OpenBMCS 2.4 – Create Admin / Remote Privilege Escalation
# Exploit Title: OpenBMCS 2.4 - Create Admin / Remote Privilege Escalation
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
OpenBMCS 2.4 – SQLi (Authenticated)
# Exploit Title: OpenBMCS 2.4 - SQLi (Authenticated)
OpenBMCS 2.4 – Cross Site Request Forgery (CSRF)
# Exploit Title: OpenBMCS 2.4 - Cross Site Request Forgery (CSRF)
Online Resort Management System 1.0 – SQLi (Authenticated)
# Exploit Title: Online Resort Management System 1.0 - SQLi (Authenticated)
WordPress Core 5.8.2 – ‘WP_Query’ SQL Injection
# Exploit Title: WordPress Core 5.8.2 - 'WP_Query' SQL Injection
Online Diagnostic Lab Management System 1.0 – SQL Injection (Unauthenticated)
#Exploit Title: Online Diagnostic Lab Management System 1.0 - SQL Injection (Unauthenticated)
Online Diagnostic Lab Management System 1.0 – Stored Cross Site Scripting (XSS)
#Exploit Title: Online Diagnostic Lab Management System 1.0 - Stored Cross Site Scripting (XSS)
Online Diagnostic Lab Management System 1.0 – Account Takeover (Unauthenticated)
#Exploit Title: Online Diagnostic Lab Management System 1.0 - Account Takeover (Unauthenticated)
SalonERP 3.0.1 – ‘sql’ SQL Injection (Authenticated)
# Exploit Title: SalonERP 3.0.1 - 'sql' SQL Injection (Authenticated)
Hospitals Patient Records Management System 1.0 – ‘doctors’ Stored Cross Site Scripting (XSS)
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'doctors' Stored Cross Site Scripting (XSS)
Hospitals Patient Records Management System 1.0 – ‘room_list’ Stored Cross Site Scripting (XSS)
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'room_list' Stored Cross Site Scripting (XSS)
Hospitals Patient Records Management System 1.0 – ‘room_types’ Stored Cross Site Scripting (XSS)
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'room_types' Stored Cross Site Scripting (XSS)
WordPress Plugin Frontend Uploader 1.3.2 – Stored Cross Site Scripting (XSS) (Unauthenticated)
# Exploit Title: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
Open-AudIT Community 4.2.0 – Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: Open-AudIT Community 4.2.0 - Cross-Site Scripting (XSS) (Authenticated)
Online Railway Reservation System 1.0 – ‘Multiple’ Stored Cross Site Scripting (XSS) (Unauthenticated)
#Exploit Title: Online Railway Reservation System 1.0 - 'Multiple' Stored Cross Site Scripting (XSS) (Unauthenticated)
Online Railway Reservation System 1.0 – Admin Account Creation (Unauthenticated)
#Exploit Title: Online Railway Reservation System 1.0 - Admin Account Creation (Unauthenticated)
Online Railway Reservation System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
#Exploit Title: Online Railway Reservation System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Online Railway Reservation System 1.0 – ‘id’ SQL Injection (Unauthenticated)
# Exploit Title: Online Railway Reservation System 1.0 - 'id' SQL Injection (Unauthenticated)
Online Veterinary Appointment System 1.0 – ‘Multiple’ SQL Injection
# Exploit Title: Online Veterinary Appointment System 1.0 - 'Multiple' SQL Injection
WordPress Plugin AAWP 3.16 – ‘tab’ Reflected Cross Site Scripting (XSS) (Authenticated)
# Exploit Title: WordPress Plugin AAWP 3.16 - 'tab' Reflected Cross Site Scripting (XSS) (Authenticated)
Projeqtor v9.3.1 – Stored Cross Site Scripting (XSS)
# Exploit Title: Projeqtor v9.3.1 - Stored Cross Site Scripting (XSS)
openSIS Student Information System 8.0 – ‘multiple’ SQL Injection
# Exploit Title: openSIS Student Information System 8.0 - 'multiple' SQL Injection
Terramaster TOS 4.2.15 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Terramaster TOS 4.2.15 - Remote Code Execution (RCE) (Unauthenticated)
Virtual Airlines Manager 2.6.2 – ‘multiple’ SQL Injection
# Exploit Title: Virtual Airlines Manager 2.6.2 - 'multiple' SQL Injection
Hospitals Patient Records Management System 1.0 – Account TakeOver
# Exploit Title: Hospitals Patient Records Management System 1.0 - Account TakeOver
Hospitals Patient Records Management System 1.0 – ‘id’ SQL Injection (Authenticated)
# Exploit Title: Hospitalss Patient Records Management System 1.0 - 'id' SQL Injection (Authenticated)
Hostel Management System 2.1 – Cross Site Scripting (XSS)
# Exploit Title: Hostel Management System 2.1 - Cross Site Scripting (XSS)
Nettmp NNT 5.1 – SQLi Authentication Bypass
# Exploit Title: Nettmp NNT 5.1 - SQLi Authentication Bypass
SAFARI Montage 8.5 – Reflected Cross Site Scripting (XSS)
# Exploit Title: SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)
Library System in PHP 1.0 – ‘publisher name’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Library System in PHP 1.0 - 'publisher name' Stored Cross-Site Scripting (XSS)
WordPress Plugin The True Ranker 2.2.2 – Arbitrary File Read (Unauthenticated)
# Exploit Title: WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)
Online Admission System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Online Admission System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Movie Rating System 1.0 – SQLi to RCE (Unauthenticated)
# Exploit Title: Movie Rating System 1.0 - SQLi to RCE (Unauthenticated)
Movie Rating System 1.0 – Broken Access Control (Admin Account Creation) (Unauthenticated)
# Exploit Title: Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated)
WordPress Plugin WP Visitor Statistics 4.7 – SQL Injection
# Exploit Title: WordPress Plugin WP Visitor Statistics 4.7 - SQL Injection
WordPress Plugin Contact Form Entries 1.1.6 – Cross Site Scripting (XSS) (Unauthenticated)
# Exploit Title: WordPress Plugin Contact Form Entries 1.1.6 - Cross Site Scripting (XSS) (Unauthenticated)
RiteCMS 3.1.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: RiteCMS 3.1.0 - Remote Code Execution (RCE) (Authenticated)
RiteCMS 3.1.0 – Arbitrary File Deletion (Authenticated)
# Exploit Title: RiteCMS 3.1.0 - Arbitrary File Deletion (Authenticated)
RiteCMS 3.1.0 – Arbitrary File Overwrite (Authenticated)
# Exploit Title: RiteCMS 3.1.0 - Arbitrary File Overwrite (Authenticated)
CMSimple 5.4 – Cross Site Scripting (XSS)
# Exploit Title: CMSimple 5.4 - Cross Site Scripting (XSS)
Exponent CMS 2.6 – Multiple Vulnerabilities
# Exploit Title: Exponent CMS 2.6 - Multiple Vulnerabilities
phpKF CMS 3.00 Beta y6 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)
WBCE CMS 1.5.1 – Admin Password Reset
# Exploit Title: WBCE CMS 1.5.1 - Admin Password Reset
Arunna 1.0.0 – ‘Multiple’ Cross-Site Request Forgery (CSRF)
# Exploit Title: Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
Croogo 3.0.2 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Croogo 3.0.2 - 'Multiple' Stored Cross-Site Scripting (XSS)
Croogo 3.0.2 – Unrestricted File Upload
# Exploit Title: Croogo 3.0.2 - Unrestricted File Upload
Online Thesis Archiving System 1.0 – SQLi Authentication Bypass
# Exploit Title: Online Thesis Archiving System 1.0 - SQLi Authentication Bypass
meterN v1.2.3 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: meterN v1.2.3 - Remote Code Execution (RCE) (Authenticated)
Booked Scheduler 2.7.5 – Remote Command Execution (RCE) (Authenticated)
# Exploit Title: Booked Scheduler 2.7.5 - Remote Command Execution (RCE) (Authenticated)
WordPress Plugin Typebot 1.4.3 – Stored Cross Site Scripting (XSS) (Authenticated)
# Exploit Title: WordPress Plugin Typebot 1.4.3 - Stored Cross Site Scripting (XSS) (Authenticated)