Low Severity
CVE-2025-3248
Published: Jul 16, 2025
# Notice
This project is a backup of the wy876 vulnerability library. We carry on wy876's open-source spirit and continue to maintain this project here.
Disclaimer:
None of the content herein is directed at any vendor or individual. The user alone bears any direct or indirect consequences and losses arising from the dissemination or use of the techniques or tools published herein.
# Vulnerability collection
Collected and organized vulnerability EXP/POC, most of them sourced from the internet.
# 2025-06-11
- [Jinher OA C6 system ActionDataSet interface XXE vulnerability](./wpoc/Jinher-OA/Jinher-OA-C6-ActionDataSet-XXE.md)
- [Lingdang CRM Playforrecord interface arbitrary file read](./wpoc/Lingdang-CRM/Lingdang-CRM-Playforrecord-file-read.md)
- [Yuanchuang Xianfeng admin console admin_list unauthorized access](./wpoc/Yuanchuang-Xianfeng/admin_list-unauth-access.md)
- [Gift-card / e-voucher collection system parent_id unauthenticated SQL injection](./wpoc/GiftCard-System/parent_id-sqli.md)
- [NetMizer log management system terminals interface SQL injection](./wpoc/NetMizer/terminals-sqli.md)
- [Shufu CRM file_download interface arbitrary file read](./wpoc/Shufu-CRM/file_download-file-read.md)
- [Yinda Huizhi smart integrated management platform PPlugList interface SQL injection](./wpoc/Yinda-Huizhi/PPlugList-sqli.md)
- [WordPress Madara local file inclusion (CVE-2025-4524)](./wpoc/WordPress/Madara-LFI-CVE-2025-4524.md)
- [Pichome index interface arbitrary file read (CVE-2025-1743)](./wpoc/Pichome/index-file-read-CVE-2025-1743.md)
- [PagerMaid-Pyro admin console run_sh interface unauthenticated command execution](./wpoc/PagerMaid-Pyro/run_sh-unauth-rce.md)
- [Grafana unauthenticated SSRF (CVE-2025-4123)](./wpoc/Grafana/unauth-SSRF-CVE-2025-4123.md)
- [unibox router postprosa interface SQL injection](./wpoc/unibox-router/postprosa-sqli.md)
- [Salia PLCC cPH2 remote command execution](./wpoc/Salia/PLCC-cPH2-rce.md)
- [Supermap iServer arbitrary file read](./wpoc/Supermap-iServer/file-read.md)
# 2025-04-28
- [Langflow framework remote command execution (CVE-2025-3248)](./wpoc/Langflow/rce-CVE-2025-3248.md)
- [FOXCMS (Qianhu) content management system remote code execution (CVE-2025-29306)](./wpoc/FOXCMS/rce-CVE-2025-29306.md)
# 2025-04-21 newly added
- [GNU Mailman directory traversal (CVE-2025-43919)](./wpoc/GNU-Mailman/dir-traversal-CVE-2025-43919.md)
- [Erlang-OTP SSH server remote code execution](./wpoc/Erlang-OTP/ssh-rce.md)
- [WordPress SureTriggers plugin authentication bypass (CVE-2025-3102)](./wpoc/WordPress/SureTriggers-auth-bypass-CVE-2025-3102.md)
- [Renwoxing Collaboration CR...