Exploits

Hubstaff 1.6.14-61e5e22e – ‘wow64log’ DLL Search Order Hijacking

Hubstaff is an employee work tracker with screenshots, timesheets, billing,

Best POS Management System v1.0 – Unauthenticated Remote Code Execution

# Exploit Title: Best POS Management System v1.0 - Unauthenticated Remote Code Execution

Prestashop 8.0.4 – CSV injection

Exploit Title: Prestashop 8.0.4 - CSV injection

SitemagicCMS 4.4.3 – Remote Code Execution (RCE)

#Exploit Title: SitemagicCMS 4.4.3 Remote Code Execution (RCE)

Webkul Qloapps 1.5.2 – Cross-Site Scripting (XSS)

# Exploit Title: Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)

eScan Management Console 14.0.1400.2281 – SQL Injection (Authenticated)

# Exploit Title: eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)

eScan Management Console 14.0.1400.2281 – Cross Site Scripting

# Exploit Title: eScan Management Console 14.0.1400.2281 - Cross Site Scripting

Affiliate Me Version 5.0.1 – SQL Injection

[#] Exploit Title: Affiliate Me Version 5.0.1 - SQL Injection

Gin Markdown Editor v0.7.4 (Electron) – Arbitrary Code Execution

# Exploit Title: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution

Yank Note v3.52.1 (Electron) – Arbitrary Code Execution

# Exploit Title: Yank Note v3.52.1 (Electron) - Arbitrary Code Execution

LeadPro CRM v1.0 – SQL Injection

# Exploit Title: LeadPro CRM v1.0 - SQL Injection

Smart School v1.0 – SQL Injection

# Exploit Title: Smart School v1.0 - SQL Injection

Stackposts Social Marketing Tool v1.0 – SQL Injection

# Exploit Title: Stackposts Social Marketing Tool v1.0 - SQL Injection

Quicklancer v1.0 – SQL Injection

# Exploit Title: Quicklancer v1.0 - SQL Injection

GetSimple CMS v3.3.16 – Remote Code Execution (RCE)

# Exploit Title: GetSimple CMS v3.3.16 - Remote Code Execution (RCE)

Bludit CMS v3.14.1 – Stored Cross-Site Scripting (XSS) (Authenticated)

# Exploit Title: Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)

ChurchCRM v4.5.4 – Reflected XSS via Image (Authenticated)

# Exploit Title: ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)

CiviCRM 5.59.alpha1 – Stored XSS (Cross-Site Scripting)

# Exploit Title: CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)

MobileTrans 4.0.11 – Weak Service Privilege Escalation

# Exploit Title :MobileTrans 4.0.11 - Weak Service Privilege Escalation

FusionInvoice 2023-1.0 – Stored XSS (Cross-Site Scripting)

# Exploit Title: FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)

RockMongo 1.1.7 – Stored Cross-Site Scripting (XSS)

# Exploit Title: RockMongo 1.1.7 - Stored Cross-Site Scripting (XSS)

FLEX 1080 < 1085 Web 1.6.0 - Denial of Service

# Exploit Title: FLEX 1080 < 1085 Web 1.6.0 - Denial of Service

Online Clinic Management System 2.2 – Multiple Stored Cross-Site Scripting (XSS)

# Exploit Title: Online Clinic Management System 2.2 - Multiple Stored Cross-Site Scripting (XSS)

Job Portal 1.0 – File Upload Restriction Bypass

Epson Stylus SX510W Printer Remote Power Off – Denial of Service

# Exploit Title: Epson Stylus SX510W Printer Remote Power Off - Denial of Service (PoC)

TinyWebGallery v2.5 – Stored Cross-Site Scripting (XSS)

#Exploit Title: TinyWebGallery v2.5 - Stored Cross-Site Scripting (XSS)

KodExplorer v4.51.03 – Pwned-Admin File-Inclusion – Remote Code Execution (RCE)

## Title: KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE)

pluck v4.7.18 – Stored Cross-Site Scripting (XSS)

Exploit Title: pluck v4.7.18 - Stored Cross-Site Scripting (XSS)

Wolf CMS 0.8.3.1 – Remote Code Execution (RCE)

# Exploit Title: Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)

Cmaps v8.0 – SQL injection

# Exploit Title: Cmaps v8.0 - SQL injection

Jedox 2022.4.2 – Code Execution via RPC Interfaces

# Exploit Title: Jedox 2022.4.2 - Code Execution via RPC Interfaces

Jedox 2022.4.2 – Remote Code Execution via Directory Traversal

# Exploit Title: Jedox 2022.4.2 - Remote Code Execution via Directory Traversal

Jedox 2020.2.5 – Stored Cross-Site Scripting in Log-Module

# Exploit Title: Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module

Jedox 2020.2.5 – Remote Code Execution via Configurable Storage Path

# Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path

Jedox 2020.2.5 – Remote Code Execution via Executable Groovy-Scripts

# Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts

Jedox 2020.2.5 – Disclosure of Database Credentials via Improper Access Controls

# Exploit Title: Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls

Jedox 2022.4.2 – Disclosure of Database Credentials via Connection Checks

# Exploit Title: Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks

EasyPHP Webserver 14.1 – Multiple Vulnerabilities (RCE and Path Traversal)

# Exploit Title: EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and

Online Pizza Ordering System v1.0 – Unauthenticated File Upload

# Exploit Title: Online Pizza Ordering System 1.0 - Unauthenticated File Upload

Codigo Markdown Editor v1.0.1 (Electron) – Remote Code Execution

# Exploit Title: Codigo Markdown Editor v1.0.1 (Electron) - Arbitrary Code Execution

Ulicms-2023.1-sniffing-vicuna – Privilege escalation

#Exploit Title: Ulicms 2023.1 sniffing-vicuna - Privilege escalation

Ulicms-2023.1 sniffing-vicuna – Remote Code Execution (RCE)

#Exploit Title: Ulicms-2023.1 sniffing-vicuna - Remote Code Execution (RCE)

Ulicms-2023.1 sniffing-vicuna – Stored Cross-Site Scripting (XSS)

#Exploit Title: Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)

File Thingie 2.5.7 – Remote Code Execution (RCE)

#!/usr/bin/python

PHP Restaurants 1.0 – SQLi Authentication Bypass & Cross Site Scripting

# Exploit Title: PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting (XSS)

phpMyFAQ v3.1.12 – CSV Injection

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection

projectSend r1605 – Private file download

Exploit Title: projectSend r1605 - Private file download

revive-adserver v5.4.1 – Cross-Site Scripting (XSS)

Exploit Title: revive-adserver v5.4.1 - Cross-Site Scripting (XSS)

admidio v4.2.5 – CSV Injection

Exploit Title: admidio v4.2.5 - CSV Injection

Serendipity 2.4.0 – File Inclusion RCE

## Exploit Title: Serendipity 2.4.0 - File Inclusion RCE