Billing System Project 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Billing System Project 1.0 - Remote Code Execution (RCE) (Unauthenticated)
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
TextPattern CMS 4.9.0-dev – Remote Command Execution (RCE) (Authenticated)
# Exploit Title: TextPattern CMS 4.9.0-dev - Remote Command Execution (RCE) (Authenticated)
Simple Client Management System 1.0 – Remote Code Execution (RCE)
# Exploit Title: Simple Client Management System 1.0 - Remote Code Execution (RCE)
WordPress Plugin Backup Guard 1.5.8 – Remote Code Execution (Authenticated)
# Exploit Title: Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution (Authenticated)
Church Management System 1.0 – ‘password’ SQL Injection (Authentication Bypass)
# Exploit Title: Church Management System 1.0 - 'password' SQL Injection (Authentication Bypass)
Church Management System 1.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Church Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
Church Management System 1.0 – Arbitrary File Upload (Authenticated)
# Exploit Title: Church Management System 1.0 - Unrestricted File Upload to Remote Code Execution (Authenticated)
Online Birth Certificate System 1.1 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
Online Voting System 1.0 – SQLi (Authentication Bypass) + Remote Code Execution (RCE)
# Exploit Title: Online Voting System 1.0 - SQLi (Authentication Bypass) + Remote Code Execution (RCE)
OpenEMR 5.0.1.7 – ‘fileName’ Path Traversal (Authenticated) (2)
# Title: OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) (2)
WordPress Plugin WP Learn Manager 1.1.2 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WP Learn Manager 1.1.2 - Stored Cross-Site Scripting (XSS)
Garbage Collection Management System 1.0 – SQL Injection (Unauthenticated)
# Exploit Title: Garbage Collection Management System 1.0 - SQL Injection (Unauthenticated)
WordPress Plugin Modern Events Calendar 5.16.2 – Event export (Unauthenticated)
# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)
WordPress Plugin Modern Events Calendar 5.16.2 – Remote Code Execution (Authenticated)
# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated)
b2evolution 7.2.2 – ‘edit account details’ Cross-Site Request Forgery (CSRF)
# Exploit Title: b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)
WordPress Plugin XCloner 4.2.12 – Remote Code Execution (Authenticated)
# Exploit Title: Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated)
Online Voting System 1.0 – Remote Code Execution (Authenticated)
# Exploit Title: Online Voting System 1.0 - Remote Code Execution (Authenticated)
Online Voting System 1.0 – Authentication Bypass (SQLi)
# Exploit Title: Online Voting System 1.0 - Authentication Bypass (SQLi)
Doctors Patients Management System 1.0 – SQL Injection (Authentication Bypass)
# Exploit Title: Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
phpAbook 0.9i – SQL Injection
# Exploit Title: phpAbook 0.9i - SQL Injection
WordPress Plugin YOP Polls 6.2.7 – Stored Cross Site Scripting (XSS)
# Exploit Title: WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)
Simple Client Management System 1.0 – ‘uemail’ SQL Injection (Unauthenticated)
# Exploit Title: Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
Seeddms 5.1.10 – Remote Command Execution (RCE) (Authenticated)
# Exploit Title: Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated)
Simple CRM 3.0 – ’email’ SQL injection (Authentication Bypass)
# Exploit Title: Simple CRM 3.0 - 'email' SQL injection (Authentication Bypass)
Online Library Management System 1.0 – Arbitrary File Upload Remote Code Execution (Unauthenticated)
# Exploit Title: Online Library Management System 1.0 - Arbitrary File Upload Remote Code Execution (Unauthenticated)
Online Library Management System 1.0 – ‘Search’ SQL Injection
# Exploit Title: Online Library Management System 1.0 - 'Search' SQL Injection
WordPress Plugin Poll, Survey, Questionnaire and Voting system 1.5.2 – ‘date_answers’ Blind SQL Injection
# Exploit Title: WordPress Plugin Poll, Survey, Questionnaire and Voting system 1.5.2 - 'date_answers' Blind SQL Inje...
WordPress Plugin WP Google Maps 8.1.11 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS)
Phone Shop Sales Managements System 1.0 – Insecure Direct Object Reference (IDOR)
# Exploit Title: Phone Shop Sales Managements System 1.0 - Insecure Direct Object Reference (IDOR)
Responsive Tourism Website 3.1 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Responsive Tourism Website 3.1 - Remote Code Execution (RCE) (Unauthenticated)
Customer Relationship Management System (CRM) 1.0 – Remote Code Execution
# Exploit Title: Customer Relationship Management System (CRM) 1.0 - Remote Code Execution
Simple CRM 3.0 – ‘name’ Stored Cross site scripting (XSS)
# Exploit Title: Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS)
Simple CRM 3.0 – ‘Change user information’ Cross-Site Request Forgery (CSRF)
# Exploit Title: Simple CRM 3.0 - 'Change user information' Cross-Site Request Forgery (CSRF)
Websvn 2.6.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
OpenEMR 5.0.1.7 – ‘fileName’ Path Traversal (Authenticated)
# Exploit Title: OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated)
ICE Hrm 29.0.0.OS – ‘xml upload’ Stored Cross-Site Scripting (XSS)
# Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)
ICE Hrm 29.0.0.OS – ‘Account Takeover’ Cross-Site Request Forgery (CSRF)
# Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)
Online Shopping Portal 3.1 – Remote Code Execution (Unauthenticated)
# Exploit Title: Online Shopping Portal 3.1 - Remote Code Execution (Unauthenticated)
Unified Office Total Connect Now 1.0 – ‘data’ SQL Injection
# Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection
CKEditor 3 – Server-Side Request Forgery (SSRF)
# Exploit Title: CKEditor 3 - Server-Side Request Forgery (SSRF)
Teachers Record Management System 1.0 – ’email’ Stored Cross-site Scripting (XSS)
# Exploit Title: Teachers Record Management System 1.0 – 'email' Stored Cross-site Scripting (XSS)
Teachers Record Management System 1.0 – ‘Multiple’ SQL Injection (Authenticated)
# Exploit Title: Teachers Record Management System 1.0 – Multiple SQL Injection (Authenticated)
OpenEMR 5.0.1.3 – Authentication Bypass
# Exploit Title: OpenEMR 5.0.1.3 - '/portal/account/register.php' Authentication Bypass
Cotonti Siena 0.9.19 – ‘maintitle’ Stored Cross-Site Scripting
# Exploit Title: Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting
Client Management System 1.1 – ‘username’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Client Management System 1.1 - 'username' Stored Cross-Site Scripting (XSS)
OpenEMR 5.0.1.3 – ‘manage_site_files’ Remote Code Execution (Authenticated)
# Exploit Title: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated)
TextPattern CMS 4.8.7 – Remote Command Execution (Authenticated)
# Exploit Title : TextPattern CMS 4.8.7 - Remote Command Execution (Authenticated)
Small CRM 3.0 – ‘Authentication Bypass’ SQL Injection
# Exploit Title: Small CRM 3.0 - 'Authentication Bypass' SQL Injection
Stock Management System 1.0 – ‘user_id’ Blind SQL injection (Authenticated)
# Exploit Title: Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)