Exploits

Online Examination System Project 1.0 – Cross-site request forgery (CSRF)

# Exploit Title: Online Examination System Project 1.0 - Cross-site request forgery (CSRF)

Teachers Record Management System 1.0 – File Upload Type Validation

Exploit Title: Teachers Record Management System 1.0 – File Upload Type Validation

Sales Tracker Management System v1.0 – Multiple Vulnerabilities

Exploit Title: Sales Tracker Management System v1.0 – Multiple Vulnerabilities

Thruk Monitoring Web Interface 3.06 – Path Traversal

# Exploit Title: Thruk Monitoring Web Interface 3.06 - Path Traversal

WordPress Theme Workreap 2.2.2 – Unauthenticated Upload Leading to Remote Code Execution

# Exploit Title: WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

USB Flash Drives Control 4.1.0.0 – Unquoted Service Path

# Exploit Title: USB Flash Drives Control 4.1.0.0 - Unquoted Service Path

Macro Expert 4.9 – Unquoted Service Path

# Exploit Title: Macro Expert 4.9 - Unquoted Service Path

Tree Page View Plugin 1.6.7 – Cross Site Scripting (XSS)

# Exploit Title: Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)

Total CMS 1.7.4 – Remote Code Execution (RCE)

# Exploit Title: Total CMS 1.7.4 - Remote Code Execution (RCE)

Enrollment System Project v1.0 – SQL Injection Authentication Bypass (SQLI)

# Exploit Title: Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)

Barebones CMS v2.0.2 – Stored Cross-Site Scripting (XSS) (Authenticated)

# Exploit Title: Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)

STARFACE 7.3.0.10 – Authentication with Password Hash Possible

Exploit Title: STARFACE 7.3.0.10 - Authentication with Password Hash Possible

MotoCMS Version 3.4.3 – SQL Injection

# Title: MotoCMS Version 3.4.3 - SQL Injection

File Manager Advanced Shortcode 2.3.2 – Unauthenticated Remote Code Execution (RCE)

# Exploit Title: File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)

Rukovoditel 3.3.1 – CSV injection

Exploit Title: Rukovoditel 3.3.1 - CSV injection

SCRMS 2023-05-27 1.0 – Multiple SQL Injection

## Exploit Title: SCRMS 2023-05-27 1.0 - Multiple SQLi

unilogies/bumsys v1.0.3 beta – Unrestricted File Upload

Exploit Title: - unilogies/bumsys v1.0.3-beta - Unrestricted File Upload

Flexense HTTP Server 10.6.24 – Buffer Overflow (DoS) (Metasploit)

##

Online Security Guards Hiring System 1.0 – Reflected XSS

#Exploit Title: Online Security Guards Hiring System 1.0 – REFLECTED XSS

Faculty Evaluation System 1.0 – Unauthenticated File Upload

# Exploit Title: Faculty Evaluation System 1.0 - Unauthenticated File Upload

Pydio Cells 4.1.2 – Unauthorised Role Assignments

Exploit Title: Pydio Cells 4.1.2 - Unauthorised Role Assignments

Pydio Cells 4.1.2 – Cross-Site Scripting (XSS) via File Download

Exploit Title: Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download

Pydio Cells 4.1.2 – Server-Side Request Forgery

Exploit Title: Pydio Cells 4.1.2 - Server-Side Request Forgery

MotoCMS Version 3.4.3 – Server-Side Template Injection (SSTI)

# Title: MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)

Camaleon CMS v2.7.0 – Server-Side Template Injection (SSTI)

Exploit Title: Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)

Filmora 12 version ( Build 1.0.0.7) – Unquoted Service Paths Privilege Escalation

# Exploit Title: Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation

WBCE CMS 1.6.1 – Multiple Stored Cross-Site Scripting (XSS)

Exploit Title: WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)

Zenphoto 1.6 – Multiple stored XSS

Exploit Title: Zenphoto 1.6 - Multiple stored XSS

Ulicms 2023.1 – create admin user via mass assignment

#Exploit Title: Ulicms 2023.1 - create admin user via mass assignment

Seagate Central Storage 2015.0916 – Unauthenticated Remote Command Execution (Metasploit)

##

SCM Manager 1.60 – Cross-Site Scripting Stored (Authenticated)

#!/usr/bin/python3

Service Provider Management System v1.0 – SQL Injection

# Exploit Title: Service Provider Management System v1.0 - SQL Injection

TinyWebGallery v2.5 – Remote Code Execution (RCE)

#Exploit Title: TinyWebGallery v2.5 - Remote Code Execution (RCE)

Optoma 1080PSTX Firmware C02 – Authentication Bypass

# Exploit Title: Optoma 1080PSTX Firmware C02 - Authentication Bypass

WordPress Plugin Backup Migration 1.2.8 – Unauthenticated Database Backup

# Exploit Title: WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup

Cameleon CMS 2.7.4 – Persistent Stored XSS in Post Title

# Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4

Apache Superset 2.0.0 – Authentication Bypass

# Exploit Title: Apache Superset 2.0.0 - Authentication Bypass

PnPSCADA v2.x – Unauthenticated PostgreSQL Injection

# Exploit Title: PnPSCADA v2.x - Unauthenticated PostgreSQL Injection

e107 v2.3.2 – Reflected XSS

# Exploit Title: e107 v2.3.2 - Reflected XSS

thrsrossi Millhouse-Project 1.414 – Remote Code Execution

WBiz Desk 1.2 – SQL Injection

[#] Exploit Title: WBiz Desk 1.2 - SQL Injection

PaperCut NG/MG 22.0.4 – Remote Code Execution (RCE)

# Exploit Title: PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)

Trend Micro OfficeScan Client 10.0 – ACL Service LPE

# Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE

PodcastGenerator 3.2.9 – Multiple Stored Cross-Site Scripting (XSS)

#Exploit Title: PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS)

Screen SFT DAB 600/C – Authentication Bypass Account Creation

#!/usr/bin/env python3

Screen SFT DAB 600/C – Authentication Bypass Password Change

#!/usr/bin/env python3

Screen SFT DAB 600/C – Authentication Bypass Erase Account

#!/usr/bin/env python3

Screen SFT DAB 600/C – Authentication Bypass Admin Password Change

#!/usr/bin/env python3

Screen SFT DAB 600/C – Authentication Bypass Reset Board Config

#!/usr/bin/env python3

Screen SFT DAB 600/C – Unauthenticated Information Disclosure (userManager.cgx)

# Exploit Title: Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)