Student Management System 1.0 – ‘message’ Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting (Authenticated)
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Dental Clinic Appointment Reservation System 1.0 – ‘date’ UNION based SQL Injection (Authenticated)
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'date' UNION based SQL Injection (Authenticated)
Dental Clinic Appointment Reservation System 1.0 – Authentication Bypass (SQLi)
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass (SQLi)
Microweber CMS 1.1.20 – Remote Code Execution (Authenticated)
# Exploit Title: Microweber CMS 1.1.20 - Remote Code Execution (Authenticated)
Human Resource Information System 0.1 – ‘First Name’ Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: Human Resource Information System 0.1 - 'First Name' Persistent Cross-Site Scripting (Authenticated)
PHP Timeclock 1.04 – ‘Multiple’ Cross Site Scripting (XSS)
# Exploit Title: PHP Timeclock 1.04 - 'Multiple' Cross Site Scripting (XSS)
PHP Timeclock 1.04 – Time and Boolean Based Blind SQL Injection
# Exploit Title: PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection
Human Resource Information System 0.1 – Remote Code Execution (Unauthenticated)
# Exploit Title: Human Resource Information System 0.1 - Remote Code Execution (Unauthenticated)
Voting System 1.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Voting System 1.0 - Remote Code Execution (Unauthenticated)
Voting System 1.0 – Authentication Bypass (SQLI)
# Exploit Title: Voting System 1.0 - Authentication Bypass (SQLI)
b2evolution 7-2-2 – ‘cf_name’ SQL Injection
# Exploit Title: b2evolution 7-2-2 - 'cf_name' SQL Injection
WordPress Plugin WP Super Edit 2.5.4 – Remote File Upload
# Title: Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload
Savsoft Quiz 5 – ‘User Account Settings’ Persistent Cross-Site Scripting
# Exploit Title: Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting
Internship Portal Management System 1.0 – Remote Code Execution(Unauthenticated)
# Exploit Title: Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated)
Piwigo 11.3.0 – ‘language’ SQL
# Exploit Title: Piwigo 11.3.0 - 'language' SQL
Voting System 1.0 – Time based SQLI (Unauthenticated SQL injection)
# Exploit Title: Voting System 1.0 - Time based SQLI (Unauthenticated SQL injection)
GetSimple CMS Custom JS 0.1 – Cross-Site Request Forgery
# Exploit Title: GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE
Moodle 3.6.1 – Persistent Cross-Site Scripting (XSS)
# Exploit Title: Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)
FOGProject 1.5.9 – File Upload RCE (Authenticated)
# Exploit Title: FOGProject 1.5.9 - File Upload RCE (Authenticated)
Cacti 1.2.12 – ‘filter’ SQL Injection
# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution
Kirby CMS 3.5.3.1 – ‘file’ Cross-Site Scripting (XSS)
# Exploit Title: Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)
WordPress Plugin WPGraphQL 1.3.5 – Denial of Service
# Exploit Title: WordPress Plugin WPGraphQL 1.3.5 - Denial of Service
Montiorr 1.7.6m – Persistent Cross-Site Scripting
# Exploit Title: Montiorr 1.7.6m - Persistent Cross-Site Scripting
Kimai 1.14 – CSV Injection
# Exploit Title: Kimai 1.14 - CSV Injection
SEO Panel 4.8.0 – ‘order_col’ Blind SQL Injection (2)
# Exploit Title: SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (2)
GetSimple CMS My SMTP Contact Plugin 1.1.2 – Persistent Cross-Site Scripting
# Exploit Title: GetSimple CMS My SMTP Contact Plugin 1.1.2 - CSRF to Stored XSS to RCE
Moodle 3.10.3 – ‘url’ Persistent Cross Site Scripting
# Exploit Title: Moodle 3.10.3 - 'url' Persistent Cross Site Scripting
RemoteClinic 2.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: RemoteClinic 2.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
CMS Made Simple 2.2.15 – ‘title’ Cross-Site Scripting (XSS)
# Exploit Title: CMS Made Simple 2.2.15 - 'title' Cross-Site Scripting (XSS)
OpenEMR 5.0.2.1 – Remote Code Execution
# Exploit Title: OpenEMR 5.0.2.1 - Remote Code Execution
rconfig 3.9.6 – Arbitrary File Upload
# Exploit Title: rconfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (2)
RemoteClinic 2 – ‘Multiple’ Cross-Site Scripting (XSS)
# Exploit Title: RemoteClinic 2 - 'Multiple' Cross-Site Scripting (XSS)
BlackCat CMS 1.3.6 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS)
WordPress Plugin RSS for Yandex Turbo 1.29 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting (XSS)
Fast PHP Chat 1.3 – ‘my_item_search’ SQL Injection
# Exploit Title: Fast PHP Chat 1.3 - 'my_item_search' SQL Injection
GetSimple CMS My SMTP Contact Plugin 1.1.1 – Cross-Site Request Forgery
# Exploit Title: GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF to RCE
Digital Crime Report Management System 1.0 – SQL Injection (Authentication Bypass)
# Exploit Title: Digital Crime Report Management System 1.0 - SQL Injection (Authentication Bypass)
Simple Student Information System 1.0 – SQL Injection (Authentication Bypass)
# Exploit Title: Simple Student Information System 1.0 - SQL Injection (Authentication Bypass)
PrestaShop 1.7.6.7 – ‘location’ Blind Sql Injection
# Exploit Title: PrestaShop 1.7.6.7 - 'location' Blind Sql Injection
Composr 10.0.36 – Remote Code Execution
# Exploit Title: Composr 10.0.36 - Remote Code Execution
CMSimple 5.2 – ‘External’ Stored XSS
# Exploit Title: CMSimple 5.2 - 'External' Stored XSS
Composr CMS 10.0.36 – Cross Site Scripting
# Exploit Title: Composr CMS 10.0.36 - Cross Site Scripting
OpenEMR 4.1.0 – ‘u’ SQL Injection
# Exploit Title: OpenEMR 4.1.0 - 'u' SQL Injection
Basic Shopping Cart 1.0 – Authentication Bypass
# Exploit Title: Basic Shopping Cart 1.0 - Authentication Bypass
Simple Food Website 1.0 – Authentication Bypass
# Exploit Title: Simple Food Website 1.0 - Authentication Bypass
Zabbix 3.4.7 – Stored XSS
# Exploit Title: Zabbix 3.4.7 - Stored XSS
GetSimple CMS 3.3.16 – Persistent Cross-Site Scripting
# Exploit Title: GetSimple CMS 3.3.16 - Reflected XSS to RCE
Budget Management System 1.0 – ‘Budget title’ Stored XSS
# Exploit Title: Budget Management System 1.0 - 'Budget title' Stored XSS
Equipment Inventory System 1.0 – ‘multiple’ Stored XSS
# Exploit Title: Equipment Inventory System 1.0 - 'multiple' Stored XSS