References https://github.com/ibaiw/2023Hvv/blob/main/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BA%20WEB%20%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20EXCU_SHELL%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2.md https://www.ddpoc.com/poc/DVB-2023-4904.html https://blog.csdn.net/qq_33608000/article/details/136713035 https://bdziyi.com/66423/ https://download.csdn.net/blog/column/10895103/132852679 https://www.youtube.com/watch?v=Cxxb8q7AZCY https://github.com/hanc00l/some_nuclei_templates/blob/main/ruijie-switch-configuration-leak.yaml https://blog.csdn.net/qq_35938621/article/details/124078706 https://www.cnblogs.com/dxmao/articles/17674294.html https://www.duoweizhe.com/dwz_ldfx/66.html
Related VulnerabilitiesPoCafterlogic-path-disclosure: AfterLogic Aurora and WebMail Pro < 7.7.9 - Full Path DisclosurePoCCVE-2026-64638: WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)PoCweaver-getemdslist-disclosure: Weaver E-cology getEmDsList Sensitive Information DisclosurePoCdlink-dsl2600u-rom0-disclosure: D-Link DSL2600U - Unauthenticated rom-0 Configuration DisclosurePoCmagento-polyshell-rce: Magento PolyShell – Unauthenticated File Upload to RCEWindows Shell Link 敏感信息泄露与欺骗漏洞(CVE-2026-25185)PoCsweetrice-backup-disclosure: SweetRice CMS 1.5.1 - Backup DisclosurePoCsap-abapreadsyslog-disclosure: SAPControl ABAPReadSyslog - DisclosurePoCsap-getenvironment-disclosure: SAPControl GetEnvironment - DisclosurePoCsap-getinstanceproperties-disclosure: SAPControl Webmethods - DisclosurePoCsap-listconfigfiles-disclosure: SAPControl ListConfigFiles - DisclosurePoCsap-listlogfiles-disclosure: SAPControl ListLogFiles - DisclosurePoCsap-readconfig-disclosure: SAPControl Read DEFAULT.PFL - Disclosure