xbtitFM 4.1.18 – Multiple Vulnerabilities
# Exploit Title: xbtitFM 4.1.18 Multiple Vulnerabilities
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Backdrop CMS 1.23.0 – Stored XSS
# Exploit Title: Backdrop CMS 1.23.0 - Stored Cross-Site Scripting - Post Body Field
Gibbon LMS < v26.0.00 - Authenticated RCE
# Exploit Title: Gibbon LMS has a PHP Deserialization vulnerability on the v26.0.00 version
TYPO3 11.5.24 – Path Traversal (Authenticated)
# Exploit Title: TYPO3 11.5.24 Path Traversal Vulnerability (Authenticated)
WEBIGniter v28.7.23 – Stored XSS
## Title: WEBIGniter v28.7.23 XSS
WordPress File Upload Plugin < 4.23.3 - Stored XSS
Exploit Title: WordPress File Upload < 4.23.3 Stored XSS (CVE 2023-4811)
UPS Network Management Card 4 – Path Traversal
# Exploit Title: UPS Network Management Card 4 - Path Traversal
Winter CMS 1.2.3 – Server-Side Template Injection (SSTI) (Authenticated)
# Exploit Title: Winter CMS 1.2.2 - Server-Side Template Injection (SSTI) (Authenticated)
Client Details System 1.0 – SQL Injection
+ **Exploit Title:** CVE-2023-7137_Client_Details_System-SQL_Injection_1
Human Resource Management System 1.0 – ’employeeid’ SQL Injection
# Exploit Title: Human Resource Management System - SQL Injection
WordPress Plugin Duplicator < 1.5.7.1 - Unauthenticated Sensitive Data Exposure to Account Takeover
# Exploit Title: WordPress Plugin Duplicator < 1.5.7.1 -
Hide My WP < 6.2.9 - Unauthenticated SQLi
# Exploit Title: Wordpress Plugin Hide My WP < 6.2.9 - Unauthenticated SQLi
Akaunting < 3.1.3 - RCE
# Exploit Title: Akaunting < 3.1.3 - RCE
DataCube3 v1.0 – Unrestricted file upload ‘RCE’
# Exploit Title: DataCube3 v1.0 - Unrestricted file upload 'RCE'
elFinder Web file manager Version – 2.1.53 Remote Command Execution
# Exploit Title: elFinder Web file manager Version: 2.1.53 Remote Command Execution
CSZ CMS Version 1.3.0 – Authenticated Remote Command Execution
# Exploit Title: CSZ CMS Version 1.3.0 Remote Command Execution
CVE-2023-50071 – Multiple SQL Injection
# Exploit Title: Customer Support System 1.0 - Multiple SQL injection
Lot Reservation Management System – Unauthenticated File Disclosure
# Exploit Title: Lot Reservation Management System Unauthenticated File Disclosure Vulnerability
Lot Reservation Management System – Unauthenticated File Upload and Remote Code Execution
# Exploit Title: Lot Reservation Management System Unauthenticated File Upload and Remote Code Execution
kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition
# Exploit Title: kk Star Ratings < 5.4.6 - Rating Tampering via Race
Neontext WordPress Plugin – Stored XSS
# Exploit Title: Wordpress Plugin Neon Text
Boss Mini 1.4.0 – local file inclusion
# Exploit Title: Boss Mini 1.4.0 - local file inclusion
Enrollment System v1.0 – SQL Injection
# Exploit Title: Enrollment System v1.0 - SQL Injection
AC Repair and Services System v1.0 – Multiple SQL Injection
# Exploit Title: AC Repair and Services System v1.0 - Multiple SQL Injection
Simple Student Attendance System v1.0 – ‘classid’ Time Based Blind & Union Based SQL Injection
# Exploit Title: Simple Student Attendance System v1.0 - 'classid' Time Based Blind & Union Based SQL Injection
Simple Student Attendance System v1.0 – Time Based Blind SQL Injection
# Exploit Title: Simple Student Attendance System - Time Based Blind SQL Injection
Real Estate Management System v1.0 – Remote Code Execution via File Upload
# Exploit Title: Real Estate Management System v1.0 - Remote Code Execution via File Upload
Petrol Pump Management Software v1.0 – Remote Code Execution via File Upload
# Exploit Title: Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload
Petrol Pump Management Software v.1.0 – SQL Injection
# Exploit Title: Petrol Pump Management Software v.1.0 - SQL Injection
Petrol Pump Management Software v.1.0 – Stored Cross Site Scripting via SVG file
# Exploit Title: Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file
Petrol Pump Management Software v1.0 – ‘Address’ Stored Cross Site Scripting
# Exploit Title: Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting
WP Fastest Cache 1.2.2 – Unauthenticated SQL Injection
# Exploit Title: Unauthenticated SQL Injection in WP Fastest Cache 1.2.2
Blood Bank v1.0 – Multiple SQL Injection
# Exploit Title: Blood Bank v1.0 SQL Injection Vulnerability
WordPress Plugin Admin Bar & Dashboard Access Control Version: 1.2.8 – “Dashboard Redirect” field Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Admin Bar & Dashboard Access Control Version: 1.2.8 - "Dashboard Redirect" field ...
WP Rocket < 2.10.3 - Local File Inclusion (LFI)
Paulos Yibelo discovered and reported this Local File Inclusion vulnerability in WordPress WP Rocket Plugin. This cou...
WordPress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)
# Exploit Title: Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)
Automatic-Systems SOC FL9600 FastLine – The device contains hardcoded login and password for super admin
# Exploit Title: Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super a...
Automatic-Systems SOC FL9600 FastLine – Directory Transversal
# Exploit Title: Automatic-Systems SOC FL9600 FastLine - Directory Transversal
SuperStoreFinder – Multiple Vulnerabilities
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Moodle 4.3 – Insecure Direct Object Reference
# Exploit Title: Moodle 4.3 'id' Insecure Direct Object Reference (IDOR)
Zoo Management System 1.0 – Unauthenticated RCE
# Exploit Title: Zoo Management System 1.0 - Unauthenticated RCE
dawa-pharma 1.0-2022 – Multiple-SQLi
## Title: dawa-pharma-1.0-2022 Multiple-SQLi
FAQ Management System v1.0 – ‘faq’ SQL Injection
# Exploit Title: FAQ Management System v1.0 - 'faq' SQL Injection
Flashcard Quiz App v1.0 – ‘card’ SQL Injection
# Exploit Title: Flashcard Quiz App v1.0 - 'card' SQL Injection
Online Shopping System Advanced – Sql Injection
# Exploit Title: Online Shopping System Advanced
taskhub 2.8.7 – SQL Injection
# Exploit Title: taskhub 2.8.7 - SQL Injection
comments-like-dislike < 1.2.0 - Authenticated (Subscriber+) Plugin Setting Reset
# Exploit Title: POC-CVE-2023-3244
Simple Inventory Management System v1.0 – ’email’ SQL Injection
# Exploit Title: Simple Inventory Management System v1.0 - 'email' SQL Injection
WEBIGniter v28.7.23 – Stored Cross Site Scripting (XSS)
# Exploit Title: WEBIGniter v28.7.23 Stored Cross Site Scripting (XSS)