Akaunting 3.1.8 – Server-Side Template Injection (SSTI)
# Exploit Title: Akaunting 3.1.8 - Server-Side Template Injection (SSTI)
Exploits
Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
- 类型
- 漏洞条目
- 总量
- 24,950
- 页码
- 12
FreePBX 16 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: FreePBX 16 - Remote Code Execution (RCE) (Authenticated)
BWL Advanced FAQ Manager 2.0.3 – Authenticated SQL Injection
Exploit Title: BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection
iMLog < 1.307 - Persistent Cross Site Scripting (XSS)
# Exploit Title: iMLog < 1.307 - Persistent Cross Site Scripting (XSS)
ElkArte Forum 1.1.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title : ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated)
changedetection < 0.45.20 - Remote Code Execution (RCE)
# Exploit Title: changedetection
Aquatronica Control System 5.1.6 – Information Disclosure
#!/usr/bin/env python
Check Point Security Gateway – Information Disclosure (Unauthenticated)
# Exploit Title: Check Point Security Gateway - Information Disclosure (Unauthenticated)
Rocket LMS 1.9 – Persistent Cross Site Scripting (XSS)
# Title: Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS)
WordPress Theme XStore 9.3.8 – SQLi
# Exploit Title: Wordpress Theme XStore 9.3.8 - SQLi
Apache OFBiz 18.12.12 – Directory Traversal
# Exploit Title: Apache OFBiz 18.12.12 - Directory Traversal
Backdrop CMS 1.27.1 – Authenticated Remote Command Execution (RCE)
# Exploit Title: Backdrop CMS 1.27.1 - Authenticated Remote Command Execution (RCE)
PopojiCMS 2.0.1 – Remote Command Execution (RCE)
# Exploit Title: PopojiCMS 2.0.1 - Remote Command Execution
htmlLawed 1.2.5 – Remote Code Execution (RCE)
# Exploit Title: htmlLawed 1.2.5 - Remote Code Execution (RCE)
Apache mod_proxy_cluster – Stored XSS
import requests
Plantronics Hub 3.25.1 – Arbitrary File Read
# Exploit Title: Plantronics Hub 3.25.1 – Arbitrary File Read
CrushFTP < 11.1.0 - Directory Traversal
## Exploit Title: CrushFTP Directory Traversal
Chyrp 2.5.2 – Stored Cross-Site Scripting (XSS)
# Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS)
Leafpub 1.1.9 – Stored Cross-Site Scripting (XSS)
# Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)
CE Phoenix Version 1.0.8.20 – Stored XSS
# Exploit Title: CE Phoenix Version 1.0.8.20 - Stored XSS
PyroCMS v3.0.1 – Stored XSS
# Exploit Title: PyroCMS v3.0.1 - Stored XSS
Prison Management System – SQL Injection Authentication Bypass
# Exploit : Prison Management System Using PHP -SQL Injection Authentication Bypass
Clinic Queuing System 1.0 – RCE
# Exploit Title: Clinic Queuing System 1.0 RCE
iboss Secure Web Gateway – Stored Cross-Site Scripting (XSS)
# Exploit Title: iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS)
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 – Authentication Bypass
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 Authentication Bypass
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 – Device Config Disclosure
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 Device Config
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 – Authentication Bypass
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Authentication Bypass
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 – Device Config Disclosure
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Device Config
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link – Authentication Bypass
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link – Device Config Disclosure
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Device Config
Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation
# Exploit Title: Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation
FlatPress v1.3 – Remote Command Execution
# Exploit Title: FlatPress v1.3 - Remote Command Execution
WordPress Plugin Background Image Cropper v1.2 – Remote Code Execution
# Exploit Title: Wordpress Plugin Background Image Cropper v1.2 - Remote Code Execution
SofaWiki 3.9.2 – Remote Command Execution (RCE) (Authenticated)
# Exploit Title: SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated)
Laravel Framework 11 – Credential Leakage
# Exploit Title: Laravel Framework 11 - Credential Leakage
Flowise 1.6.5 – Authentication Bypass
# Exploit Title: Flowise 1.6.5 - Authentication Bypass
djangorestframework-simplejwt 5.3.1 – Information Disclosure
# Exploit Title: djangorestframework-simplejwt 5.3.1 - Information Disclosure
Jenkins 2.441 – Local File Inclusion
# Exploit Title: Jenkins 2.441 - Local File Inclusion
OpenClinic GA 5.247.01 – Information Disclosure
# Exploit Title: OpenClinic GA 5.247.01 - Information Disclosure
OpenClinic GA 5.247.01 – Path Traversal (Authenticated)
# Exploit Title: OpenClinic GA 5.247.01 - Path Traversal (Authenticated)
Savsoft Quiz v6.0 Enterprise – Stored XSS
# Exploit Title: Savsoft Quiz v6.0 Enterprise - Persistent Cross-Site
Online Fire Reporting System OFRS – SQL Injection Authentication Bypass
# Exploit Title: Online Fire Reporting System SQL Injection Authentication Bypass
Stock Management System v1.0 – Unauthenticated SQL Injection
# Exploit Title: Stock Management System v1.0 - Unauthenticated SQL Injection
BMC Compuware iStrobe Web – 20.13 – Pre-auth RCE
#!/usr/bin/env python3
GUnet OpenEclass E-learning platform 3.15 – ‘certbadge.php’ Unrestricted File Upload
# Exploit Title: GUnet OpenEclass E-learning platform 3.15 - 'certbadge.php' Unrestricted File Upload
MinIO < 2024-01-31T20-20-33Z - Privilege Escalation
# Exploit Title: MinIO < 2024-01-31T20-20-33Z - Privilege Escalation
Terratec dmx_6fire USB – Unquoted Service Path
# Exploit Title: Terratec dmx_6fire USB - Unquoted Service Path
Ray OS v2.6.3 – Command Injection RCE(Unauthorized)
# Exploit Title: Ray OS v2.6.3 - Command Injection RCE(Unauthorized)
HTMLy Version v2.9.6 – Stored XSS
# Exploit Title: HTMLy Version v2.9.6 - Stored XSS
WordPress Plugin Playlist for Youtube 1.32 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Wordpress Plugin Playlist for Youtube - Stored Cross-Site Scripting (XSS)