WebsiteBaker 2.13.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Budget and Expense Tracker System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Budget and Expense Tracker System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Budget and Expense Tracker System 1.0 – Authenticated Bypass
# Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass
Church Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Church Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Online Food Ordering System 2.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Online Food Ordering System 2.0 - Remote Code Execution (RCE) (Unauthenticated)
WordPress 5.7 – ‘Media Library’ XML External Entity Injection (XXE) (Authenticated)
# Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)
Church Management System 1.0 – ‘search’ SQL Injection (Unauthenticated)
# Exploit Title: Church Management System 1.0 - 'search' SQL Injection (Unauthenticated)
Simple Attendance System 1.0 – Authenticated bypass
# Exploit Title: Simple Attendance System 1.0 - Authenticated bypass
Library Management System 1.0 – Blind Time-Based SQL Injection (Unauthenticated)
# Exploit Title: Library Management System 1.0 - Blind Time-Based SQL Injection (Unauthenticated)
WordPress Plugin WooCommerce Booster Plugin 5.4.3 – Authentication Bypass
# Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass
ImpressCMS 1.4.2 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution (RCE) (Authenticated)
AlphaWeb XE – File Upload Remote Code Execution (RCE) (Authenticated)
# Exploit Title: AlphaWeb XE - File Upload Remote Code Execution (RCE) (Authenticated)
Evolution CMS 3.1.6 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)
Support Board 3.3.3 – ‘Multiple’ SQL Injection (Unauthenticated)
# Exploit Title: Support Board 3.3.3 - 'Multiple' SQL Injection (Unauthenticated)
Purchase Order Management System 1.0 – Remote File Upload
# Exploit Title: Purchase Order Management System 1.0 - Remote File Upload
Apartment Visitor Management System (AVMS) 1.0 – ‘username’ SQL Injection
# Exploit Title: Apartment Visitor Management System (AVMS) 1.0 - 'username' SQL Injection
WordPress Plugin Download From Files 1.48 – Arbitrary File Upload
# Exploit Title: Wordpress Plugin Download From Files 1.48 - Arbitrary File Upload
Men Salon Management System 1.0 – Multiple Vulnerabilities
# Exploit Title: Men Salon Management System 1.0 - Multiple Vulnerabilities
Bus Pass Management System 1.0 – ‘adminname’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)
WordPress Plugin TablePress 1.14 – CSV Injection
# Exploit Title: WordPress Plugin TablePress 1.14 - CSV Injection
WordPress Plugin Survey & Poll 1.5.7.3 – ‘sss_params’ SQL Injection (2)
# Exploit Title: WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection (2)
WordPress Plugin WP Sitemap Page 1.6.4 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WP Sitemap Page 1.6.4 - Stored Cross-Site Scripting (XSS)
Patient Appointment Scheduler System 1.0 – Persistent Cross-Site Scripting
# Exploit Title: Patient Appointment Scheduler System 1.0 - Persistent/Stored XSS
Patient Appointment Scheduler System 1.0 – Unauthenticated File Upload
# Exploit Title: Patient Appointment Scheduler System 1.0 - Unauthenticated File Upload
Bus Pass Management System 1.0 – ‘viewid’ Insecure direct object references (IDOR)
# Exploit Title: Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
FlatCore CMS 2.0.7 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: FlatCore CMS 2.0.7 - Remote Code Execution (RCE) (Authenticated)
OpenEMR 6.0.0 – ‘noteid’ Insecure Direct Object Reference (IDOR)
# Exploit Title: OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR)
OpenSIS 8.0 ‘modname’ – Directory Traversal
# Exploit Title: OpenSIS 8.0 'modname' - Directory/Path Traversal
WordPress Plugin Duplicate Page 4.4.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Duplicate Page 4.4.1 - Stored Cross-Site Scripting (XSS)
OpenSIS Community 8.0 – ‘cp_id_miss_attn’ SQL Injection
# Exploit Title: OpenSIS Community 8.0 - 'cp_id_miss_attn' SQL Injection
Dolibarr ERP 14.0.1 – Privilege Escalation
# Exploit Title: Dolibarr ERP/CRM 14.0.1 - Privilege Escalation
WordPress Plugin Payments Plugin | GetPaid 2.4.6 – HTML Injection
# Exploit Title: WordPress Plugin Payments Plugin | GetPaid 2.4.6 - HTML Injection
Traffic Offense Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Traffic Offense Management System 1.0 - SQLi to Remote Code Execution (RCE) (Unauthenticated)
WordPress Plugin ProfilePress 3.1.3 – Privilege Escalation (Unauthenticated)
# Exploit Title: WordPress Plugin ProfilePress 3.1.3 - Privilege Escalation (Unauthenticated)
Projectsend r1295 – ‘name’ Stored XSS
# Exploit Title: Projectsend r1295 - 'name' Stored XSS
Bus Pass Management System 1.0 – ‘viewid’ SQL Injection
# Exploit Title: Bus Pass Management System 1.0 - 'viewid' SQL Injection
Online Leave Management System 1.0 – Arbitrary File Upload to Shell (Unauthenticated)
# Exploit Title: Online Leave Management System 1.0 - Arbitrary File Upload to Shell (Unauthenticated)
WordPress Plugin Mail Masta 1.0 – Local File Inclusion (2)
# Exploit Title: WordPress Plugin Mail Masta 1.0 - Local File Inclusion (2)
RaspAP 2.6.6 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)
Simple Phone Book 1.0 – ‘Username’ SQL Injection (Unauthenticated)
# Exploit Title: Simple Phone book/directory 1.0 - 'Username' SQL Injection (Unauthenticated)
Online Traffic Offense Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Online Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Laundry Booking Management System 1.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
Laundry Booking Management System 1.0 – ‘Multiple’ SQL Injection
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' SQL Injection
Online Traffic Offense Management System 1.0 – ‘id’ SQL Injection (Authenticated)
# Exploit Title: Online Traffic Offense Management System 1.0 - 'id' SQL Injection (Authenticated)
Charity Management System CMS 1.0 – Multiple Vulnerabilities
# Exploit Title: Charity Management System CMS 1.0 - Multiple Vulnerabilities
COVID19 Testing Management System 1.0 – ‘Multiple’ SQL Injections
# Exploit Title: COVID19 Testing Management System 1.0 - 'Multiple' SQL Injections
Simple Image Gallery 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Crime records Management System 1.0 – ‘Multiple’ SQL Injection (Authenticated)
# Exploit Title: Crime records Management System 1.0 - 'Multiple' SQL Injection (Authenticated)
Simple Water Refilling Station Management System 1.0 – Remote Code Execution (RCE) through File Upload
# Exploit Title: Simple Water Refilling Station Management System 1.0 - Remote Code Execution (RCE) through File Upload
Simple Water Refilling Station Management System 1.0 – Authentication Bypass
# Exploit Title: Simple Water Refilling Station Management System 1.0 - Authentication Bypass