COVID19 Testing Management System 1.0 – ‘State’ Stored Cross-Site-Scripting (XSS)
# Exploit Title: COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
GLPI 9.4.5 – Remote Code Execution (RCE)
# Exploit Title: GLPI 9.4.5 - Remote Code Execution (RCE)
WoWonder Social Network Platform 3.1 – Authentication Bypass
# Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass
Zenario CMS 8.8.52729 – ‘cID’ SQL injection (Authenticated)
# Exploit Title: Zenario CMS 8.8.52729 - 'cID' Blind & Error based SQL injection (Authenticated)
WordPress Plugin Database Backups 1.2.2.6 – ‘Database Backup Download’ CSRF
# Exploit Title: WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
OpenEMR 5.0.0 – Remote Code Execution (Authenticated)
# Exploit Title: OpenEMR 5.0.0 - Remote Code Execution (Authenticated)
TextPattern CMS 4.8.7 – Stored Cross-Site Scripting (XSS)
# Exploit Title: TextPattern CMS 4.8.7 - Stored Cross-Site Scripting (XSS)
Student Result Management System 1.0 – ‘class’ SQL Injection
# Exploit Title: Student Result Management System 1.0 - 'class' SQL Injection
GravCMS 1.10.7 – Arbitrary YAML Write/Update (Unauthenticated) (2)
# Exploit Title: GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
WordPress Plugin visitors-app 0.3 – ‘user-agent’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin visitors-app 0.3 - 'user-agent' Stored Cross-Site Scripting (XSS)
OpenCart 3.0.3.6 – ‘subject’ Stored Cross-Site Scripting
# Exploit Title: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting
OpenCart 3.0.3.7 – ‘Change Password’ Cross-Site Request Forgery (CSRF)
# Exploit Title : OpenCart 3.0.3.7 - 'Change Password' Cross-Site Request Forgery (CSRF)
WordPress Plugin wpDiscuz 7.0.4 – Remote Code Execution (Unauthenticated)
# Exploit Title: WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)
WordPress Plugin wpDiscuz 7.0.4 – Arbitrary File Upload (Unauthenticated)
# Exploit Title: Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
Grav CMS 1.7.10 – Server-Side Template Injection (SSTI) (Authenticated)
# Title: Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)
WordPress Plugin Smart Slider-3 3.5.0.8 – ‘name’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Smart Slider-3 3.5.0.8 - 'name' Stored Cross-Site Scripting (XSS)
Monstra CMS 3.0.4 – Remote Code Execution (Authenticated)
# Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)
4Images 1.8 – ‘redirect’ Reflected XSS
# Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS
FUDForum 3.1.0 – ‘author’ Reflected XSS
# Exploit Title: FUDForum 3.1.0 - 'author' Reflected XSS
FUDForum 3.1.0 – ‘srch’ Reflected XSS
# Exploit Title: FUDForum 3.1.0 - 'srch' Reflected XSS
Seo Panel 4.8.0 – ‘from_time’ Reflected XSS
# Exploit Title: Seo Panel 4.8.0 - 'from_time' Reflected XSS
PHP 8.1.0-dev – ‘User-Agentt’ Remote Code Execution
# Exploit Title: PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution
Seo Panel 4.8.0 – ‘category’ Reflected XSS
# Exploit Title: Seo Panel 4.8.0 - 'category' Reflected XSS
Seo Panel 4.8.0 – ‘search_name’ Reflected XSS
# Exploit Title: Seo Panel 4.8.0 - 'search_name' Reflected XSS
GetSimple CMS 3.3.4 – Information Disclosure
# Exploit Title: GetSimple CMS 3.3.4 - Information Disclosure
WordPress Plugin WP Prayer version 1.6.1 – ‘prayer_messages’ Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: WordPress Plugin WP Prayer version 1.6.1 - 'prayer_messages' Stored Cross-Site Scripting (XSS) (Auth...
ProjeQtOr Project Management 9.1.4 – Remote Code Execution
# Exploit Title: ProjeQtOr Project Management 9.1.4 - Remote Code Execution
Trixbox 2.8.0.4 – ‘lang’ Path Traversal
# Exploit Title: Trixbox 2.8.0.4 - 'lang' Path Traversal
Trixbox 2.8.0.4 – ‘lang’ Remote Code Execution (Unauthenticated)
# Exploit Title: Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
WordPress Plugin LifterLMS 4.21.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS)
PHPFusion 9.03.50 – Remote Code Execution
# Exploit Title: PHPFusion 9.03.50 - Remote Code Execution
Pluck CMS 4.7.13 – File Upload Remote Code Execution (Authenticated)
# Exploit Title: Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)
WordPress Plugin Cookie Law Bar 1.2.1 – ‘clb_bar_msg’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)
Gadget Works Online Ordering System 1.0 – ‘Category’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS)
WordPress Plugin ReDi Restaurant Reservation 21.0307 – ‘Comment’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)
WordPress Plugin WP Statistics 13.0.7 – Time-Based Blind SQL Injection (Unauthenticated)
# Exploit Title: WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated)
COVID19 Testing Management System 1.0 – ‘Admin name’ Cross-Site Scripting (XSS)
# Exploit Title: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)
COVID19 Testing Management System 1.0 – SQL Injection (Auth Bypass)
# Exploit Title: COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)
WordPress Plugin Stop Spammers 2021.8 – ‘log’ Reflected Cross-site Scripting (XSS)
# Exploit Title: WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)
EgavilanMedia PHPCRUD 1.0 – ‘First Name’ SQL Injection
# Exploit Title: EgavilanMedia PHPCRUD 1.0 - 'First Name' SQL Injection
Printable Staff ID Card Creator System 1.0 – ’email’ SQL Injection
# Exploit Title: Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload
Subrion CMS 4.2.1 – Arbitrary File Upload
# Exploit Title: Subrion CMS 4.2.1 - File Upload Bypass to RCE (Authenticated)
Advanced Guestbook 2.4.4 – ‘Smilies’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)
Billing Management System 2.0 – Union based SQL injection (Authenticated)
# Exploit Title: Billing Management System 2.0 - Union based SQL injection (Authenticated)
Simple Chatbot Application 1.0 – ‘Category’ Stored Cross site Scripting
# Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting
Dental Clinic Appointment Reservation System 1.0 – Cross Site Request Forgery (Add Admin)
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Cross Site Request Forgery (Add Admin)
Dental Clinic Appointment Reservation System 1.0 – ‘Firstname’ Persistent Cross Site Scripting (Authenticated)
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'Firstname' Persistent Cross Site Scripting (Auth...
Customer Relationship Management (CRM) System 1.0 – ‘Category’ Persistent Cross site Scripting
# Exploit Title: Customer Relationship Management (CRM) System 1.0 - 'Category' Persistent Cross site Scripting
Chamilo LMS 1.11.14 – Remote Code Execution (Authenticated)
# Exploit Title: Chamilo LMS 1.11.14 - Remote Code Execution (Authenticated)
Podcast Generator 3.1 – ‘Long Description’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Podcast Generator 3.1 - 'Long Description' Persistent Cross-Site Scripting (XSS)