Exploit catalog results

Showing 25 PoCs on this page

Metasploit

Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (time param)

Metasploit exploitAdded to Metasploit 2025-08-07
Not analyzedCVE-2025-341521 file

exploit_linux/http/aitemi_m300_time_rce · Ruby

Metasploit

ICTBroadcast Unauthenticated Remote Code Execution

Metasploit exploitAdded to Metasploit 2025-08-02
Not analyzedCVE-2025-26111 file

exploit_linux/http/ictbroadcast_unauth_cookie · Ruby

Metasploit

WordPress Photo Gallery Plugin SQL Injection (CVE-2022-0169)

Metasploit auxiliary PoCby Krzysztof Zając, plus 1 additional contributorAdded to Metasploit 2025-07-10
Not analyzedCVE-2022-01691 file

auxiliary_gather/wp_photo_gallery_sqli · Ruby

Metasploit

Wing FTP Server NULL-byte Authentication Bypass (CVE-2025-47812)

Metasploit exploitby Julien AhrensAdded to Metasploit 2025-07-01
Not analyzedCVE-2025-478121 file

exploit_multi/http/wingftp_null_byte_rce · Ruby

Metasploit

Xorcom CompletePBX Arbitrary File Read and Deletion via systemDataFileName

Metasploit auxiliary PoCAdded to Metasploit 2025-06-22
Not analyzedCVE-2025-300051 file

auxiliary_scanner/http/xorcom_completepbx_diagnostics_file_read · Ruby

Metasploit

Xorcom CompletePBX Authenticated Command Injection via Task Scheduler

Metasploit exploitAdded to Metasploit 2025-06-22
Not analyzedCVE-2025-300041 file

exploit_linux/http/xorcom_completepbx_scheduler · Ruby

Metasploit

Xorcom CompletePBX Authenticated File Disclosure via Backup Download

Metasploit auxiliary PoCAdded to Metasploit 2025-06-22
Not analyzedCVE-2025-22921 file

auxiliary_scanner/http/xorcom_completepbx_file_disclosure · Ruby

Metasploit

vBulletin replaceAdTemplate Remote Code Execution

Metasploit exploitby Egidio Romano (EgiX)Added to Metasploit 2025-05-23
Not analyzedCVE-2025-48827CVE-2025-488281 file

exploit_multi/http/vbulletin_replace_ad_template_rce · Ruby

Metasploit

Invision Community 5.0.6 customCss RCE

Metasploit exploitby Egidio Romano (EgiX)Added to Metasploit 2025-05-20
Not analyzedCVE-2025-479161 file

exploit_multi/http/invision_customcss_rce · Ruby

Metasploit

WordPress Depicter Plugin SQL Injection (CVE-2025-2011)

Metasploit auxiliary PoCby Muhamad VisatAdded to Metasploit 2025-05-19
Not analyzedCVE-2025-20111 file

auxiliary_gather/wp_depicter_sqli_cve_2025_2011 · Ruby

Metasploit

WP User Registration and Membership Unauthenticated Privilege Escalation (CVE-2025-2563)

Metasploit exploitby wesley (wcraft)Added to Metasploit 2025-05-13
Not analyzedCVE-2025-25631 file

exploit_multi/http/wp_user_registration_membership_escalation · Ruby

Metasploit

WordPress SureTriggers (aka OttoKit) Combined Auth Bypass (CVE-2025-3102, CVE-2025-27007)

Metasploit exploitby Denver Jackson, plus 2 additional contributorsAdded to Metasploit 2025-05-07
Not analyzedCVE-2025-27007CVE-2025-31021 file

exploit_multi/http/wp_suretriggers_auth_bypass · Ruby

Metasploit

Craft CMS Image Transform Preauth RCE (CVE-2025-32432)

Metasploit exploitby Nicolas Bourras (Orange Cyberdefense)Added to Metasploit 2025-04-26
Not analyzedCVE-2025-324321 file

exploit_linux/http/craftcms_preauth_rce_cve_2025_32432 · Ruby

Metasploit

Craft CMS Twig Template Injection RCE via FTP Templates Path

Metasploit exploitby AssetNote, plus 1 additional contributorAdded to Metasploit 2024-12-29
Not analyzedCVE-2024-561451 file

exploit_linux/http/craftcms_ftp_template · Ruby

Metasploit

WordPress WP Time Capsule Arbitrary File Upload to RCE

Metasploit exploitby Rein DaelmanAdded to Metasploit 2024-12-11
Not analyzedCVE-2024-88561 file

exploit_multi/http/wp_time_capsule_file_upload_rce · Ruby

Metasploit

WordPress Really Simple SSL Plugin Authentication Bypass to RCE

Metasploit exploitby István MártonAdded to Metasploit 2024-12-05
Not analyzedCVE-2024-109241 file

exploit_multi/http/wp_reallysimplessl_2fa_bypass_rce · Ruby

Metasploit

CyberPanel Multi CVE Pre-auth RCE

Metasploit exploitby DreyAnd, plus 1 additional contributorAdded to Metasploit 2024-10-31
Not analyzedCVE-2024-51378CVE-2024-51567CVE-2024-515681 file

exploit_unix/webapp/cyberpanel_preauth_rce_multi_cve · Ruby

Metasploit

WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529)

Metasploit auxiliary PoCby Achref Ben Thameur a.k.a achrefthameur, plus 1 additional contributorAdded to Metasploit 2024-10-14
Not analyzedCVE-2024-8522CVE-2024-85291 file

auxiliary_scanner/http/wp_learnpress_c_fields_sqli · Ruby

Metasploit

WordPress Ultimate Member SQL Injection (CVE-2024-1071)

Metasploit auxiliary PoCby Christiaan SwiersAdded to Metasploit 2024-10-14
Not analyzedCVE-2024-10711 file

auxiliary_scanner/http/wp_ultimate_member_sorting_sqli · Ruby

Metasploit

WordPress wp-automatic Plugin SQLi Admin Creation

Metasploit exploitby Rafie MuhammadAdded to Metasploit 2024-10-14
Not analyzedCVE-2024-279561 file

exploit_multi/http/wp_automatic_sqli_to_rce · Ruby

Metasploit

WordPress TI WooCommerce Wishlist SQL Injection (CVE-2024-43917)

Metasploit auxiliary PoCby Rafie MuhammadAdded to Metasploit 2024-10-14
Not analyzedCVE-2024-439171 file

auxiliary_scanner/http/wp_ti_woocommerce_wishlist_sqli · Ruby

Metasploit

WordPress WP Fastest Cache Unauthenticated SQLi (CVE-2023-6063)

Metasploit auxiliary PoCby Alex Sanford, plus 1 additional contributorAdded to Metasploit 2024-10-14
Not analyzedCVE-2023-60631 file

auxiliary_scanner/http/wp_fastest_cache_sqli · Ruby

Metasploit

BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257)

Metasploit exploitby chebuyaAdded to Metasploit 2024-09-21
Not analyzedCVE-2024-45256CVE-2024-452571 file

exploit_unix/webapp/byob_unauth_rce · Ruby

Metasploit

VICIdial Authenticated Remote Code Execution

Metasploit exploitby Jaggar Henry of KoreLogic, Inc.Added to Metasploit 2024-09-11
Not analyzedCVE-2024-85041 file

exploit_unix/webapp/vicidial_agent_authenticated_rce · Ruby

Metasploit

Vicidial SQL Injection Time-based Admin Credentials Enumeration

Metasploit auxiliary PoCby Jaggar Henry of KoreLogic, Inc.Added to Metasploit 2024-09-11
Not analyzedCVE-2024-85031 file

auxiliary_scanner/http/vicidial_sql_enum_users_pass · Ruby