ImpressCMS v1.4.4 – Unrestricted File Upload
# Exploit Title: ImpressCMS v1.4.4 - Unrestricted File Upload
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Fuel CMS 1.5.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)# Google Dork: NA
WordPress Plugin Elementor 3.6.2 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WordPress Plugin Elementor 3.6.2 - Remote Code Execution (RCE) (Authenticated)
PKP Open Journals System 3.3 – Cross-Site Scripting (XSS)
# Exploit Title: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
REDCap 11.3.9 – Stored Cross Site Scripting
# Exploit Title: REDCap 11.3.9 - Stored Cross-Site Scripting
WordPress Plugin Popup Maker 1.16.5 – Stored Cross-Site Scripting (Authenticated)
# Exploit Title: WordPress Plugin Popup Maker Add New Cookie > Add > Cookie Time (overwrite the default '1 month' w...
WordPress Plugin Videos sync PDF 1.7.4 – Stored Cross Site Scripting (XSS)
# Exploit Title: WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting (XSS)
Scriptcase 9.7 – Remote Code Execution (RCE)
# Exploit Title: Scriptcasr 9.7 arbitrary file upload getshell
Easy Appointments 1.4.2 – Information Disclosure
# Exploit Title: Easy Appointments 1.4.2 - Information Disclosure
WordPress Plugin Motopress Hotel Booking Lite 4.2.4 – SQL Injection
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
ICEHRM 31.0.0.0S – Cross-site Request Forgery (CSRF) to Account Deletion
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion
qdPM 9.2 – Cross-site Request Forgery (CSRF)
# Exploit Title: qdPM 9.2 - Cross-site Request Forgery (CSRF)
minewebcms 1.15.2 – Cross-site Scripting (XSS)
# Exploit Title: minewebcms 1.15.2 - Cross-site Scripting (XSS)
KLiK Social Media Website 1.0 – ‘Multiple’ SQLi
# Exploit Title: KLiK Social Media Website 1.0 - 'Multiple' SQLi
Zenario CMS 9.0.54156 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Zenario CMS 9.0.54156 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Easy Cookie Policy 1.6.2 – Broken Access Control to Stored XSS
# Exploit Title: WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
CSZ CMS 1.2.9 – ‘Multiple’ Blind SQLi(Authenticated)
# Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
WordPress Plugin admin-word-count-column 2.2 – Local File Read
# Exploit Title: WordPress Plugin admin-word-count-column 2.2 - Local File Read
WordPress Plugin video-synchro-pdf 1.7.4 – Local File Inclusion
# Exploit Title: WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion
WordPress Plugin cab-fare-calculator 1.0.3 – Local File Inclusion
# Exploit Title: WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion
WordPress Plugin Curtain 1.0.2 – Cross-site Request Forgery (CSRF)
# Exploit Title: WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF)
Drupal avatar_uploader v7.x-1.0-beta8 – Cross Site Scripting (XSS)
# Exploit Title: Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS)
Atom CMS 2.0 – Remote Code Execution (RCE)
# Exploit Title: Atom CMS 2.0 - Remote Code Execution (RCE)
ImpressCMS 1.4.2 – Remote Code Execution (RCE)
# Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution (RCE)
WordPress Plugin amministrazione-aperta 3.7.3 – Local File Read – Unauthenticated
# Exploit Title: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
ICEHRM 31.0.0.0S – Cross-site Request Forgery (CSRF) to Account Takeover
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
WordPress Plugin iQ Block Country 1.2.13 – Arbitrary File Deletion via Zip Slip (Authenticated)
# Exploit Title: Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)
Tiny File Manager 2.4.6 – Remote Code Execution (RCE)
# Exploit Title: Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
Pluck CMS 4.7.16 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)
Moodle 3.11.5 – SQLi (Authenticated)
# Exploit Title: Moodle 3.11.5 - SQLi (Authenticated)
Zabbix 5.0.17 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Zabbix 5.0.17 - Remote Code Execution (RCE) (Authenticated)
Attendance and Payroll System v1.0 – SQLi Authentication Bypass
# Exploit Title: Attendance and Payroll System v1.0 - SQLi Authentication Bypass
Attendance and Payroll System v1.0 – Remote Code Execution (RCE)
# Exploit Title: Attendance and Payroll System v1.0 - Remote Code Execution (RCE)
part-db 0.5.11 – Remote Code Execution (RCE)
# Exploit Title: part-db 0.5.11 - Remote Code Execution (RCE)
Xerte 3.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Xerte 3.9 - Remote Code Execution (RCE) (Authenticated)
Xerte 3.10.3 – Directory Traversal (Authenticated)
# Exploit Title: Xerte 3.10.3 - Directory Traversal (Authenticated)
Microweber CMS 1.2.10 – Local File Inclusion (Authenticated) (Metasploit)
# Exploit Title: Microweber CMS v1.2.10 Local File Inclusion (Authenticated)
WebHMI 4.1 – Stored Cross Site Scripting (XSS) (Authenticated)
# Exploit Title: WebHMI 4.1 - Stored Cross Site Scripting (XSS) (Authenticated)
WebHMI 4.1.1 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WebHMI 4.1.1 - Remote Code Execution (RCE) (Authenticated)
Student Record System 1.0 – ‘cid’ SQLi (Authenticated)
# Exploit Title: Student Record System 1.0 - 'cid' SQLi (Authenticated)
Air Cargo Management System v1.0 – SQLi
# Title: Air Cargo Management System v1.0 - SQLi
Simple Real Estate Portal System 1.0 – ‘id’ SQLi
# Exploit Title: Simple Real Estate Portal System 1.0 - 'id' SQL Injection
FileCloud 21.2 – Cross-Site Request Forgery (CSRF)
# Exploit Title: FileCloud 21.2 - Cross-Site Request Forgery (CSRF)
WordPress Plugin WP User Frontend 3.5.25 – SQLi (Authenticated)
# Exploit Title: WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)
Cab Management System 1.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Cab Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
Microweber 1.2.11 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
Cab Management System 1.0 – ‘id’ SQLi (Authenticated)
# Exploit Title: Cab Management System 1.0 - 'id' SQLi (Authenticated)
WordPress Plugin Perfect Survey – 1.5.1 – SQLi (Unauthenticated)
# Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)
Hotel Druid 3.0.3 – Remote Code Execution (RCE)
# Exploit Title: Hotel Druid 3.0.3 - Remote Code Execution (RCE)
WordPress Plugin dzs-zoomsounds 6.60 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: WordPress Plugin dzs-zoomsounds - Remote Code Execution (RCE) (Unauthenticated)