50
45
45
45
45
45
45
[dos] EVerest 2025.9.0 - DoS
A public proof-of-concept denial-of-service exploit has been published for the EVerest 2025.9.0 open-source EV charging framework.
Exploit-DB lists a denial-of-service proof of concept targeting EVerest version 2025.9.0. EVerest is an open-source software framework used for EV charging infrastructure. No in-the-wild exploitation or CVE mapping is stated in the listing.
20
[webapps] Bludit CMS - Stored XSS
A stored cross-site scripting (XSS) vulnerability in Bludit CMS was disclosed through a public proof-of-concept published on Exploit-DB.
Exploit-DB published a webapps entry for a stored XSS flaw in Bludit CMS, an open-source flat-file content management system. Stored XSS allows an attacker to persist malicious scripts that execute in other users' browsers, potentially enabling session theft or unauthorized actions. The listing did not include a CVE identifier or affected version range.
25
[webapps] Wolf CMS 0.8.3.1 - RCE v
A proof-of-concept exploit for remote code execution in Wolf CMS 0.8.3.1 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a remote code execution vulnerability in Wolf CMS 0.8.3.1. The listing is categorized under web applications. No exploitation in the wild or CVE identifier is stated in the listing.
15
[webapps] EasyAppointments 1.5.1 - Blind SQL Injection
A proof-of-concept exploit for a blind SQL injection vulnerability in EasyAppointments 1.5.1 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a blind SQL injection flaw in EasyAppointments 1.5.1. The listing falls under the webapps category and enables reproduction of the injection. No in-the-wild exploitation or CVE identifier is stated in the listing.
20
[webapps] Payload CMS 3.72.0 - Blind SQL Injection
A proof-of-concept exploit for a blind SQL injection vulnerability in Payload CMS 3.72.0 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a blind SQL injection flaw in Payload CMS 3.72.0. The listing falls under the webapps category and allows reproduction of the injection. No in-the-wild exploitation or CVE identifier is stated in the listing.
25
[webapps] miniOrange 5.4.3 - Unauthenticated Auth Bypass
A proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3. The flaw allows attackers to bypass authentication without credentials. No in-the-wild exploitation or CVE identifier is stated in the listing.
30
[webapps] Grav CMS 2.0.7 - RCE
A proof-of-concept exploit for remote code execution in Grav CMS 2.0.7 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a remote code execution vulnerability in Grav CMS 2.0.7. The listing is for web applications and provides code defenders can use to reproduce the issue. No exploitation in the wild or CVE assignment is stated in the listing.
30
[webapps] CubeCart 6.7.4 - SQL
A proof-of-concept SQL injection exploit targeting CubeCart 6.7.4 was published on Exploit-DB.
Exploit-DB carries a proof-of-concept exploit for a SQL injection vulnerability in CubeCart 6.7.4, an open-source e-commerce platform. The listing demonstrates the injection issue but the provided text includes no CVE identifier or evidence of active exploitation. SQL injection in the storefront could expose or modify store data.
12
[webapps] C-MOR 6.0104 - Directory Traversal
A directory traversal proof-of-concept for video surveillance software C-MOR version 6.0104 has been published on Exploit-DB.
Exploit-DB entry 52666 discloses a directory traversal vulnerability in C-MOR version 6.0104, a video surveillance platform. The issue is listed under web application vulnerabilities. No CVE identifier or exploitation evidence is included in the listing.
35
[webapps] CubeCart 6.7.4 - Stored XSS
A proof-of-concept stored cross-site scripting exploit targeting CubeCart 6.7.4 was published on Exploit-DB.
Exploit-DB lists a proof-of-concept exploit for a stored cross-site scripting (XSS) vulnerability in CubeCart 6.7.4, a PHP-based e-commerce web application. The listing demonstrates injection of attacker-controlled script that persists in the application, but no exploitation in the wild or CVE assignment is reported in the provided text.
12
[webapps] CubeCart 6.7.4 - SQL injection
A second proof-of-concept SQL injection exploit for CubeCart 6.7.4 was published on Exploit-DB.
Exploit-DB lists a SQL injection proof-of-concept affecting CubeCart 6.7.4, the open-source shopping cart application. The entry demonstrates the flaw but the provided text does not include a CVE identifier or reports of exploitation in the wild. It appears alongside related CubeCart XSS and SQL injection listings published the same day.
12
[webapps] CubeCart 6.7.4 - Cross-Site Scripting
A cross-site scripting exploit targeting CubeCart 6.7.4 web applications was published on Exploit-DB as entry 52661.
Exploit-DB listing 52661 discloses a cross-site scripting vulnerability in CubeCart version 6.7.4, classified under webapps. The listing makes a public exploit available, but no CVE id, exploitation evidence, or vendor patch status is provided in the item text.
20
[remote] PCMan 2.0.7 - Buffer Overflow
A remote buffer overflow in PCMan 2.0.7 has a public proof-of-concept exploit published on Exploit-DB.
Exploit-DB listing 52657 discloses a remote buffer overflow vulnerability in PCMan version 2.0.7. A proof-of-concept exploit is publicly available, allowing attackers to potentially crash or compromise affected instances. The listing includes no CVE identifier and reports no observed exploitation in the wild.
22
[dos] NanaZip 6.5 - DoS
A denial-of-service proof-of-concept targeting NanaZip 6.5 has been published on Exploit-DB.
Exploit-DB entry 52656 contains a public proof-of-concept that triggers a denial-of-service condition in NanaZip 6.5. The listing is limited to the vulnerability title and does not include CVE identifiers or details on exploitation conditions. No evidence of in-the-wild exploitation is provided.
10
[remote] phpSysInfo 3.4.5 - IP Allowlist Bypass
A published exploit demonstrates an IP allowlist bypass in phpSysInfo 3.4.5, weakening access restrictions.
Exploit-DB published exploit #52648 for phpSysInfo 3.4.5, a system monitoring web tool. The exploit shows the IP allowlist restriction can be bypassed. No exploitation in the wild is reported in the disclosure text.
15
[webapps] webpack_devserver 5.2.5 - CSRF
Exploit-DB published a cross-site request forgery proof of concept for webpack_devserver 5.2.5.
Exploit-DB lists a webapps CSRF proof-of-concept against webpack_devserver version 5.2.5. The flaw affects the local webpack development server, where cross-site requests could be issued against it. No CVE id is cited in the entry and no active exploitation is reported.
20
[dos] NanaZip 6.5 - DoS
A denial-of-service proof of concept for NanaZip 6.5 was published on Exploit-DB.
Exploit-DB carries a denial-of-service proof-of-concept targeting NanaZip version 6.5. NanaZip is an open-source file archiver packaged for Windows. The entry cites no CVE id and no evidence of active exploitation.
15
[webapps] flyto_core 2.26.7 - Server-Side Request Forgery
Exploit-DB published a server-side request forgery proof of concept for flyto_core 2.26.7.
Exploit-DB lists a proof-of-concept for server-side request forgery affecting flyto_core version 2.26.7. SSRF flaws can allow attackers to make arbitrary requests from the server toward internal resources. No CVE id is cited and no in-the-wild exploitation is reported.
15
45
50
45
45
45
45
45
45
45
45
45
45
45
45
45