ImportExportTools NG 10.0.4 – HTML Injection
# Exploit Title: ImportExportTools NG 10.0.4 - HTML Injection
multiple
multiple 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Isshue Shopping Cart 3.5 – ‘Title’ Cross Site Scripting (XSS)
# Exploit Title: Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)
Codiad 2.8.4 – Remote Code Execution (Authenticated) (4)
# Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated) (4)
i3 International Annexxus Cameras Ax-n 5.2.0 – Application Logic Flaw
# Exploit Title: i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw
WebCTRL OEM 6.5 – ‘locale’ Reflected Cross-Site Scripting (XSS)
# Exploit Title: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)
Apache HTTP Server 2.4.50 – Remote Code Execution (RCE) (2)
# Exploit: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2)
myfactory FMS 7.1-911 – ‘Multiple’ Reflected Cross-Site Scripting (XSS)
# Exploit Title: myfactory FMS 7.1-911 - 'Multiple' Reflected Cross-Site Scripting (XSS)
Plastic SCM 10.0.16.5622 – WebAdmin Server Access
# Exploit Title: Plastic SCM 10.0.16.5622 - WebAdmin Server Access
Logitech Media Server 8.2.0 – ‘Title’ Cross-Site Scripting (XSS)
# Exploit Title: Logitech Media Server 8.2.0 - 'Title' Cross-Site Scripting (XSS)
Apache HTTP Server 2.4.50 – Path Traversal & Remote Code Execution (RCE)
# Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)
Apache HTTP Server 2.4.49 – Path Traversal & Remote Code Execution (RCE)
# Exploit Title: Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)
Odine Solutions GateKeeper 1.0 – ‘trafficCycle’ SQL Injection
# Exploit Title: Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL Injection
Atlassian Jira Server Data Center 8.16.0 – Arbitrary File Read
# Exploit Title: Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read
Open Game Panel – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Open Game Panel - Remote Code Execution (RCE) (Authenticated)
Payara Micro Community 5.2021.6 – Directory Traversal
# Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal
WhatsUpGold 21.0.3 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)
Gurock Testrail 7.2.0.3014 – ‘files.md5’ Improper Access Control
# Exploit Title: Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control
Cloudron 6.2 – ‘returnTo ‘ Cross Site Scripting (Reflected)
# Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
T-Soft E-Commerce 4 – change ‘admin credentials’ Cross-Site Request Forgery (CSRF)
# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)
Antminer Monitor 0.5.0 – Authentication Bypass
# Exploit Title: Antminer Monitor 0.5.0 - Authentication Bypass
WPanel 4.3.1 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WPanel 4.3.1 - Remote Code Execution (RCE) (Authenticated)
Strapi CMS 3.0.0-beta.17.4 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated)
Strapi 3.0.0-beta.17.7 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated)
Strapi 3.0.0-beta – Set Password (Unauthenticated)
# Exploit Title: Strapi 3.0.0-beta - Set Password (Unauthenticated)
ZesleCP 3.1.9 – Remote Code Execution (RCE) (Authenticated)
# Title: ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)
CyberPanel 2.1 – Remote Code Execution (RCE) (Authenticated)
# Title: CyberPanel 2.1 - Remote Code Execution (RCE) (Authenticated)
ProcessMaker 3.5.4 – Local File inclusion
# Exploit Title: ProcessMaker 3.5.4 - Local File inclusion
Altova MobileTogether Server 7.3 – XML External Entity Injection (XXE)
# Exploit Title: Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE)
Cockpit CMS 0.11.1 – ‘Username Enumeration & Password Reset’ NoSQL Injection
# Exploit Title: Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection
GFI Mail Archiver 15.1 – Telerik UI Component Arbitrary File Upload (Unauthenticated)
# Exploit Title: GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload (Unauthenticated)
Oracle Fatwire 6.3 – Multiple Vulnerabilities
# Exploit Title: Oracle Fatwire 6.3 - Multiple Vulnerabilities
Elasticsearch ECE 7.13.3 – Anonymous Database Dump
# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump
ElasticSearch 7.13.3 – Memory disclosure
# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure
Apache Tomcat 9.0.0.M1 – Cross-Site Scripting (XSS)
# Exploit Title: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS)
Apache Tomcat 9.0.0.M1 – Open Redirect
# Exploit Title: Apache Tomcat 9.0.0.M1 - Open Redirect
Wyomind Help Desk 1.3.6 – Remote Code Execution (RCE)
# Exploit Title: Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE)
Visual Tools DVR VX16 4.2.28.0 – OS Command Injection (Unauthenticated)
# Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)
perfexcrm 1.10 – ‘State’ Stored Cross-site scripting (XSS)
# Exploit Title: perfexcrm 1.10 - 'State' Stored Cross-site scripting (XSS)
Scratch Desktop 3.17 – Remote Code Execution
# Exploit Title: Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution (XSS/RCE)
Vianeos OctoPUS 5 – ‘login_user’ SQLi
# Exploit Title: Vianeos OctoPUS 5 - 'login_user' SQLi
Simple Traffic Offense System 1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Simple Traffic Offense System 1.0 - 'Multiple' Stored Cross Site Scripting (XSS)
Apache Superset 1.1.0 – Time-Based Account Enumeration
# Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration
VMware vCenter Server 7.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: VMware vCenter Server RCE 6.5 / 6.7 / 7.0 - Remote Code Execution (RCE) (Unauthenticated)
Accela Civic Platform 21.1 – ‘contactSeqNumber’ Insecure Direct Object References (IDOR)
# Exploit Title: Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR)
Accela Civic Platform 21.1 – ‘successURL’ Cross-Site-Scripting (XSS)
# Exploit Title: Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)
Solar-Log 500 2.8.2 – Unprotected Storage of Credentials
# Exploit Title: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials
Solar-Log 500 2.8.2 – Incorrect Access Control
# Exploit Title: Solar-Log 500 2.8.2 - Incorrect Access Control
Grocery crud 1.6.4 – ‘order_by’ SQL Injection
# Exploit Title: Grocery crud 1.6.4 - 'order_by' SQL Injection