WinRAR version 6.22 – Remote Code Execution via ZIP archive
################################################################################################
Exploits
Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
- 类型
- 漏洞条目
- 总量
- 24,950
- 页码
- 14
liveSite Version 2019.1 – Remote Code Execution
## Exploit Title: liveSite Version : 2019.1 Campaigns Remote Code Execution
Craft CMS 4.4.14 – Unauthenticated Remote Code Execution
#!/usr/bin/env python3
SPA-CART CMS – Stored XSS
# Exploit Title: SPA-CART CMS - Stored XSS
Insurance Management System PHP and MySQL 1.0 – Multiple Stored XSS
# Exploit Title:Insurance Management System PHP and MySQL 1.0 - Multiple
MobileShop master v1.0 – SQL Injection Vuln.
+ Exploit Title: MobileShop master v1.0 - SQL Injection Vuln.
Tourism Management System v2.0 – Arbitrary File Upload
# Exploit Title: Tourism Management System v2.0 - Arbitrary File Upload
Wallos < 1.11.2 - File Upload RCE
# Exploit Title: Wallos - File Upload RCE (Authenticated)
Nagios XI Version 2024R1.01 – SQL Injection
# Exploit Title: NAGIOS XI SQLI
LimeSurvey Community 5.3.32 – Stored XSS
# Exploit Title: Stored Cross-Site Scripting (XSS) in LimeSurvey Community
minaliC 2.0.0 – Denied of Service
#!/usr/bin/perl
Employee Management System 1.0 – ‘admin_id’ SQLi
# Exploit Title: Employee Management System 1.0 - 'admin_id' SQLi
Blood Bank 1.0 – ‘bid’ SQLi
# Exploit Title: Blood Bank 1.0 - 'bid' SQLi
Simple Task List 1.0 – ‘status’ SQLi
# Exploit Title: Simple Task List 1.0 - 'status' SQLi
Teacher Subject Allocation Management System 1.0 – ‘searchdata’ SQLi
# Exploit Title: Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
HNAS SMU 14.8.7825 – Information Disclosure
# Exploit Title: Hitachi NAS (HNAS) System Management Unit (SMU) 14.8.7825 - Information Disclosure
CSZCMS v1.3.0 – SQL Injection (Authenticated)
# Title: CSZCMS v1.3.0 - SQL Injection (Authenticated)
WordPress File Upload Plugin < 4.23.3 - Stored XSS
Exploit Title: WordPress File Upload < 4.23.3 Stored XSS (CVE 2023-4811)
WEBIGniter v28.7.23 – Stored XSS
## Title: WEBIGniter v28.7.23 XSS
TYPO3 11.5.24 – Path Traversal (Authenticated)
# Exploit Title: TYPO3 11.5.24 Path Traversal Vulnerability (Authenticated)
Gibbon LMS < v26.0.00 - Authenticated RCE
# Exploit Title: Gibbon LMS has a PHP Deserialization vulnerability on the v26.0.00 version
Atlassian Confluence < 8.5.3 - Remote Code Execution
# Exploit Title: CVE-2023-22527: Atlassian Confluence RCE Vulnerability
Backdrop CMS 1.23.0 – Stored XSS
# Exploit Title: Backdrop CMS 1.23.0 - Stored Cross-Site Scripting - Post Body Field
TELSAT marKoni FM Transmitter 1.9.5 – Root Command Injection
#!/usr/bin/env python
TELSAT marKoni FM Transmitter 1.9.5 – Backdoor Account Information Disclosure
TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account
TELSAT marKoni FM Transmitter 1.9.5 – Insecure Access Control Change Password
TELSAT marKoni FM Transmitter 1.9.5 Insecure Access Control Change Password
xbtitFM 4.1.18 – Multiple Vulnerabilities
# Exploit Title: xbtitFM 4.1.18 Multiple Vulnerabilities
Quick.CMS 6.7 – SQL Injection Login Bypass
# Exploit Title: Quick.CMS 6.7 SQL Injection Login Bypass
Winter CMS 1.2.3 – Server-Side Template Injection (SSTI) (Authenticated)
# Exploit Title: Winter CMS 1.2.2 - Server-Side Template Injection (SSTI) (Authenticated)
LaborOfficeFree 19.10 – MySQL Root Password Calculator
# Exploit Title: LaborOfficeFree 19.10 MySQL Root Password Calculator - CVE-2024-1346
Karaf v4.4.3 Console – RCE
#!/usr/bin/python
Nokia BMC Log Scanner – Remote Code Execution
# Exploit Title: Nokia BMC Log Scanner Remote Code Execution
UPS Network Management Card 4 – Path Traversal
# Exploit Title: UPS Network Management Card 4 - Path Traversal
vm2 – sandbox escape
# Exploit Title: vm2 Sandbox Escape vulnerability
JetBrains TeamCity 2023.05.3 – Remote Code Execution (RCE)
#- Exploit Title: JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)
Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
#- Exploit Title: Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
SolarView Compact 6.00 – Command Injection
#- Exploit Title: SolarView Compact 6.00 - Command Injection
Viessmann Vitogate 300 2.1.3.0 – Remote Code Execution (RCE)
#- Exploit Title: Viessmann Vitogate 300
Ruijie Switch PSG-5124 26293 – Remote Code Execution (RCE)
#- Exploit Title: Ruijie Switch PSG-5124 26293 - Remote Code Execution (RCE)
GitLab CE/EE < 16.7.2 - Password Reset
# Exploit Title: GitLab CE/EE < 16.7.2 - Password Reset
KiTTY 0.76.1.13 – ‘Start Duplicated Session Hostname’ Buffer Overflow
# Exploit Title: KiTTY 0.76.1.13 - 'Start Duplicated Session Hostname' Buffer Overflow
KiTTY 0.76.1.13 – ‘Start Duplicated Session Username’ Buffer Overflow
# Exploit Title: KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow
KiTTY 0.76.1.13 – Command Injection
# Exploit Title: KiTTY 0.76.1.13 - Command Injection
Human Resource Management System 1.0 – ’employeeid’ SQL Injection
# Exploit Title: Human Resource Management System - SQL Injection
OSGi v3.8-3.18 Console – RCE
#!/usr/bin/python
OSGi v3.7.2 (and below) Console – RCE
#!/usr/bin/python
Client Details System 1.0 – SQL Injection
+ **Exploit Title:** CVE-2023-7137_Client_Details_System-SQL_Injection_1
Cisco Firepower Management Center < 6.6.7.1 - Authenticated RCE
# Exploit Title: [Cisco Firepower Management Center]