PopojiCMS Version 2.0.1 – Remote Command Execution
# Exploit Title: PopojiCMS Version : 2.0.1 Remote Command Execution
Exploits
Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
- 类型
- 漏洞条目
- 总量
- 24,950
- 页码
- 13
PrusaSlicer 2.6.1 – Arbitrary code execution
# Exploit Title: PrusaSlicer 2.6.1 - Arbitrary code execution on g-code export
Moodle 3.10.1 – Authenticated Blind Time-Based SQL Injection – “sort” parameter
# Exploit Title: Moodle Authenticated Time-Based Blind SQL Injection - "sort" Parameter
WBCE 1.6.0 – Unauthenticated SQL injection
# Exploit Title: |Unauthenticated SQL injection in WBCE 1.6.0
WBCE CMS Version 1.6.1 – Remote Command Execution (Authenticated)
# Exploit Title: WBCE CMS Version : 1.6.1 Remote Command Execution
WordPress Plugin WP Video Playlist 1.1.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Wordpress Plugin WP Video Playlist 1.1.1 - Stored Cross-Site Scripting (XSS)
AnyDesk 7.0.15 – Unquoted Service Path
# Exploit Title: AnyDesk 7.0.15 - Unquoted Service Path
WordPress Theme Travelscape v1.0.3 – Arbitrary File Upload
# Exploit Title: Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload
Positron Broadcast Signal Processor TRA7005 v1.20 – Authentication Bypass
# Exploit Title: Positron Broadcast Signal Processor TRA7005 v1.20 - Authentication Bypass
Human Resource Management System v1.0 – Multiple SQLi
## Title: Human Resource Management System v1.0 - Multiple SQLi
Best Student Result Management System v1.0 – Multiple SQLi
## Title: Best Student Result Management System v1.0 - Multiple SQLi
Daily Expense Manager 1.0 – ‘term’ SQLi
# Exploit Title: Daily Expense Manager 1.0 - 'term' SQLi
Open Source Medicine Ordering System v1.0 – SQLi
# Exploit Title : Open Source Medicine Ordering System v1.0 - SQLi
ESET NOD32 Antivirus 17.0.16.0 – Unquoted Service Path
# Exploit Title: ESET NOD32 Antivirus 17.0.16.0 - Unquoted Service Path
Computer Laboratory Management System v1.0 – Multiple-SQLi
# Title: Computer Laboratory Management System v1.0 - Multiple-SQLi
WordPress Plugin Alemha Watermarker 1.3.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Wordpress Plugin Alemha Watermarker 1.3.1 - Stored Cross-Site Scripting (XSS)
Simple Backup Plugin Python Exploit 2.7.10 – Path Traversal
# Exploit Title: Simple Backup Plugin < 2.7.10 - Arbitrary File Download via Path Traversal
Online Hotel Booking In PHP 1.0 – Blind SQL Injection (Unauthenticated)
# Exploit Title: Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated)
ASUS Control Center Express 01.06.15 – Unquoted Service Path
# Exploit Title: ASUS Control Center Express 01.06.15 - Unquoted Service Path
OpenCart Core 4.0.2.3 – ‘search’ SQLi
# Exploit Title: OpenCart Core 4.0.2.3 - 'search' SQLi
Rapid7 nexpose – ‘nexposeconsole’ Unquoted Service Path
# Exploit Title: Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
GL-iNet MT6000 4.5.5 – Arbitrary File Download
# Exploit Title: GL-iNet MT6000 4.5.5 - Arbitrary File Download
Petrol Pump Management Software v1.0 – Remote Code Execution (RCE)
# Exploit Title: Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
E-INSUARANCE v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS)
Hospital Management System v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)
Microsoft Windows 10.0.17763.5458 – Kernel Privilege Escalation
#############################################
FoF Pretty Mail 1.1.2 – Local File Inclusion (LFI)
Exploit Title: FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)
FoF Pretty Mail 1.1.2 – Server Side Template Injection (SSTI)
Exploit Title: FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)
LeptonCMS 7.0.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated)
Employee Management System 1.0 – `txtfullname` and `txtphone` SQL Injection
# Exploit Title: Employee Management System 1.0 - `txtfullname` and `txtphone` SQL Injection
Employee Management System 1.0 – `txtusername` and `txtpassword` SQL Injection (Admin Login)
# Exploit Title: Employee Management System 1.0 - `txtusername` and `txtpassword` SQL Injection (Admin Login)
Daily Habit Tracker 1.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)
Daily Habit Tracker 1.0 – SQL Injection
# Exploit Title: Daily Habit Tracker 1.0 - SQL Injection
Daily Habit Tracker 1.0 – Broken Access Control
# Exploit Title: Daily Habit Tracker 1.0 - Broken Access Control
Blood Bank v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Blood Bank v1.0 Stored Cross Site Scripting (XSS)
Elementor Website Builder < 3.12.2 - Admin+ SQLi
#EXPLOIT Elementor Website Builder < 3.12.2 - Admin+ SQLi
CE Phoenix v1.0.8.20 – Remote Code Execution
## Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution (RCE) (Authenticated)
Smart School 6.4.1 – SQL Injection
# Exploit Title: Smart School 6.4.1 - SQL Injection
WordPress Plugin – Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)
# Exploit Title: Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthentic...
Microsoft Windows Defender – Detection Mitigation Bypass TrojanWin32Powessere.G
[+] Credits: John Page (aka hyp3rlinx)
Casdoor < v1.331.0 - '/api/set-password' CSRF
# Exploit Title: Casdoor < v1.331.0 - '/api/set-password' CSRF
Gibbon LMS v26.0.00 – SSTI vulnerability
# Exploit Title: Gibbon LMS v26.0.00 - SSTI vulnerability
Axigen < 10.5.7 - Persistent Cross-Site Scripting
# Exploit Title: Axigen < 10.5.7 - Persistent Cross-Site Scripting
Asterisk AMI – Partial File Content & Path Disclosure (Authenticated)
# Exploit Title: Asterisk AMI - Partial File Content & Path Disclosure (Authenticated)
Workout Journal App 1.0 – Stored XSS
# Exploit Title: Workout Journal App 1.0 - Stored XSS
Purei CMS 1.0 – SQL Injection
# Exploit Title: Purei CMS 1.0 - SQL Injection
Broken Access Control – on NodeBB v3.6.7
Exploit Title: Broken Access Control - on NodeBB v3.6.7
RouterOS 6.40.5 – 6.44 and 6.48.1 – 6.49.10 – Denial of Service
# Exploit Title: CVE-2024-27686: RouterOS-SMB-DOS
Siklu MultiHaul TG series < 2.0.0 - unauthenticated credential disclosure
# Exploit Title: Siklu MultiHaul TG series - unauthenticated credential disclosure
Dell Security Management Server <1.9.0 - Local Privilege Escalation
# Exploit Title: [title] Dell Security Management Server versions prior to