MixPHP Framework 2.2.17 – Unsafe Deserialization Remote Code Execution
# Exploit Title: MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
scramble – Remote Code Execution
# Exploit Title: scramble - Remote Code Execution
Grav CMS 2.0.0-beta.2 – Remote Code Execution
# Exploit Title: Grav CMS < 2.0.0-beta.2 - Remote Code Execution (RCE)
cPanel – CRLF Injection
# ExploitTitle: cPanel 11.40 - CRLF Injection
phpMyFAQ 4.0.16 – Improper Authorization
# Exploit Title: phpMyFAQ <= 4.0.16 - Improper Authorization
WeGIA 3.5.0 – SQL Injection
# Exploit Title: WeGIA 3.5.0 - SQL Injection
Pluck 4.7.7-dev2 – PHP Code Execution
# Exploit Title: Pluck 4.7.7-dev2 - PHP Code Execution
phpMyFAQ 2.9.8 – Cross-Site Request Forgery(CSRF)
# Exploit Title: phpMyFAQ 2.9.8 - Cross-Site Request Forgery(CSRF)
phpMyFAQ 2.9.8 – Cross-Site Request Forgery (CSRF)
# Exploit Title: phpMyFAQ 2.9.8 Cross-Site Request Forgery (CSRF)
phpMyFaq 2.9.8 – Cross Site Request Forgery (CSRF)
# Exploit Title: phpMyFaq 2.9.8 - Cross Site Request Forgery (CSRF)
MobileDetect 2.8.31 – Cross-Site Scripting (XSS)
# Exploit Title: MobileDetect 2.8.31 - Cross-Site Scripting (XSS)
phpIPAM 1.4 – SQL-Injection
# Exploit Title: phpIPAM 1.4 - SQL Injection
OpenRepeater 2.1 – OS Command Injection
# Exploit Title: OpenRepeater 2.1 - OS Command Injection
phpMyAdmin 5.0.0 – SQL Injection
# Exploit Title: phpMyAdmin 5.0.0 - SQL Injection
RosarioSIS 6.7.2 – Cross Site Scripting (XSS)
# Exploit Title: RosarioSIS 6.7.2 - Cross Site Scripting (XSS)
RosarioSIS 6.7.2 – Cross-Site Scripting (XSS)
# Exploit Title: RosarioSIS 6.7.2 - Cross-Site Scripting (XSS)
PluckCMS 4.7.10 – Unrestricted File Upload
# Exploit Title: PluckCMS 4.7.10 - Unrestricted File Upload
openSIS Community Edition 8.0 – SQL Injection
# Exploit Title: openSIS Community Edition 8.0 - SQL Injection
phpIPAM 1.5.1 – SQL Injection
# Exploit Title: phpIPAM 1.5.1 - SQL Injection
Piwigo 13.6.0 – SQL Injection
# Exploit Title: Piwigo 13.6.0 - SQL Injection
phpIPAM 1.6 – Reflected-Cross-Site Scripting (XSS)
# Exploit Title: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
phpIPAM 1.6 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
Grav CMS 1.7.48 – Remote Code Execution (RCE)
# Exploit Title: Grav CMS 1.7.48 - Remote Code Execution (RCE)
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Department Assignment Alias Nick Field
# Exploit Title: LiveHelperChat
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via the Chat Transfer Function
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via the Chat Transfer Function
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Personal Canned Messages
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Facebook Integration Page Name Field
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Operator Surname
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Operator Surname
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Telegram Bot Username
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
Joomla JS Jobs plugin 1.4.2 – SQL injection
# Exploit Title: Joomla JS Jobs plugin 1.4.2 - SQL injection
PHP CGI Module 8.3.4 – Remote Code Execution (RCE)
#!/usr/bin/env python3
Litespeed Cache WordPress Plugin 6.3.0.1 – Privilege Escalation
# Exploit Title: Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation
Anchor CMS 0.12.7 – Stored Cross Site Scripting (XSS)
# Exploit Title: Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS)
Laravel Pulse 1.3.1 – Arbitrary Code Injection
#!/usr/bin/env python3
CloudClassroom PHP Project 1.0 – SQL Injection
# Exploit Title: CloudClassroom PHP Project 1.0 - SQL Injection
Grokability Snipe-IT 8.0.4 – Insecure Direct Object Reference (IDOR)
# Exploit Title: Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)
WordPress Core 6.2 – Directory Traversal
# Exploit Title: WordPress Core 6.2 - Directory Traversal
WonderCMS 3.4.2 – Remote Code Execution (RCE)
# Exploit Title: WonderCMS 3.4.2 - Remote Code Execution (RCE)
code-projects Online Exam Mastering System 1.0 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)
Drupal 11.x-dev – Full Path Disclosure
#!/usr/bin/env python
KiviCare Clinic & Patient Management System (EHR) 3.6.4 – Unauthenticated SQL Injection
# Exploit Title: KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection
Inventio Lite 4 – SQL Injection
# Exploit Title: Inventio Lite 4 - SQL Injection
Tatsu 3.3.11 – Unauthenticated RCE
# Exploit Title:Tatsu 3.3.11 - Unauthenticated RCE
ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) – Authenticated Path Traversal
# Exploit Title: ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) - Authenticated Path Traversal
ABB Cylon Aspect 3.08.02 (deployStart.php) – Unauthenticated Command Execution
# Exploit Title: ABB Cylon Aspect 3.08.02 (deployStart.php) Unauthenticated Command Execution
Smart Manager 8.27.0 – Post-Authenticated SQL Injection
# Exploit Title: Smart Manager 8.27.0 - Post-Authenticated SQL Injection
KodExplorer 4.52 – Open Redirect
# Exploit Title: KodExplorer 4.52 - Open Redirect
Car Rental Project 1.0 – Remote Code Execution
# Exploit Title: Car Rental Project 1.0 - Remote Code Execution
phpMyFAQ 3.2.10 – Unintended File Download Triggered by Embedded Frames
# Exploit Title: phpMyFAQ v3.2.10 - Unintended File Download Triggered by Embedded Frames