WBCE 1.6.0 – Unauthenticated SQL injection
# Exploit Title: |Unauthenticated SQL injection in WBCE 1.6.0
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Moodle 3.10.1 – Authenticated Blind Time-Based SQL Injection – “sort” parameter
# Exploit Title: Moodle Authenticated Time-Based Blind SQL Injection - "sort" Parameter
PopojiCMS Version 2.0.1 – Remote Command Execution
# Exploit Title: PopojiCMS Version : 2.0.1 Remote Command Execution
WordPress Plugin Playlist for Youtube 1.32 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Wordpress Plugin Playlist for Youtube - Stored Cross-Site Scripting (XSS)
HTMLy Version v2.9.6 – Stored XSS
# Exploit Title: HTMLy Version v2.9.6 - Stored XSS
GUnet OpenEclass E-learning platform 3.15 – ‘certbadge.php’ Unrestricted File Upload
# Exploit Title: GUnet OpenEclass E-learning platform 3.15 - 'certbadge.php' Unrestricted File Upload
Open Source Medicine Ordering System v1.0 – SQLi
# Exploit Title : Open Source Medicine Ordering System v1.0 - SQLi
Daily Expense Manager 1.0 – ‘term’ SQLi
# Exploit Title: Daily Expense Manager 1.0 - 'term' SQLi
Best Student Result Management System v1.0 – Multiple SQLi
## Title: Best Student Result Management System v1.0 - Multiple SQLi
Human Resource Management System v1.0 – Multiple SQLi
## Title: Human Resource Management System v1.0 - Multiple SQLi
WordPress Theme Travelscape v1.0.3 – Arbitrary File Upload
# Exploit Title: Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload
WordPress Plugin Alemha Watermarker 1.3.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Wordpress Plugin Alemha Watermarker 1.3.1 - Stored Cross-Site Scripting (XSS)
Computer Laboratory Management System v1.0 – Multiple-SQLi
# Title: Computer Laboratory Management System v1.0 - Multiple-SQLi
Axigen < 10.5.7 - Persistent Cross-Site Scripting
# Exploit Title: Axigen < 10.5.7 - Persistent Cross-Site Scripting
Gibbon LMS v26.0.00 – SSTI vulnerability
# Exploit Title: Gibbon LMS v26.0.00 - SSTI vulnerability
WordPress Plugin – Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)
# Exploit Title: Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthentic...
Smart School 6.4.1 – SQL Injection
# Exploit Title: Smart School 6.4.1 - SQL Injection
CE Phoenix v1.0.8.20 – Remote Code Execution
## Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution (RCE) (Authenticated)
Elementor Website Builder < 3.12.2 - Admin+ SQLi
#EXPLOIT Elementor Website Builder < 3.12.2 - Admin+ SQLi
Blood Bank v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Blood Bank v1.0 Stored Cross Site Scripting (XSS)
Daily Habit Tracker 1.0 – Broken Access Control
# Exploit Title: Daily Habit Tracker 1.0 - Broken Access Control
Daily Habit Tracker 1.0 – SQL Injection
# Exploit Title: Daily Habit Tracker 1.0 - SQL Injection
Daily Habit Tracker 1.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)
Employee Management System 1.0 – `txtusername` and `txtpassword` SQL Injection (Admin Login)
# Exploit Title: Employee Management System 1.0 - `txtusername` and `txtpassword` SQL Injection (Admin Login)
Employee Management System 1.0 – `txtfullname` and `txtphone` SQL Injection
# Exploit Title: Employee Management System 1.0 - `txtfullname` and `txtphone` SQL Injection
LeptonCMS 7.0.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated)
FoF Pretty Mail 1.1.2 – Server Side Template Injection (SSTI)
Exploit Title: FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)
FoF Pretty Mail 1.1.2 – Local File Inclusion (LFI)
Exploit Title: FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)
Hospital Management System v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)
E-INSUARANCE v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS)
Petrol Pump Management Software v1.0 – Remote Code Execution (RCE)
# Exploit Title: Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
OpenCart Core 4.0.2.3 – ‘search’ SQLi
# Exploit Title: OpenCart Core 4.0.2.3 - 'search' SQLi
Online Hotel Booking In PHP 1.0 – Blind SQL Injection (Unauthenticated)
# Exploit Title: Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated)
Simple Backup Plugin Python Exploit 2.7.10 – Path Traversal
# Exploit Title: Simple Backup Plugin < 2.7.10 - Arbitrary File Download via Path Traversal
liveSite Version 2019.1 – Remote Code Execution
## Exploit Title: liveSite Version : 2019.1 Campaigns Remote Code Execution
Purei CMS 1.0 – SQL Injection
# Exploit Title: Purei CMS 1.0 - SQL Injection
Workout Journal App 1.0 – Stored XSS
# Exploit Title: Workout Journal App 1.0 - Stored XSS
LimeSurvey Community 5.3.32 – Stored XSS
# Exploit Title: Stored Cross-Site Scripting (XSS) in LimeSurvey Community
Wallos < 1.11.2 - File Upload RCE
# Exploit Title: Wallos - File Upload RCE (Authenticated)
Tourism Management System v2.0 – Arbitrary File Upload
# Exploit Title: Tourism Management System v2.0 - Arbitrary File Upload
MobileShop master v1.0 – SQL Injection Vuln.
+ Exploit Title: MobileShop master v1.0 - SQL Injection Vuln.
Insurance Management System PHP and MySQL 1.0 – Multiple Stored XSS
# Exploit Title:Insurance Management System PHP and MySQL 1.0 - Multiple
SPA-CART CMS – Stored XSS
# Exploit Title: SPA-CART CMS - Stored XSS
Craft CMS 4.4.14 – Unauthenticated Remote Code Execution
#!/usr/bin/env python3
CSZCMS v1.3.0 – SQL Injection (Authenticated)
# Title: CSZCMS v1.3.0 - SQL Injection (Authenticated)
Teacher Subject Allocation Management System 1.0 – ‘searchdata’ SQLi
# Exploit Title: Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
Simple Task List 1.0 – ‘status’ SQLi
# Exploit Title: Simple Task List 1.0 - 'status' SQLi
Blood Bank 1.0 – ‘bid’ SQLi
# Exploit Title: Blood Bank 1.0 - 'bid' SQLi
Employee Management System 1.0 – ‘admin_id’ SQLi
# Exploit Title: Employee Management System 1.0 - 'admin_id' SQLi
Quick.CMS 6.7 – SQL Injection Login Bypass
# Exploit Title: Quick.CMS 6.7 SQL Injection Login Bypass