qdPM 9.1 – Remote Code Execution (RCE) (Authenticated) (v2)
# Exploit Title: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)
Exploits
Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
- 类型
- 漏洞条目
- 总量
- 24,950
- 页码
- 33
OpenCart v3.x Newsletter Module – Blind SQLi
# Exploit Title: OpenCart v3.x Newsletter Module - Blind SQLi
m1k1o’s Blog v.10 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)
SDT-CW3B1 1.1.0 – OS Command Injection
# Exploit Title: SDT-CW3B1 1.1.0 - OS command injection
Survey Sparrow Enterprise Survey Software 2022 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
T-Soft E-Commerce 4 – ‘UrunAdi’ Stored Cross-Site Scripting (XSS)
# Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
T-Soft E-Commerce 4 – SQLi (Authenticated)
# Exploit Title: T-Soft E-Commerce 4 - SQLi (Authenticated)
SolarView Compact 6.0 – OS Command Injection
# Exploit Title: SolarView Compact 6.0 - OS Command Injection
Showdoc 2.10.3 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
F5 BIG-IP 16.0.x – Remote Code Execution (RCE)
# Exploit Title: F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
College Management System 1.0 – ‘course_code’ SQL Injection (Authenticated)
# Exploit Title: College Management System - 'course_code' SQL Injection (Authenticated)
Royal Event Management System 1.0 – ‘todate’ SQL Injection (Authenticated)
# Exploit Title: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
TLR-2005KSH – Arbitrary File Delete
# Exploit Title: TLR-2005KSH - Arbitrary File Delete
ImpressCMS v1.4.4 – Unrestricted File Upload
# Exploit Title: ImpressCMS v1.4.4 - Unrestricted File Upload
Microfinance Management System 1.0 – ‘customer_number’ SQLi
# Exploit Title: Microfinance Management System 1.0 - 'customer_number' SQLi
Akka HTTP 10.1.14 – Denial of Service
# Exploit Title: Akka HTTP Denial of Service via Nested Header Comments
WebTareas 2.4 – Blind SQLi (Authenticated)
# Exploit Title: WebTareas 2.4 - Blind SQLi (Authenticated)
USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 – Remote Root Backdoor
# Exploit Title: USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 - Remote Root Backdoor
WordPress Plugin Advanced Uploader 4.2 – Arbitrary File Upload (Authenticated)
# Exploit Title: WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
Magento eCommerce CE v2.3.5-p2 – Blind SQLi
Exploit Title: Magento eCommerce CE v2.3.5-p2 - Blind SQLi
Bookeen Notea – Directory Traversal
# Exploit Title: Bookeen Notea - Directory Traversal
Bitrix24 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Bitrix24 - Remote Code Execution (RCE) (Authenticated)
CSZ CMS 1.3.0 – ‘Multiple’ Blind SQLi
# Exploit Title: CSZ CMS 1.3.0 - 'Multiple' Blind SQLi
SAP BusinessObjects Intelligence 4.3 – XML External Entity (XXE)
# Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
UDisk Monitor Z5 Phone – ‘MonServiceUDisk.exe’ Unquoted Service Path
# Exploit Title: UDisk Monitor Z5 Phone - 'MonServiceUDisk.exe' Unquoted Service Path
TCQ – ITeCProteccioAppServer.exe – Unquoted Service Path
# Exploit Title: TCQ - 'ITeCProteccioAppServer.exe' Unquoted Service Path
Wondershare Dr.Fone 11.4.10 – Insecure File Permissions
# Exploit Title: Wondershare Dr.Fone 11.4.10 - Insecure File Permissions
ManageEngine ADSelfService Plus Build 6118 – NTLMv2 Hash Exposure
# Exploit Title: ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure
Prime95 Version 30.7 build 9 – Remote Code Execution (RCE)
# Exploit Title: Prime95 Version 30.7 build 9 - Remote Code Execution (RCE)
DLINK DIR850 – Insecure Access Control
# Exploit Title: DLINK DIR850 - Insecure Access Control
DLINK DIR850 – Open Redirect
# Exploit Title: DLINK DIR850 - Open Redirect
Cyclos 4.14.7 – DOM Based Cross-Site Scripting (XSS)
# Exploit Title: Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS)
Cyclos 4.14.7 – ‘groupId’ DOM Based Cross-Site Scripting (XSS)
# Exploit Title: Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS)
e107 CMS v3.2.1 – Multiple Vulnerabilities
# Exploit Title: e107 CMS v3.2.1 - Multiple Vulnerabilities
ExifTool 12.23 – Arbitrary Code Execution
# Exploit Title: ExifTool 12.23 - Arbitrary Code Execution
Wondershare Dr.Fone 12.0.7 – Privilege Escalation (ElevationService)
# Exploit Title: Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService)
Wondershare Dr.Fone 12.0.7 – Remote Code Execution (RCE)
# Exploit Title: Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE)
Apache CouchDB 3.2.1 – Remote Code Execution (RCE)
# Exploit Title: Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
Anuko Time Tracker – SQLi (Authenticated)
# Exploit Title: Anuko Time Tracker - SQLi (Authenticated)
Tenda HG6 v3.3.0 – Remote Command Injection
# Exploit Title: Tenda HG6 v3.3.0 - Remote Command Injection
Google Chrome 78.0.3904.70 – Remote Code Execution
# Exploit Title: Google Chrome 78.0.3904.70 - Remote Code Execution
PyScript – Read Remote Python Source Code
# Exploit Title: PyScript Remote Emscripten VMemory Python libraries
DLINK DAP-1620 A1 v1.01 – Directory Traversal
# Exploit Title: DLINK DAP-1620 A1 v1.01 - Directory Traversal
Explore CMS 1.0 – SQL Injection
# Exploit Title: Explore CMS 1.0 - SQL Injection
Navigate CMS 2.9.4 – Server-Side Request Forgery (SSRF) (Authenticated)
#!/usr/bin/env python3
PHProjekt PhpSimplyGest v1.3. – Stored Cross-Site Scripting (XSS)
# Exploit Title: PHProjekt PhpSimplyGest v1.3.0 - Stored Cross-Site Scripting (XSS)
Beehive Forum – Account Takeover
# Exploit Title: Beehive Forum - Account Takeover
MyBB 1.8.29 – MyBB 1.8.29 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Blue Admin 21.06.01 – Cross-Site Request Forgery (CSRF)
Exploit Title: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Joomla Plugin SexyPolling 2.1.7 – SQLi
# Exploit Title: Joomla Plugin SexyPolling 2.1.7 - SQLi