Control Web Panel 7 (CWP7) v0.9.8.1147 – Remote Code Execution (RCE)
// Exploit Title: Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE)
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Online Eyewear Shop 1.0 – SQL Injection (Unauthenticated)
# Exploit Title: Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated)
bgERP v22.31 (Orlovets) – Cookie Session vulnerability & Cross-Site Scripting (XSS)
## Title: bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS)
Bus Pass Management System 1.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Bus Pass Management System 1.0 - Stored Cross-Site Scripting (XSS)
Calendar Event Multi View 1.4.07 – Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)
# Exploit Title: Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting...
zstore 6.6.0 – Cross-Site Scripting (XSS)
## Exploit Title: zstore 6.6.0 - Cross-Site Scripting (XSS)
projectSend r1605 – Remote Code Exectution RCE
Exploit Title: projectSend r1605 - Remote Code Exectution RCE
PhotoShow 3.0 – Remote Code Execution
# Exploit Title: PhotoShow 3.0 - Remote Code Execution
Paid Memberships Pro v2.9.8 (WordPress Plugin) – Unauthenticated SQL Injection
#!/usr/bin/env python
GLPI Cartography Plugin v6.0.0 – Unauthenticated Remote Code Execution (RCE)
# Exploit Title: GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
GLPI v10.0.2 – SQL Injection (Authentication Depends on Configuration)
# ADVISORY INFORMATION
GLPI Activity v3.1.0 – Authenticated Local File Inclusion on Activity plugin
# Exploit Title: GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin
GLPI Glpiinventory v1.0.1 – Unauthenticated Local File Inclusion
# ADVISORY INFORMATION
GLPI 4.0.2 – Unauthenticated Local File Inclusion on Manageentities plugin
# ADVISORY INFORMATION
ERPGo SaaS 3.9 – CSV Injection
# Exploit Title: ERPGo SaaS 3.9 - CSV Injection
AmazCart CMS 3.4 – Cross-Site-Scripting (XSS)
# Exploit Title: AmazCart CMS 3.4 - Cross-Site-Scripting (XSS)
Art Gallery Management System Project v1.0 – SQL Injection (editid) authenticated
# Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection (editid) authenticated
Art Gallery Management System Project v1.0 – SQL Injection (cid) Unauthenticated
# Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection (cid) Unauthenticated
Art Gallery Management System Project v1.0 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
MyBB 1.8.32 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: MyBB 1.8.32 - Chained LFI Remote Code Execution (RCE) (Authenticated)
SLIMSV 9.5.2 – Cross-Site Scripting (XSS)
## Exploit Title: SLIMSV 9.5.2 - Cross-Site Scripting (XSS)
Zstore 6.5.4 – Reflected Cross-Site Scripting (XSS)
## Exploit Title: Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)
Metform Elementor Contact Form Builder v3.1.2 – Unauthenticated Stored Cross-Site Scripting (XSS)
# Exploit Title: Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
ChiKoi v1.0 – SQL Injection
## Title: ChiKoi-1.0 SQLi
pimCore v5.4.18-skeleton – Sensitive Cookie with Improper SameSite Attribute
## Exploit Title: pimCore v5.4.18-skeleton - Sensitive Cookie with Improper SameSite Attribute
Yahoo User Interface library (YUI2) TreeView v2.8.2 – Multiple Reflected Cross Site Scripting (XSS)
# Exploit Title: Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)
PMB 7.4.6 – SQL Injection
# Exploit Title: PMB 7.4.6 - SQL Injection
SugarCRM 12.2.0 – Remote Code Execution (RCE)
#!/usr/bin/env python
Prizm Content Connect v10.5.1030.8315 – XXE
# Exploit Title: Prizm Content Connect v10.5.1030.8315 - XXE
XCMS v1.83 – Remote Command Execution (RCE)
Exploit Title: XCMS v1.83 - Remote Command Execution (RCE)
Textpattern 4.8.8 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated)
Bangresto 1.0 – SQL Injection
## Exploit Title: Bangresto 1.0 - SQL Injection
Cacti v1.2.22 – Remote Command Execution (RCE)
# Exploit Title: Cacti v1.2.22 - Remote Command Execution (RCE)
Judging Management System v1.0 – Authentication Bypass
# Exploit Title: Judging Management System v1.0 - Authentication Bypass
Judging Management System v1.0 – Remote Code Execution (RCE)
# Exploit Title: Judging Management System v1.0 - Remote Code Execution (RCE)
rconfig 3.9.7 – Sql Injection (Authenticated)
# Exploit Title: rconfig 3.9.7 - Sql Injection (Authenticated)
Spitfire CMS 1.0.475 – PHP Object Injection
# Exploit Title: Spitfire CMS 1.0.475 - PHP Object Injection
Senayan Library Management System v9.0.0 – SQL Injection
## Exploit Title: Senayan Library Management System v9.0.0 - SQL Injection
Bludit 3-14-1 Plugin ‘UploadPlugin’ – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated)
WooCommerce v7.1.0 – Remote Code Execution(RCE)
# Title: Wordpress Plugin WooCommerce v7.1.0 - Remote Code Execution(RCE)
Eve-ng 5.0.1-13 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS)
WPForms 1.7.8 – Cross-Site Scripting (XSS)
# Exploit Title: WPForms 1.7.8 - Cross-Site Scripting (XSS)
4images 1.9 – Remote Command Execution (RCE)
# Exploit Title: 4images 1.9 - Remote Command Execution (RCE)
Device Manager Express 7.8.20002.47752 – Remote Code Execution (RCE)
# Exploit Title: Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)
Concrete5 CME v9.1.3 – Xpath injection
## Exploit Title: Concrete5 CME v9.1.3 - Xpath injection
Ecommerse v1.0 – Cross-Site Scripting (XSS)
## Title: Ecommerse v1.0 - Cross-Site Scripting (XSS)
myBB forums 1.8.26 – Stored Cross-Site Scripting (XSS)
# Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)
ClicShopping v3.402 – Cross-Site Scripting (XSS)
## Title: ClicShopping v3.402 - Cross-Site Scripting (XSS)
Revenue Collection System v1.0 – Remote Code Execution (RCE)
# Exploit Title: Revenue Collection System v1.0 - Remote Code Execution (RCE)