Icinga Web 2.10 – Authenticated Remote Code Execution
#!/usr/bin/env python3
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Ateme TITAN File 3.9 – SSRF File Enumeration
#Exploit Title: Ateme TITAN File 3.9 - SSRF File Enumeration
BuildaGate5library v5 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)
Frappe Framework (ERPNext) 13.4.0 – Remote Code Execution (Authenticated)
# Exploit Title: Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)
Spring Cloud 3.2.2 – Remote Command Execution (RCE)
# Exploit Title: Spring Cloud 3.2.2 - Remote Command Execution (RCE)
Netlify CMS 2.10.192 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
Faculty Evaluation System v1.0 – SQL Injection
# Exploit Title: Faculty Evaluation System v1.0 - SQL Injection
Piwigo v13.7.0 – Stored Cross-Site Scripting (XSS) (Authenticated)
#Exploit Title: Piwigo v13.7.0 - Stored Cross-Site Scripting (XSS) (Authenticated)
Lost and Found Information System v1.0 – SQL Injection
# Exploit Title: Lost and Found Information System v1.0 - SQL Injection
Gila CMS 1.10.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Gila CMS 1.10.9 - Remote Code Execution (RCE) (Authenticated)
Beauty Salon Management System v1.0 – SQLi
# Exploit Title: Beauty Salon Management System v1.0 - SQLi
Car Rental Script 1.8 – Stored Cross-site scripting (XSS)
# Exploit Title: Car Rental Script 1.8 - Stored Cross-site scripting (XSS)
WBCE CMS 1.6.1 – Open Redirect & CSRF
Exploit Title: WBCE CMS 1.6.1 - Open Redirect & CSRF
PodcastGenerator 3.2.9 – Blind SSRF via XML Injection
#Exploit Title: PodcastGenerator 3.2.9 - Blind SSRF via XML Injection
Alkacon OpenCMS 15.0 – Multiple Cross-Site Scripting (XSS)
# Exploit Title: Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)
Prestashop 8.0.4 – Cross-Site Scripting (XSS)
Exploit Title: Prestashop 8.0.4 - Cross-Site Scripting (XSS)
Vacation Rental 1.8 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS)
WP AutoComplete 1.0.4 – Unauthenticated SQLi
# Exploit Title: WP AutoComplete 1.0.4 - Unauthenticated SQLi
GZ Forum Script 1.8 – Stored Cross-Site Scripting (XSS)
# Exploit Title: GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)
Time Slot Booking Calendar 1.8 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Time Slot Booking Calendar 1.8 - Stored XSS
spip v4.1.10 – Spoofing Admin account
## Exploit Title: spip v4.1.10 - Spoofing Admin account
D-Link DAP-1325 – Broken Access Control
# Exploit Title: D-Link DAP-1325 - Broken Access Control
WebsiteBaker v2.13.3 – Directory Traversal
Exploit Title: WebsiteBaker v2.13.3 - Directory Traversal
WebsiteBaker v2.13.3 – Stored XSS
Exploit Title: WebsiteBaker v2.13.3 - Stored XSS
POS Codekop v2.0 – Authenticated Remote Code Execution (RCE)
# Exploit Title: POS Codekop v2.0 - Authenticated Remote Code Execution (RCE)
FuguHub 8.1 – Remote Code Execution
# Exploit Title: FuguHub 8.1 - Remote Code Execution
Sales of Cashier Goods v1.0 – Cross Site Scripting (XSS)
# Exploit Title: Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS)
Rukovoditel 3.4.1 – Multiple Stored XSS
Exploit Title: Rukovoditel 3.4.1 - Multiple Stored XSS
Xenforo Version 2.2.13 – Authenticated Stored XSS
# Exploit Title: Xenforo Version 2.2.13 - Authenticated Stored XSS
PrestaShop Winbiz Payment module – Improper Limitation of a Pathname to a Restricted Directory
# Exploit Title: PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory
Microsoft SharePoint Enterprise Server 2016 – Spoofing
// Exploit Title: Microsoft SharePoint Enterprise Server 2016 - Spoofing
MCL-Net 4.3.5.8788 – Information Disclosure
# Exploit Title: MCL-Net 4.3.5.8788 - Information Disclosure
Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)
# -*- coding: utf-8 -*-
Smart Office Web 20.28 – Remote Information Disclosure (Unauthenticated)
# Exploit Title: Smart Office Web 20.28 - Remote Information Disclosure (Unauthenticated)
HiSecOS 04.0.01 – Privilege Escalation
# Exploit Title: HiSecOS 04.0.01 - Privilege Escalation
SPIP v4.2.0 – Remote Code Execution (Unauthenticated)
#!/usr/bin/env python3
Super Socializer 7.13.52 – Reflected XSS
# Exploit Title: Super Socializer 7.13.52 - Reflected XSS
WP Sticky Social 1.0.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS)
# Exploit Title: WP Sticky Social 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS)
WordPress Theme Medic v1.0.0 – Weak Password Recovery Mechanism for Forgotten Password
# Exploit Title: WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password
Symantec SiteMinder WebAgent v12.52 – Cross-site scripting (XSS)
Exploit Title: Symantec SiteMinder WebAgent v12.52 - Cross-site scripting (XSS)
Diafan CMS 6.0 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: Diafan CMS 6.0 - Reflected Cross-Site Scripting (XSS)
Student Study Center Management System v1.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)
Jobpilot v2.61 – SQL Injection
# Exploit Title: Jobpilot v2.61 - SQL Injection
Groomify v1.0 – SQL Injection
# Exploit Title: Groomify v1.0 - SQL Injection
The Shop v2.5 – SQL Injection
# Exploit Title: The Shop v2.5 - SQL Injection
Online Art gallery project 1.0 – Arbitrary File Upload (Unauthenticated)
# Exploit Title: Online Art gallery project 1.0 - Arbitrary File Upload (Unauthenticated)
PyLoad 0.5.0 – Pre-auth Remote Code Execution (RCE)
# Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
Textpattern CMS v4.8.8 – Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
Online Thesis Archiving System v1.0 – Multiple-SQLi
## Exploit Title: Online Thesis Archiving System v1.0 - Multiple-SQLi
Xoops CMS 2.5.10 – Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated)