php

ElkarBackup 1.3.3 – Persistent Cross-Site Scripting

# Exploit Title: ElkarBackup 1.3.3 - Persistent Cross-Site Scripting

Savsoft Quiz 5 – Stored Cross-Site Scripting

# Exploit Title: Savsoft Quiz 5 - Stored Cross-Site Scripting

Pharmacy Medical Store and Sale Point 1.0 – ‘catid’ SQL Injection

# Title: Pharmacy Medical Store and Sale Point 1.0 - 'catid' SQL Injection

Bludit 3.9.2 – Authentication Bruteforce Mitigation Bypass

#!/usr/bin/env ruby

GetSimple CMS Plugin Multi User 1.8.2 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: GetSimple CMS Plugin Multi User v1.8.2 - Cross-Site Request Forgery (Add Admin)

vBulletin 5.6.2 – ‘widget_tabbedContainer_tab_panel’ Remote Code Execution

# Exploit Title: vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution

CMS Made Simple 2.2.14 – Authenticated Arbitrary File Upload

# Exploit Title: CMS Made Simple 2.2.14 - Arbitrary File Upload (Authenticated)

Fuel CMS 1.4.7 – ‘col’ SQL Injection (Authenticated)

# Exploit Title: Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)

Warehouse Inventory System 1.0 – Cross-Site Request Forgery (Change Admin Password)

# Exploit Title: Warehouse Inventory System 1.0 - Cross-Site Request Forgery (Change Admin Password)

Daily Expenses Management System 1.0 – ‘item’ SQL Injection

# Exploit Title: Daily Expenses Management System 1.0 - 'item' SQL Injection

Victor CMS 1.0 – ‘Search’ SQL Injection

# Exploit Title: Victor CMS 1.0 - 'Search' SQL Injection

Stock Management System 1.0 – Authentication Bypass

# Exploit Title: Stock Management System 1.0 - Authentication Bypass

Daily Expenses Management System 1.0 – ‘username’ SQL Injection

# Exploit Title: Daily Expenses Management System 1.0 - 'username' SQL Injection

Online Shopping Alphaware 1.0 – Authentication Bypass

# Title: Online Shopping Alphaware 1.0 - Authentication Bypass

WordPress Plugin Maintenance Mode by SeedProd 5.1.1 – Persistent Cross-Site Scripting

# Exploit Title: Wordpress Plugin Maintenance Mode by SeedProd 5.1.1 - Persistent Cross-Site Scripting

eGroupWare 1.14 – ‘spellchecker.php’ Remote Command Execution

# Exploit Title: eGroupWare 1.14 - 'spellchecker.php' Remote Command Execution

Virtual Airlines Manager 2.6.2 – Persistent Cross-Site Scripting

# Exploit Title: Virtual Airlines Manager 2.6.2 - Persistent Cross-Site Scripting

pfSense 2.4.4-p3 – Cross-Site Request Forgery

# Exploit Title: pfSense 2.4.4-p3 - Cross-Site Request Forgery

Webtareas 2.1p – Arbitrary File Upload (Authenticated)

# Exploit Title: Webtareas 2.1p - Arbitrary File Upload (Authenticated)

PandoraFMS 7.0 NG 746 – Persistent Cross-Site Scripting

# Exploit Title: PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting

Koken CMS 0.22.24 – Arbitrary File Upload (Authenticated)

# Exploit Title: Koken CMS 0.22.24 - Arbitrary File Upload (Authenticated)

elaniin CMS – Authentication Bypass

# Exploit Title: elaniin CMS 1.0 - Authentication Bypass

Online Course Registration 1.0 – Unauthenticated Remote Code Execution

# Exploit Title: Online Course Registration 1.0 - Unauthenticated Remote Code Execution

LibreHealth 2.0.0 – Authenticated Remote Code Execution

# Exploit Title: LibreHealth 2.0.0 - Authenticated Remote Code Execution

PandoraFMS NG747 7.0 – ‘filename’ Persistent Cross-Site Scripting

# Exploit Title: PandoraFMS NG747 7.0 - 'filename' Persistent Cross-Site Scripting

WordPress Plugin Email Subscribers & Newsletters 4.2.2 – ‘hash’ SQL Injection (Unauthenticated)

# Exploit Title: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - 'hash' SQL Injection (Unauthenticated)

WordPress Plugin Email Subscribers & Newsletters 4.2.2 – Unauthenticated File Download

# Exploit Title: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download

GOautodial 4.0 – Persistent Cross-Site Scripting (Authenticated)

# Exploit Title: GOautodial 4.0 - Persistent Cross-Site Scripting (Authenticated)

TimeClock Software 1.01 0 – (Authenticated) Time-Based SQL Injection

#!/usr/bin/python3

WordPress Theme NexosReal Estate 1.7 – ‘search_order’ SQL Injection

# Exploit Title: WordPress Theme NexosReal Estate 1.7 - 'search_order' SQL Injection

CMSUno 1.6 – Cross-Site Request Forgery (Change Admin Password)

# Exploit Title: CMSUno 1.6 - Cross-Site Request Forgery (Change Admin Password)

Infor Storefront B2B 1.0 – ‘usr_name’ SQL Injection

# Exploit Title: Infor Storefront B2B 1.0 - 'usr_name' SQL Injection

Online Farm Management System 0.1.0 – Persistent Cross-Site Scripting

# Exploit Title: Online Farm Management System 0.1.0 - Persistent Cross-Site Scripting

Web Based Online Hotel Booking System 0.1.0 – Authentication Bypass

# Exploit Title: Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass

Online Polling System 1.0 – Authentication Bypass

# Exploit Title: Online Polling System 1.0 - Authentication Bypass

Joomla! J2 JOBS 1.3.0 – ‘sortby’ Authenticated SQL Injection

# Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection

Park Ticketing Management System 1.0 – Authentication Bypass

# Exploit Title: Park Ticketing Management System 1.0 - Authentication Bypass

Park Ticketing Management System 1.0 – ‘viewid’ SQL Injection

# Exploit Title: Park Ticketing Management System 1.0 - 'viewid' SQL Injection

Barangay Management System 1.0 – Authentication Bypass

# Exploit Title: Barangay Management System 1.0 - Authentication Bypass

Savsoft Quiz 5 – Persistent Cross-Site Scripting

# Exploit Title: Savsoft Quiz 5 - Persistent Cross-Site Scripting

WordPress Plugin Powie’s WHOIS Domain Check 0.9.31 – Persistent Cross-Site Scripting

# Exploit Title: Wordpress Plugin Powie's WHOIS Domain Check 0.9.31 - Persistent Cross-Site Scripting

PHP 7.4 FFI – ‘disable_functions’ Bypass

Joomla! J2 JOBS 1.3.0 – ‘sortby’ Authenticated SQL Injection

# Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection

Online Shopping Portal 3.1 – ’email’ SQL Injection

# Exploit Title: Online Shopping Portal 3.1 - 'email' SQL Injection

Nagios XI 5.6.12 – ‘export-rrd.php’ Remote Code Execution

# Exploit Title: Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution

RiteCMS 2.2.1 – Authenticated Remote Code Execution

# Exploit Title: RiteCMS 2.2.1 - Authenticated Remote Code Execution

File Management System 1.1 – Persistent Cross-Site Scripting

# Exploit Title: File Management System 1.1 - Persistent Cross-Site Scripting

ZenTao Pro 8.8.2 – Command Injection

# Exploit Title: ZenTao Pro 8.8.2 - Command Injection

Online Shopping Portal 3.1 – Authentication Bypass

# Exploit Title: Online Shopping Portal 3.1 - Authentication Bypass

PHP-Fusion 9.03.60 – PHP Object Injection

# Exploit Title: PHP-Fusion 9.03.60 - PHP Object Injection