemailer Version: nodemailer or href: message is read ANYWAY, because...

Linuxfabrik monitoring_plugins_6.0.0 - SSRF

Exploit Title: Linuxfabrik monitoringplugins6.0.0 - SSRF Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/Linuxfabrik/monitoring-plugins Software Link: https://github.com/Linuxfabrik/monitoring-plugins Version: Linuxfabrik monitoring-plugins = 6.0...

NanaZip 6.5 - DoS

Exploit Title: NanaZip 6.5 - DoS Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/M2Team/NanaZip Software Link: https://github.com/M2Team/NanaZip/releases Version: NanaZip 3 GiB. All superb...