LFCMS 3.7.0 – Cross-Site Request Forgery (Add User)
# Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: users can be added arbitrarily.
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Joomla! Component Jomres 9.11.2 – Cross-Site Request Forgery (Add User)
# Exploit Title: Joomla!Component jomres 9.11.2 - Cross site request forgery
Dimofinf CMS 3.0.0 – Cross-Site Scripting
# Title: Dimofinf CMS 3.0.0 - Cross-Site Scripting
OEcms 3.1 – Cross-Site Scripting
# Title: OEcms 3.1 - Cross-Site Scripting
Joomla! Component Ek Rishta 2.10 – SQL Injection
# Title: SQL Injection Joomla Component Ek rishta 2.10 - SQL Injection
Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload
# Exploit Title: Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload
MACCMS 10 – Cross-Site Request Forgery (Add User)
# Exploit Title: MACCMS_V10 CSRF vulnerability add admin account
WordPress Plugin Ultimate Form Builder Lite < 1.3.7 - SQL Injection
# Title: WordPress Ultimate Form Builder Lite Plugin < 1.3.7 - SQL Injection
WordPress Plugin Google Map < 4.0.4 - SQL Injection
# Title: WordPress Google Map Plugin < 4.0.4 - SQL Injection
Canon PrintMe EFI – Cross-Site Scripting
# Title: Canon PrintMe EFI - Cross-Site Scripting
Joomla! Component EkRishta 2.10 – ‘username’ SQL Injection
# Exploit Title: Joomla! Component EkRishta 2.10 - 'username' SQL Injection
Schools Alert Management Script – Arbitrary File Read
# Exploit Title: Schools Alert Management Script - Arbitrary File Read
Schools Alert Management Script – ‘get_sec.php’ SQL Injection
# Exploit Title: Schools Alert Management Script - 'get_sec.php' SQL Injection
userSpice 4.3.24 – Username Enumeration
# Exploit Title: userSpice 4.3.24 - Username Enumeration
userSpice 4.3.24 – ‘X-Forwarded-For’ Cross-Site Scripting
# Exploit Title: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting
Schools Alert Management Script – Arbitrary File Deletion
# Exploit Title: Schools Alert Management Script - Arbitrary File Deletion
Event Manager Admin panel – ‘events_new.php’ SQL injection
# Exploit Title: Event Manager PHP Script Admin panel - 'events_new.php' SQL injection
WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection
# Title: WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection
Schools Alert Management Script – SQL Injection
# Exploit Title: Schools Alert Management Script - SQL Injection
Monstra CMS < 3.0.4 - Cross-Site Scripting (1)
# Title: Monstra CMS < 3.0.4 - Cross-Site Scripting
WordPress Plugin Contact Form Maker 1.12.20 – SQL Injection
# Title: WordPress Contact Form Maker Plugin 1.12.20 - SQL Injection
WordPress Plugin Form Maker 1.12.24 – SQL Injection
# Title: WordPress Form Maker Plugin 1.12.24 - SQL Injection
WampServer 3.0.6 – Cross-Site Request Forgery
# Exploit Title: WampServer 3.0.6 - Cross-Site Request Forgery
Pagekit < 1.0.13 - Cross-Site Scripting Code Generator
# Title: Pagekit < 1.0.13 - Cross-Site Scripting Code Generator
MyBB Recent Threads Plugin 1.0 – Cross-Site Scripting
# Exploit Title: MyBB Recent Threads Plugin v1.0 - Cross-Site Scripting
GreenCMS 2.3.0603 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability add admin
GreenCMS 2.3.0603 – Cross-Site Request Forgery / Remote Code Execution
# Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability get webshell
Smartshop 1 – Cross-Site Request Forgery
# Exploit Title: Smartshop 1 - Cross site request forgery
Smartshop 1 – ‘id’ SQL Injection
# Exploit Title: Smartshop 1 - SQL Injection
Grid Pro Big Data 1.0 – SQL Injection
# Exploit Title: Grid Pro Big Data 1.0 - 'test.php' SQL Injection
CSV Import & Export 1.1.0 – SQL Injection / Cross-Site Scripting
# Exploit Title: CSV Import & Export v1.1.0 - SQL Injection / Cross-Site
PHP Dashboards NEW 5.5 – ’email’ SQL Injection
# Exploit Title: PHP Dashboards NEW v5.5 - 'Login' SQL Injection
New STAR 2.1 – SQL Injection / Cross-Site Scripting
# Exploit Title: New STAR 2.1 - SQL Injection / Cross-Site Scripting
Dolibarr ERP/CRM 7.0.0 – (Authenticated) SQL Injection
# [CVE-2018-10094] Dolibarr SQL Injection vulnerability
MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass
Vendor: Appnitro
Facebook Clone Script 1.0.5 – Cross-Site Request Forgery
# Exploit Title: Facebook Clone Script 1.0.5 - Cross-Site Request Forgery
Facebook Clone Script 1.0.5 – ‘search’ SQL Injection
# Exploit Title: Facebook Clone Script 1.0.5 - 'search' SQL Injection
MyBB ChangUonDyU Plugin 1.0.2 – Cross-Site Scripting
# Exploit Title: MyBB ChangUonDyU Advanced Statistics Plugin v1.0.2 - Cross-Site Scripting
wityCMS 0.6.1 – Cross-Site Scripting
# Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field
Joomla! Component JoomOCShop 1.0 – Cross-Site Request Forgery
# Exploit Title: Joomla! extension JoomOCShop 1.0 - Cross site request forgery
Joomla! Component jCart for OpenCart 2.3.0.2 – Cross-Site Request Forgery
# Exploit Title: Joomla! extension jCart for OpenCart 2.3.0.2 - Cross site request forgery
Joomla! Component Full Social 1.1.0 – ‘search_query’ SQL Injection
# Exploit Title: Joomla! extension Full Social 1.1.0 - 'search_query' SQL
WordPress Plugin Events Calendar – SQL Injection
# Exploit Title: Wordpress Plugin Events Calendar - SQL Injection
DomainMod 4.09.03 – ‘sslpaid’ Cross-Site Scripting
# Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter
DomainMod 4.09.03 – ‘oid’ Cross-Site Scripting
# Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter
Baby Names Search Engine 1.0 – ‘a’ SQL Injection
# Exploit Title: Baby Names Search Engine v1.0 - 'a' SQL Injection
My Directory 2.0 – SQL Injection / Cross-Site Scripting
# Exploit Title: My Directory 2.0 - SQL Injection / Cross-Site Scripting