esm-dev 136 – Path Traversal
# Exploit Title: esm-dev 136 - Path Traversal
multiple
multiple 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
MaNGOSWebV4 4.0.6 – Reflected XSS
# Exploit Title: MaNGOSWebV4 4.0.6 - Reflected XSS
Django 5.1.13 – SQL Injection
# Exploit Title: Django 5.1.13 - SQL Injection
YOURLS 1.8.2 – Cross-Site Request Forgery (CSRF)
# Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
phpMyFAQ 3.1.7 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Flowise 3.0.4 – Remote Code Execution (RCE)
# Exploit Title: Flowise 3.0.4 - Remote Code Execution (RCE)
Casdoor 2.95.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)
ClipBucket 5.5.0 – Arbitrary File Upload
# Exploit Title: ClipBucket 5.5.0 - Arbitrary File Upload
ClipBucket 5.5.2 Build #90 – Server-Side Request Forgery (SSRF)
# Exploit Title: ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)
Tourism Management System 2.0 – Arbitrary Shell Upload
# Exploit Title: Tourism Management System 2.0 - Arbitrary Shell Upload
Casdoor 2.55.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF)
dotCMS 25.07.02-1 – Authenticated Blind SQL Injection
#!/usr/bin/env python3
ELEX WooCommerce WordPress Plugin 1.4.3 – SQL Injection
#include <stdio.h>
Concrete CMS 9.4.3 – Stored XSS
# Exploit Title: Concrete CMS 9.4.3 - Stored XSS
Mbed TLS 3.6.4 – Use-After-Free
#include<stdio.h>
HTTP/2 2.0 – Denial Of Service (DOS)
#!/usr/bin/env python3
HTMLDOC 1.9.13 – Stack Buffer Overflow
#!/usr/bin/env python3
StoryChief WordPress Plugin 1.0.42 – Arbitrary File Upload
# Exploit Title: StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
Ivanti Endpoint Manager Mobile 12.5.0.0 – Authentication Bypass
#!/usr/bin/env python3
Lingdang CRM 8.6.4.7 – SQL Injection
# Exploit Title: Lingdang CRM 8.6.4.7 - SQL Injection
Birth Chart Compatibility WordPress Plugin 2.0 – Full Path Disclosure
#include<stdio.h>
Tenda AC20 16.03.08.12 – Command Injection
#include <stdio.h>
Soosyze CMS 2.0 – Brute Force Login
# Exploit Title: Soosyze CMS 2.0 - Brute Force Login
RiteCMS 3.0.0 – Reflected Cross Site Scripting (XSS)
# Exploit Title: RiteCMS 3.0.0 – Reflected Cross-Site Scripting (XSS)
BigAnt Office Messenger 5.6.06 – SQL Injection
# Exploit Title: BigAnt Office Messenger 5.6.06 - SQL Injection
JetBrains TeamCity 2023.11.4 – Authentication Bypass
#!/usr/bin/env python3
ServiceNow Multiple Versions – Input Validation & Template Injection
#!/usr/bin/env python3
Ghost CMS 5.59.1 – Arbitrary File Read
#!/usr/bin/env python3
Ghost CMS 5.42.1 – Path Traversal
#!/usr/bin/env python3
Belkin F9K1009 F9K1010 2.00.04/2.00.09 – Hard Coded Credentials
#include <stdio.h>
VMware vSphere Client 8.0.3.0 – Reflected Cross-Site Scripting (XSS)
# VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)
Tigo Energy Cloud Connect Advanced (CCA) 4.0.1 – Command Injection
#include <stdio.h>
Citrix NetScaler ADC/Gateway 14.1 – Memory Disclosure
# Exploit Title: Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure
atjiu pybbs 6.0.0 – Cross Site Scripting (XSS)
#include <stdio.h>
projectworlds Online Admission System 1.0 – SQL Injection
#include <stdio.h>
Cisco ISE 3.0 – Authorization Bypass
# Exploit Title: Cisco ISE 3.0 - Authorization Bypass
Cisco ISE 3.0 – Remote Code Execution (RCE)
# Exploit Title: Cisco ISE 3.0 - Remote Code Execution (RCE)
Ultimate Member WordPress Plugin 2.6.6 – Privilege Escalation
#!/usr/bin/env python3
Copyparty 1.18.6 – Reflected Cross-Site Scripting (XSS)
allowing an attacker to inject and execute arbitrary JavaScript in a victim’s browser
Adobe ColdFusion 2023.6 – Remote File Read
# Exploit Title: Adobe ColdFusion 2023.6 - Remote File Read
Mezzanine CMS 6.1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Mezzanine CMS 6.1.0 Stored Cross Site Scripting (XSS)
XWiki 14 – SQL Injection via getdeleteddocuments.vm
# Exploit Title: XWiki 14 - SQL Injection via getdeleteddocuments.vm
Invision Community 4.7.20 – (calendar/view.php) SQL Injection
# Exploit Title: Invision Community
Xlight FTP 1.1 – Denial Of Service (DOS)
# Exploit Title: Xlight FTP 1.1 - Denial Of Service (DOS)
Discourse 3.1.1 – Unauthenticated Chat Message Access
#!/usr/bin/env ruby