LayerBB 1.1.4 – ‘search_query’ SQL Injection
# Exploit Title: LayerBB 1.1.4 - 'search_query' SQL Injection
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Batflat CMS 1.3.6 – ‘multiple’ Stored XSS
# Exploit Title: Batflat CMS 1.3.6 - 'multiple' Stored XSS
Beauty Parlour Management System 1.0 – ‘sername’ SQL Injection
# Exploit Title: Beauty Parlour Management System 1.0 - 'sername' SQL Injection
Online Exam System With Timer 1.0 – ’email’ SQL injection Auth Bypass
# Exploit Title: Online Exam System With Timer 1.0 - 'email' SQL injection Auth Bypass
Comment System 1.0 – ‘multiple’ Stored Cross-Site Scripting
# Exploit Title: Comment System 1.0 - 'multiple' Stored Cross-Site Scripting
PEEL Shopping 9.3.0 – ‘Comments’ Persistent Cross-Site Scripting
# Exploit Title: PEEL Shopping 9.3.0 - 'Comments/Special Instructions' Stored Cross-Site Scripting
Batflat CMS 1.3.6 – Remote Code Execution (Authenticated)
# Exploit Title: Batflat CMS 1.3.6 - Remote Code Execution (Authenticated)
Billing Management System 2.0 – ’email’ SQL injection Auth Bypass
# Exploit Title: Billing Management System 2.0 - 'email' SQL injection Auth Bypass
Faulty Evaluation System 1.0 – ‘multiple’ Stored Cross-Site Scripting
# Exploit Title: Faulty Evaluation System 1.0 - 'multiple' Stored Cross-Site Scripting
BlackCat CMS 1.3.6 – ‘Display name’ Cross Site Scripting (XSS)
# Exploit Title: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)
Online Internship Management System 1.0 – ’email’ SQL injection Auth Bypass
# Exploit Title: Online Internship Management System 1.0 - 'email' SQL injection Auth Bypass
Teachers Record Management System 1.0 – ‘searchteacher’ SQL Injection
# Exploit Title: Teachers Record Management System 1.0 - 'searchteacher' SQL Injection
TestLink 1.9.20 – Unrestricted File Upload (Authenticated)
# Exploit Title: TestLink 1.9.20 - Unrestricted File Upload (Authenticated)
School Event Attendance Monitoring System 1.0 – ‘Item Name’ Stored Cross-Site Scripting
# Exploit Title: School Event Attendance Monitoring System 1.0 - 'Item Name' Stored Cross-Site Scripting
School File Management System 1.0 – ‘multiple’ Stored Cross-Site Scripting
# Exploit Title: School File Management System 1.0 - 'multiple' Stored Cross-Site Scripting
Online Marriage Registration System (OMRS) 1.0 – Remote code execution (3)
# Exploit Title: Online Marriage Registration System (OMRS) 1.0 - Remote code execution (3)
b2evolution 6.11.6 – ‘tab3’ Reflected XSS
# Exploit Title: b2evolution 6.11.6 - 'tab3' Reflected XSS
b2evolution 6.11.6 – ‘redirect_to’ Open Redirect
# Exploit Title: b2evolution 6.11.6 - 'redirect_to' Open Redirect
PEEL Shopping 9.3.0 – ‘address’ Stored Cross-Site Scripting
# Exploit Title: PEEL Shopping 9.3.0 - 'address' Stored Cross-Site Scripting
b2evolution 6.11.6 – ‘plugin name’ Stored XSS
# Exploit Title: b2evolution 6.11.6 - 'plugin name' Stored XSS
Online Car Rental System 1.0 – Stored Cross Site Scripting
# Exploit Title: Online Car Rental System 1.0 - Stored Cross Site Scripting
WordPress Plugin Supsystic Backup 2.3.9 – Local File Inclusion
# Exploit Title: WordPress Plugin Supsystic Backup 2.3.9 - Local File Inclusion
WordPress Plugin Supsystic Contact Form 1.7.5 – Multiple Vulnerabilities
# Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.5 - Multiple Vulnerabilities
WordPress Plugin Supsystic Data Tables Generator 1.9.96 – Multiple Vulnerabilities
# Exploit Title: WordPress Plugin Supsystic Data Tables Generator 1.9.96 - Multiple Vulnerabilities
WordPress Plugin Supsystic Digital Publications 1.6.9 – Multiple Vulnerabilities
# Exploit Title: WordPress Plugin Supsystic Digital Publications 1.6.9 - Multiple Vulnerabilities
WordPress Plugin Supsystic Membership 1.4.7 – ‘sidx’ SQL injection
# Exploit Title: WordPress Plugin Supsystic Membership 1.4.7 - 'sidx' SQL injection
WordPress Plugin Supsystic Newsletter 1.5.5 – ‘sidx’ SQL injection
# Exploit Title: WordPress Plugin Supsystic Newsletter 1.5.5 - 'sidx' SQL injection
YetiShare File Hosting Script 5.1.0 – ‘url’ Server-Side Request Forgery
# Title: YetiShare File Hosting Script 5.1.0 - 'url' Server-Side Request Forgery
WordPress Plugin Supsystic Pricing Table 1.8.7 – Multiple Vulnerabilities
# Exploit Title: WordPress Plugin Supsystic Pricing Table 1.8.7 - Multiple Vulnerabilities
WordPress Plugin Supsystic Ultimate Maps 1.1.12 – ‘sidx’ SQL injection
# Exploit Title: WordPress Plugin Supsystic Ultimate Maps 1.1.12 - 'sidx' SQL injection
WordPress Plugin Welcart e-Commerce 2.0.0 – ‘search[order_column][0]’ SQL injection
# Exploit Title: WordPress Plugin Welcart e-Commerce 2.0.0 - 'search[order_column][0]' SQL injection
SEO Panel 4.6.0 – Remote Code Execution (2)
# Exploit Title: SEO Panel 4.6.0 - Remote Code Execution (2)
PhreeBooks 5.2.3 ERP – Remote Code Execution (2)
# Exploit Title: PhreeBooks 5.2.3 - Remote Code Execution
LiteSpeed Web Server Enterprise 5.4.11 – Command Injection (Authenticated)
# Exploit Title: LiteSpeed Web Server Enterprise 5.4.11 - Command Injection (Authenticated)
Car Rental Project 2.0 – Arbitrary File Upload to Remote Code Execution
# Exploit Title: Car Rental Project 2.0 - Arbitrary File Upload to Remote Code Execution
Student Record System 4.0 – ‘cid’ SQL Injection
# Exploit Title: Student Record System 4.0 - 'cid' SQL Injection
WordPress 5.0.0 – Image Remote Code Execution
# Exploit Title: WordPress 5.0.0 - Image Remote Code Execution
Klog Server 2.4.1 – Command Injection (Authenticated)
# Exploit Title: Klog Server 2.4.1 - Command Injection (Authenticated)
Roundcube Webmail 1.2 – File Disclosure
# Exploit Title: Roundcube Webmail 1.2 - File Disclosure
Vehicle Parking Tracker System 1.0 – ‘Owner Name’ Stored Cross-Site Scripting
# Exploit Title: Vehicle Parking Tracker System 1.0 - 'Owner Name' Stored Cross-Site Scripting
bloofoxCMS 0.5.2.1 – CSRF (Add user)
# Title: bloofoxCMS 0.5.2.1 - CSRF (Add user)
MyBB Thread Redirect Plugin 0.2.1 – Cross-Site Scripting
# Exploit Title: MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting
MyBB Trending Widget Plugin 1.2 – Cross-Site Scripting
# Exploit Title: MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting
Park Ticketing Management System 1.0 – ‘viewid’ SQL Injection
# Exploit Title: Park Ticketing Management System 1.0 - 'viewid' SQL Injection
User Management System 1.0 – ‘uid’ SQL Injection
# Exploit Title: User Management System 1.0 - 'uid' SQL Injection
Zoo Management System 1.0 – ‘anid’ SQL Injection
# Exploit Title: Zoo Management System 1.0 - 'anid' SQL Injection
MyBB Delete Account Plugin 1.4 – Cross-Site Scripting
# Exploit Title: MyBB Delete Account Plugin 1.4 - Cross-Site Scripting
Simple Public Chat Room 1.0 – ‘msg’ Stored Cross-Site Scripting
# Exploit Title: Simple Public Chat Room 1.0 - 'msg' Stored Cross-Site Scripting
Simple Public Chat Room 1.0 – Authentication Bypass SQLi
# Exploit Title: Simple Public Chat Room 1.0 - Authentication Bypass SQLi
MyBB Hide Thread Content Plugin 1.0 – Information Disclosure
# Exploit Title: MyBB Hide Thread Content Plugin 1.0 - Information Disclosure