Exploit-DB lists RCE in Ruflo MCP Bridge 3.16.2
The public entry labels version 3.16.2 remotely exploitable but gives no CVE, fix, or confirmed attacks.
Stories per day · 30 days
2 RSS
Relatedwebapps3command-execution2firmware2rce2account-takeover1command-injection1database1edimax1exasol1keycloak1mcp1open-eclass1php1php2shell1pizzafy1prosoft1remote-code-execution1rlx-ifh24e1
34 stories, newest first · one card per story
Stories tagged #exploit-db
Exploit-DB lists PHP2Shell RCE for PHP after v5.4
The listing covers remote code execution in PHP core versions after v5.4 as CVE-2026-109618.
ProSoft RLX-IFH24E v2.2.44 executes unsigned firmware upgrade as root
Exploit-DB published a remote exploit for that radio firmware version; no CVE or fix is named.
Exploit-DB lists an RCE exploit for Open eClass 3.15
The feed names Open eClass 3.15 only and does not describe access requirements or a patch.
Exasol Database 7.1.30 remote command-execution exploit published
Exploit-DB lists a remote command-execution exploit for version 7.1.30, with no CVE or fix named.
Keycloak 26.7.2 unauthenticated account takeover exploit published
Exploit-DB lists a web-app exploit that takes over accounts in Keycloak 26.7.2 without authentication.
Synametrics Syncrify 6.2 remote command execution exploit published
Exploit-DB lists a remote exploit for command execution against Syncrify 6.2; no CVE or patch is named.
Edimax BR-6478AC v2.20 exploit enables authenticated command injection
Exploit-DB published a remote exploit for firmware v2.20; no CVE, patch, or confirmed attacks are named.
pizzafy 1.0 web app has a published SQL injection exploit
Exploit-DB lists the issue under webapps; no CVE, patch, or confirmed attacks are stated.
[remote] Teltonika_RutOS 00.07.06.21 - command injection
Exploit-DB lists a remote command-injection exploit for Teltonika RutOS 00.07.06.21.
[webapps] SuiteCRM 8.10.1 - Authenticated SSRF
Exploit-DB lists an authenticated SSRF exploit against SuiteCRM 8.10.1.
[webapps] InvoicePlane 1.7.1 - RCE
Exploit-DB published a remote code execution exploit for InvoicePlane 1.7.1.
[webapps] TigerGraph_Community_Edition 4.2.4 - arbitrary file write
Exploit-DB lists an arbitrary file-write flaw in TigerGraph Community Edition 4.2.4.
[webapps] Food-Ordering 1.0 - LFI
Exploit-DB publishes a local file inclusion proof-of-concept for Food-Ordering 1.0.
[remote] Ecava_ntegraXor IGX_16.0.701.10 - RCE
Exploit-DB published a remote code execution exploit for Ecava IntegraXor IGX 16.0.701.10.
[webapps] Krayin CRM 2.2.4 - IDOR
Exploit-DB published an IDOR exploit for Krayin CRM 2.2.4.
[webapps] POMS oretnom23v1.0 - SQLi vulnerabilities
Exploit-DB published SQL injection exploits for POMS oretnom23 version 1.0.
[webapps] WordPress 7.0.2 - Path Travesal
Exploit-DB publishes a path traversal proof-of-concept against WordPress 7.0.2.
[remote] MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE
Exploit-DB lists remote RCE affecting MikroTrick 6.49.21, 7.24, 7.24.2 and other versions.
[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution
Exploit-DB published an authenticated remote code execution exploit targeting Metabase version 0.61.0.
[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)
Exploit-DB published a remote code execution exploit targeting FreePBX version 17.0.2.
[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting
A reflected cross-site scripting flaw in Bludit CMS 3.20.0 is documented with a public proof-of-concept exploit on Exploit-DB.
[webapps] PodcastGenerator 3.2.9 - Stored XSS
A stored cross-site scripting flaw in PodcastGenerator 3.2.9 is documented with a public proof-of-concept exploit on Exploit-DB.
[webapps] Bludit CMS - Stored XSS
A stored cross-site scripting (XSS) vulnerability in Bludit CMS was disclosed through a public proof-of-concept published on Exploit-DB.