WordPress Plugin Zephyr Project Manager 3.2.42 – Multiple SQLi
# Exploit Title: Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Testa 3.5.1 Online Test Management System – Reflected Cross-Site Scripting (XSS)
# Exploit Title: Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)
Aero CMS v0.0.1 – SQLi
# Title: Aero CMS v0.0.1 - SQLi
WordPress Plugin 3dady real-time web stats 1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)
WordPress Plugin WP-UserOnline 2.88.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)
Feehi CMS 2.1.1 – Remote Code Execution (Authenticated)
# Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Netroics Blog Posts Grid 1.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Netroics Blog Posts Grid 1.0 - Stored Cross-Site Scripting (XSS)
WordPress Plugin Testimonial Slider and Showcase 2.2.6 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Testimonial Slider and Showcase 2.2.6 - Stored Cross-Site Scripting (XSS)
Feehi CMS 2.1.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
Prestashop blockwishlist module 2.1.0 – SQLi
# Exploit Title: Prestashop blockwishlist module 2.1.0 - SQLi
NanoCMS v0.4 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: NanoCMS v0.4 - Remote Code Execution (RCE) (Authenticated)
mPDF 7.0 – Local File Inclusion
# Exploit Title: mPDF 7.0 - Local File Inclusion
CuteEditor for PHP 6.6 – Directory Traversal
# Exploit Title: CuteEditor for PHP 6.6 - Directory Traversal
WordPress Plugin Duplicator 1.4.7 – Information Disclosure
# Exploit Title: WordPress Plugin Duplicator 1.4.7 - Information Disclosure
WordPress Plugin Duplicator 1.4.6 – Unauthenticated Backup Download
# Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
WordPress Plugin WP-UserOnline 2.87.6 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
WordPress Plugin Visual Slide Box Builder 3.2.9 – SQLi
# Title: WordPress Plugin Visual Slide Box Builder 3.2.9 - SQLi
CodoForum v5.1 – Remote Code Execution (RCE)
# Exploit Title: CodoForum v5.1 - Remote Code Execution (RCE)
Magnolia CMS 6.2.19 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
WSO2 Management Console (Multiple Products) – Unauthenticated Reflected Cross-Site Scripting (XSS)
# Exploit Title: WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)
WordPress Plugin Weblizar 8.9 – Backdoor
# Exploit Title: WordPress Plugin Weblizar 8.9 - Backdoor
Old Age Home Management System 1.0 – SQLi Authentication Bypass
# Exploit Title: Old Age Home Management System 1.0 - SQLi Authentication Bypass
ChurchCRM 4.4.5 – SQLi
# Exploit Title: ChurchCRM 4.4.5 - SQLi
phpIPAM 1.4.5 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated)
Pandora FMS v7.0NG.742 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Motopress Hotel Booking Lite 4.2.4 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS)
Microweber CMS 1.2.15 – Account Takeover
# Exploit Title: Microweber CMS 1.2.15 - Account Takeover
Contao 4.13.2 – Cross-Site Scripting (XSS)
# Exploit Title: Contao 4.13.2 - Cross-Site Scripting (XSS)
qdPM 9.1 – Remote Code Execution (RCE) (Authenticated) (v2)
# Exploit Title: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)
m1k1o’s Blog v.10 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)
OpenCart v3.x Newsletter Module – Blind SQLi
# Exploit Title: OpenCart v3.x Newsletter Module - Blind SQLi
Showdoc 2.10.3 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
Royal Event Management System 1.0 – ‘todate’ SQL Injection (Authenticated)
# Exploit Title: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
College Management System 1.0 – ‘course_code’ SQL Injection (Authenticated)
# Exploit Title: College Management System - 'course_code' SQL Injection (Authenticated)
WordPress Plugin stafflist 3.1.2 – SQLi (Authenticated)
# Exploit Title: WordPress Plugin stafflist 3.1.2 - SQLi (Authenticated)
Joomla Plugin SexyPolling 2.1.7 – SQLi
# Exploit Title: Joomla Plugin SexyPolling 2.1.7 - SQLi
WordPress Plugin Blue Admin 21.06.01 – Cross-Site Request Forgery (CSRF)
Exploit Title: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
MyBB 1.8.29 – MyBB 1.8.29 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)
Beehive Forum – Account Takeover
# Exploit Title: Beehive Forum - Account Takeover
PHProjekt PhpSimplyGest v1.3. – Stored Cross-Site Scripting (XSS)
# Exploit Title: PHProjekt PhpSimplyGest v1.3.0 - Stored Cross-Site Scripting (XSS)
Navigate CMS 2.9.4 – Server-Side Request Forgery (SSRF) (Authenticated)
#!/usr/bin/env python3
Explore CMS 1.0 – SQL Injection
# Exploit Title: Explore CMS 1.0 - SQL Injection
Anuko Time Tracker – SQLi (Authenticated)
# Exploit Title: Anuko Time Tracker - SQLi (Authenticated)
e107 CMS v3.2.1 – Multiple Vulnerabilities
# Exploit Title: e107 CMS v3.2.1 - Multiple Vulnerabilities
CSZ CMS 1.3.0 – ‘Multiple’ Blind SQLi
# Exploit Title: CSZ CMS 1.3.0 - 'Multiple' Blind SQLi
Bitrix24 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Bitrix24 - Remote Code Execution (RCE) (Authenticated)
Magento eCommerce CE v2.3.5-p2 – Blind SQLi
Exploit Title: Magento eCommerce CE v2.3.5-p2 - Blind SQLi
WordPress Plugin Advanced Uploader 4.2 – Arbitrary File Upload (Authenticated)
# Exploit Title: WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
WebTareas 2.4 – Blind SQLi (Authenticated)
# Exploit Title: WebTareas 2.4 - Blind SQLi (Authenticated)
Microfinance Management System 1.0 – ‘customer_number’ SQLi
# Exploit Title: Microfinance Management System 1.0 - 'customer_number' SQLi