osCommerce 2.3.4.1 – Remote Code Execution
# Exploit Title: osCommerce 2.3.4.1 Remote Code Execution
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
WordPress Plugin WP Security Audit Log 3.1.1 – Sensitive Information Disclosure
# Exploit Title: WP Security Audit Log Plugin, Sensitive Information Disclosure
Joomla! Component AcySMS 3.5.0 – CSV Macro Injection
# Exploit Title: Joomla! Component AcySMS 3.5.0 CSV Macro Injection
Joomla! Component Acymailing Starter 5.9.5 – CSV Macro Injection
# Exploit Title: Joomla! Component Acymailing Starter 5.9.5 CSV Macro
WordPress Plugin Contact Form 7 to Database Extension 2.10.32 – CSV Injection
# Exploit Title : Contact Form 7 to Database Extension Wordpress Plugin CSV Injection
WordPress Plugin Relevanssi 4.0.4 – Reflected Cross-Site Scripting
# Exploit Title : Relevanssi Wordpress Search Plugin Reflected Cross Site Scripting (XSS)
Open-AuditIT Professional 2.1 – Cross-Site Scripting
# Exploit Title: Open-AuditIT Professional 2.1 - Stored Cross site scripting (XSS)
Laravel Log Viewer < 0.13.0 - Local File Download
# Exploit Title: Laravel log viewer by rap2hpoutre local file download (LFD)
WordPress Plugin Site Editor 1.1.1 – Local File Inclusion
Product: Site Editor Wordpress Plugin - https://wordpress.org/plugins/site-editor/
MyBB Plugin Last User’s Threads in Profile Plugin 1.2 – Persistent Cross-Site Scripting
# Exploit Title: MyBB Last User's Threads in Profile Plugin v1.2 - Persistent XSS
XenForo 2 – CSS Loader Denial of Service
# Exploit Title: XenForo CSS Loader DoS
Vehicle Sales Management System – Multiple Vulnerabilities
# Exploit Title: VSMS Multiple Vulnerabilities
WordPress Plugin Duplicator 1.2.32 – Cross-Site Scripting
# Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting (XSS)
Tuleap 9.17.99.189 – Blind SQL Injection
===============================================================================
TextPattern 4.6.2 – ‘qty’ SQL Injection
=============================================
Bacula-Web < 8.0.0-rc2 - SQL Injection
# Exploit Title: Multiple SQL injection vulnerabilities in Bacula-Web
Redaxo CMS Addon MyEvents 2.2.1 – SQL Injection
# Exploit Title: Redaxo CMS Addon MyEvents SQL Injection [ Backend ]
ClipBucket < 4.0.0 - Release 4902 - Command Injection / File Upload / SQL Injection
SEC Consult Vulnerability Lab Security Advisory < 20180227-0 >
TestLink Open Source Test Management < 1.9.16 - Remote Code Execution
# Title: TestLink Open Source Test Management( comment out skip-networking as well as bind-address (if any present i...
uWSGI < 2.0.17 - Directory Traversal
# Exploit Title: uWSGI PHP Plugin Directory Traversal
Concrete5 CMS < 8.3.0 - Username / Comments Enumeration
#!/usr/bin/env python3
CMS Made Simple 2.1.6 – Remote Code Execution
# Exploit Title: CMS Made Simple 2.1.6 - Remote Code Execution
School Management Script 3.0.4 – Authentication Bypass
# Exploit Title: SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4.
MyBB My Arcade Plugin 1.3 – Cross-Site Scripting
# Exploit Title: MyBB My Arcade Plugin v1.3 - Persistent XSS
October CMS < 1.0.431 - Cross-Site Scripting
# Exploit Title: October CMS Stored Code Injection
PSNews Website 1.0.0 – ‘Keywords’ SQL Injection
# Exploit Title: PSNews Website (Same Backend with Mobile Apps) 1.0.0 - 'Keywords' SQL Injection
PHIMS – Hospital Management Information System – ‘Password’ SQL Injection
# Exploit Title: PHIMS - Hospital Management Information System - 'Password' SQL Injection