Quick.CMS 6.7 – Remote Code Execution (Authenticated)
# Exploit Title: Quick.CMS 6.7 - Remote Code Execution (Authenticated)
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Online Grading System 1.0 – ‘uname’ SQL Injection
# Exploit Title: Online Grading System 1.0 - 'uname' SQL Injection
BloofoxCMS 0.5.2.1 – ‘text’ Stored Cross Site Scripting
# Title: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting
WordPress Plugin SuperForms 4.9 – Arbitrary File Upload
# Exploit Title: WordPress Plugin SuperForms 4.9 - Arbitrary File Upload to Remote Code Execution
Fuel CMS 1.4.1 – Remote Code Execution (2)
# Title: Fuel CMS 1.4.1 - Remote Code Execution (2)
OpenEMR 5.0.1 – Remote Code Execution (Authenticated) (2)
# Title: OpenEMR 5.0.1 - Remote Code Execution (Authenticated) (2)
CMSUno 1.6.2 – ‘lang’ Remote Code Execution (Authenticated)
# Exploit Title: CMSUno 1.6.2 - 'lang/user' Remote Code Execution (Authenticated)
EgavilanMedia PHPCRUD 1.0 – ‘Full Name’ Stored Cross Site Scripting
# Exploit Title: EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting
Simple College Website 1.0 – ‘full’ Stored Cross Site Scripting
# Exploit Title: Simple College Website 1.0 - 'full' Stored Cross Site Scripting
Simple College Website 1.0 – ‘name’ Sql Injection (Authentication Bypass)
# Exploit Title: Simple College Website 1.0 - 'name' Sql Injection (Authentication Bypass)
Cemetry Mapping and Information System 1.0 – ‘user_email’ Sql Injection (Authentication Bypass)
# Exploit Title: Cemetry Mapping and Information System 1.0 - 'user_email' Sql Injection (Authentication Bypass)
Library System 1.0 – ‘category’ SQL Injection
# Exploit Title: Library System 1.0 - 'category' SQL Injection
CASAP Automated Enrollment System 1.0 – ‘route’ Stored XSS
# Exploit Title: CASAP Automated Enrollment System 1.0 - 'route' Stored XSS
CASAP Automated Enrollment System 1.0 – ‘First Name’ Stored XSS
# Exploit Title: CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS
Collabtive 3.1 – ‘address’ Persistent Cross-Site Scripting
# Exploit Title: Collabtive 3.1 - 'address' Persistent Cross-Site Scripting
MyBB Timeline Plugin 1.0 – Persistent Cross-Site Scripting
# Exploit Title: MyBB Timeline Plugin 1.0 - Cross-Site Scripting / CSRF
CASAP Automated Enrollment System 1.0 – Authentication Bypass
# Exploit Title: CASAP Automated Enrollment System 1.0 - Authentication Bypass
Library System 1.0 – Authentication Bypass
# Exploit Title: Library System 1.0 - Authentication Bypass Via SQL Injection
Nagios XI 5.7.5 – Multiple Persistent Cross-Site Scripting
# Exploit Title: Nagios XI 5.7.5 - Multiple Persistent Cross-Site Scripting
Apartment Visitors Management System 1.0 – ’email’ SQL Injection
# Exploit Title: Apartment Visitors Management System 1.0 - 'email' SQL Injection
Online Documents Sharing Platform 1.0 – ‘user’ SQL Injection
# Exploit Title: Online Documents Sharing Platform 1.0 - 'user' SQL Injection
Voting System 1.0 – File Upload RCE (Authenticated Remote Code Execution)
# Exploit Title: Voting System 1.0 - File Upload RCE (Authenticated Remote Code Execution)
osTicket 1.14.2 – SSRF
# Exploit Title: osTicket 1.14.2 - SSRF
Life Insurance Management System 1.0 – File Upload RCE (Authenticated)
# Exploit Title: Life Insurance Management System 1.0 - File Upload RCE (Authenticated)
Life Insurance Management System 1.0 – ‘client_id’ SQL Injection
# Exploit Title: Life Insurance Management System 1.0 - 'client_id' SQL Injection
E-Learning System 1.0 – Authentication Bypass
# Exploit Title: E-Learning System 1.0 - Authentication Bypass & RCE
Alumni Management System 1.0 – “Last Name field in Registration page” Stored XSS
# Exploit Title: Alumni Management System 1.0 - "Last Name field in Registration page" Stored XSS
Online Hotel Reservation System 1.0 – ‘person’ time-based SQL Injection
# Exploit Title: Online Hotel Reservation System 1.0 - 'person' time-based SQL Injection
Online Hotel Reservation System 1.0 – Cross-site request forgery (CSRF)
# Exploit Title: Online Hotel Reservation System 1.0 - Cross-site request forgery (CSRF)
Online Hotel Reservation System 1.0 – ‘id’ Time-based SQL Injection
# Exploit Title: Online Hotel Reservation System 1.0 - 'id' Time-based SQL Injection
Online Hotel Reservation System 1.0 – ‘description’ Stored Cross-site Scripting
# Exploit Title: Online Hotel Reservation System 1.0 - Stored Cross-site Scripting
WordPress Plugin Easy Contact Form 1.1.7 – ‘Name’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting (XSS)
PHP-Fusion CMS 9.03.90 – Cross-Site Request Forgery (Delete admin shoutbox message)
# Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
Laravel 8.4.2 debug mode – Remote code execution
# Exploit Title: Laravel 8.4.2 debug mode - Remote code execution
Online Shopping Cart System 1.0 – ‘id’ SQL Injection
# Exploit Title: Online Shopping Cart System 1.0 - 'id' SQL Injection
Nagios XI 5.7.X – Remote Code Execution RCE (Authenticated)
# Exploit Title: Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)
Online Movie Streaming 1.0 – Admin Authentication Bypass
# Exploit Title: Online Movie Streaming 1.0 - Admin Authentication Bypass
Online Hotel Reservation System 1.0 – Admin Authentication Bypass
# Exploit Title: Online Hotel Reservation System 1.0 - Admin Authentication Bypass
Cemetry Mapping and Information System 1.0 – Multiple SQL Injections
# Exploit Title: Cemetry Mapping and Information System 1.0 - Multiple SQL Injections
Gila CMS 2.0.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Gila CMS 2.0.0 - Remote Code Execution (Unauthenticated)
Prestashop 1.7.7.0 – ‘id_product’ Time Based Blind SQL Injection
# Exploit Title: Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection
OpenCart 3.0.36 – ATO via Cross Site Request Forgery
# Exploit Title: OpenCart 3.0.36 - ATO via Cross Site Request Forgery
WordPress Plugin Custom Global Variables 1.0.5 – ‘name’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Custom Global Variables 1.0.5 - 'name' Stored Cross-Site Scripting (XSS)
Cemetry Mapping and Information System 1.0 – Multiple Stored Cross-Site Scripting
# Exploit Title: Cemetry Mapping and Information System 1.0 - Multiple Stored Cross-Site Scripting
Online Doctor Appointment System 1.0 – ‘Multiple’ Stored XSS
# Exploit Title: Online Doctor Appointment System 1.0 - 'Multiple' Stored XSS
Life Insurance Management System 1.0 – Multiple Stored XSS
# Exploit Title: Life Insurance Management System 1.0 - Multiple Stored XSS