RATES SYSTEM 1.0 – Authentication Bypass
# Exploit Title: RATES SYSTEM 1.0 - Authentication Bypass
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Simple Image Gallery System 1.0 – ‘id’ SQL Injection
# Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection
Care2x Open Source Hospital Information Management 2.7 Alpha – ‘Multiple’ Stored XSS
# Exploit Title: Care2x Open Source Hospital Information Management 2.7 Alpha - 'Multiple' Stored XSS
Police Crime Record Management System 1.0 – ‘casedetails’ SQL Injection
# Exploit Title: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection
Police Crime Record Management System 1.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
4images 1.8 – ‘limitnumber’ SQL Injection (Authenticated)
# Exploit Title: 4images 1.8 - 'limitnumber' SQL Injection (Authenticated)
RATES SYSTEM 1.0 – ‘Multiple’ SQL Injections
# Exploit Title: RATES SYSTEM 1.0 - 'Multiple' SQL Injections
COVID19 Testing Management System 1.0 – ‘searchdata’ SQL Injection
# Exploit Title: COVID19 Testing Management System 1.0 - 'searchdata' SQL Injection
Simple Library Management System 1.0 – ‘rollno’ SQL Injection
# Exploit Title: Simple Library Management System 1.0 - 'rollno' SQL Injection
WordPress Plugin Picture Gallery 1.4.2 – ‘Edit Content URL’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Picture Gallery 1.4.2 - 'Edit Content URL' Stored Cross-Site Scripting (XSS)
Moodle 3.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Moodle 3.9 - Remote Code Execution (RCE) (Authenticated)
CMSuno 1.7 – ‘tgo’ Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: CMSuno 1.7 - 'tgo' Stored Cross-Site Scripting (XSS) (Authenticated)
Client Management System 1.1 – ‘cname’ Stored Cross-site scripting (XSS)
# Exploit Title: Client Management System 1.1 - 'cname' Stored Cross-site scripting (XSS)
qdPM 9.2 – Password Exposure (Unauthenticated)
# Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)
qdPM 9.1 – Remote Code Execution (Authenticated)
# Exploit Title: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin WP Customize Login 1.1 – ‘Change Logo Title’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WP Customize Login 1.1 - 'Change Logo Title' Stored Cross-Site Scripting (XSS)
Hotel Management System 1.0 – Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)
# Exploit Title: Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution...
Online Hotel Reservation System 1.0 – ‘Multiple’ Cross-site scripting (XSS)
# Exploit Title: Online Hotel Reservation System 1.0 - 'Multiple' Cross-site scripting (XSS)
Men Salon Management System 1.0 – SQL Injection Authentication Bypass
# Exploit Title: Men Salon Management System 1.0 - SQL Injection Authentication Bypass
Care2x Integrated Hospital Info System 2.7 – ‘Multiple’ SQL Injection
# Exploit Title: Care2x Integrated Hospital Info System 2.7 - 'Multiple' SQL Injection
Event Registration System with QR Code 1.0 – Authentication Bypass
# Exploit Title: Event Registration System with QR Code 1.0 - Authentication Bypass & RCE
Customer Relationship Management System (CRM) 1.0 – Sql Injection Authentication Bypass
# Exploit Title: Customer Relationship Management System (CRM) 1.0 - Sql Injection Authentication Bypass
PHP 7.3.15-3 – ‘PHP_SESSION_UPLOAD_PROGRESS’ Session Data Injection
# Exploit Title: PHP 7.3.15-3 - 'PHP_SESSION_UPLOAD_PROGRESS' Session Data Injection
XOS Shop 1.0.9 – ‘Multiple’ Arbitrary File Deletion (Authenticated)
# Exploit Title: XOS Shop 1.0.9 - 'Multiple' Arbitrary File Deletion (Authenticated)
WordPress Plugin Simple Post 1.1 – ‘Text field’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting (XSS)
CSZ CMS 1.2.9 – ‘Multiple’ Arbitrary File Deletion
# Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Arbitrary File Deletion
WordPress Plugin KN Fix Your Title 1.0.1 – ‘Separator’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin KN Fix Your Title 1.0.1 - 'Separator' Stored Cross-Site Scripting (XSS)
PEEL Shopping 9.3.0 – ‘id’ Time-based SQL Injection
# Exploit Title: PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection
WordPress Plugin Mimetic Books 0.2.13 – ‘Default Publisher ID field’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Mimetic Books 0.2.13 - 'Default Publisher ID field' Stored Cross-Site Scripting (XSS)
WordPress Plugin LearnPress 3.2.6.8 – Privilege Escalation
# Exploit Title: WordPress Plugin LearnPress 3.2.6.8 - Privilege Escalation
WordPress Plugin LearnPress 3.2.6.7 – ‘current_items’ SQL Injection (Authenticated)
# Exploit Title: WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)
WordPress Plugin Popular Posts 5.3.2 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated)
osCommerce 2.3.4.1 – Remote Code Execution (2)
# Exploit Title: osCommerce 2.3.4.1 - Remote Code Execution (2)
WordPress Plugin Current Book 1.0.1 – ‘Book Title’ Persistent Cross-Site Scripting
# Exploit Title: WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting (XSS)
Garbage Collection Management System 1.0 – SQL Injection + Arbitrary File Upload
# Exploit Title: Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload
OpenEMR 5.0.1.3 – ‘manage_site_files’ Remote Code Execution (Authenticated) (2)
# Title: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2)
Invoice System 1.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
WordPress Plugin WPFront Notification Bar 1.9.1.04012 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WPFront Notification Bar 1.9.1.04012 - Stored Cross-Site Scripting (XSS)
Zoo Management System 1.0 – ‘Multiple’ Persistent Cross-Site-Scripting (XSS)
# Exploit Title: Zoo Management System 1.0 - 'Multiple' Stored Cross-Site-Scripting (XSS)
Church Management System 1.0 – SQL Injection (Authentication Bypass) + Arbitrary File Upload + RCE
# Exploit Title: Church Management System 1.0 - SQL Injection (Authentication Bypass) + Arbitrary File Upload + RCE
WordPress Plugin SP Project & Document Manager 4.21 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Wordpress Plugin SP Project & Document Manager 4.21 - Remote Code Execution (RCE) (Authenticated)
Online Covid Vaccination Scheduler System 1.0 – Arbitrary File Upload to Remote Code Execution (Unauthenticated)
# Exploit Title: Online Covid Vaccination Scheduler System 1.0 - Arbitrary File Upload to Remote Code Execution (Unau...
Employee Record Management System 1.2 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS)
Exam Hall Management System 1.0 – Unrestricted File Upload + RCE (Unauthenticated)
# Exploit Title: Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)
WordPress Plugin Plainview Activity Monitor 20161228 – Remote Code Execution (RCE) (Authenticated) (2)
# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)
Online Covid Vaccination Scheduler System 1.0 – ‘username’ time-based blind SQL Injection
# Exploit Title: Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection
WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 – Directory Traversal
# Exploit Title: WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal
Phone Shop Sales Managements System 1.0 – Arbitrary File Upload
# Exploit Title: Phone Shop Sales Managements System 1.0 - 'Multiple' Arbitrary File Upload to Remote Code Execution
Phone Shop Sales Managements System 1.0 – Authentication Bypass (SQLi)
# Exploit Title: Phone Shop Sales Managements System 1.0 - Authentication Bypass (SQLi)
Exam Hall Management System 1.0 – Unrestricted File Upload (Unauthenticated)
# Exploit Title: Exam Hall Management System 1.0 - Unrestricted File Upload (Unauthenticated)