webapps

Monstra 3.0.4 – Stored Cross-Site Scripting (XSS)

# Exploit Title: Monstra 3.0.4 - Stored Cross-Site Scripting (XSS)

projectSend r1605 – Stored XSS

Exploit Title: projectSend r1605 - Stored XSS

projectSend r1605 – CSV injection

Exploit Title: projectSend r1605 - CSV injection

Sales Tracker Management System v1.0 – Multiple Vulnerabilities

Exploit Title: Sales Tracker Management System v1.0 – Multiple Vulnerabilities

Teachers Record Management System 1.0 – File Upload Type Validation

Exploit Title: Teachers Record Management System 1.0 – File Upload Type Validation

Online Examination System Project 1.0 – Cross-site request forgery (CSRF)

# Exploit Title: Online Examination System Project 1.0 - Cross-site request forgery (CSRF)

WordPress Theme Workreap 2.2.2 – Unauthenticated Upload Leading to Remote Code Execution

# Exploit Title: WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

Thruk Monitoring Web Interface 3.06 – Path Traversal

# Exploit Title: Thruk Monitoring Web Interface 3.06 - Path Traversal

Tree Page View Plugin 1.6.7 – Cross Site Scripting (XSS)

# Exploit Title: Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)

File Manager Advanced Shortcode 2.3.2 – Unauthenticated Remote Code Execution (RCE)

# Exploit Title: File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)

MotoCMS Version 3.4.3 – SQL Injection

# Title: MotoCMS Version 3.4.3 - SQL Injection

STARFACE 7.3.0.10 – Authentication with Password Hash Possible

Exploit Title: STARFACE 7.3.0.10 - Authentication with Password Hash Possible

Barebones CMS v2.0.2 – Stored Cross-Site Scripting (XSS) (Authenticated)

# Exploit Title: Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)

Enrollment System Project v1.0 – SQL Injection Authentication Bypass (SQLI)

# Exploit Title: Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)

Total CMS 1.7.4 – Remote Code Execution (RCE)

# Exploit Title: Total CMS 1.7.4 - Remote Code Execution (RCE)

MotoCMS Version 3.4.3 – Server-Side Template Injection (SSTI)

# Title: MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)

Pydio Cells 4.1.2 – Server-Side Request Forgery

Exploit Title: Pydio Cells 4.1.2 - Server-Side Request Forgery

Pydio Cells 4.1.2 – Cross-Site Scripting (XSS) via File Download

Exploit Title: Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download

Pydio Cells 4.1.2 – Unauthorised Role Assignments

Exploit Title: Pydio Cells 4.1.2 - Unauthorised Role Assignments

Faculty Evaluation System 1.0 – Unauthenticated File Upload

# Exploit Title: Faculty Evaluation System 1.0 - Unauthenticated File Upload

Online Security Guards Hiring System 1.0 – Reflected XSS

#Exploit Title: Online Security Guards Hiring System 1.0 – REFLECTED XSS

unilogies/bumsys v1.0.3 beta – Unrestricted File Upload

Exploit Title: - unilogies/bumsys v1.0.3-beta - Unrestricted File Upload

SCRMS 2023-05-27 1.0 – Multiple SQL Injection

## Exploit Title: SCRMS 2023-05-27 1.0 - Multiple SQLi

Rukovoditel 3.3.1 – CSV injection

Exploit Title: Rukovoditel 3.3.1 - CSV injection

Camaleon CMS v2.7.0 – Server-Side Template Injection (SSTI)

Exploit Title: Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)

SCM Manager 1.60 – Cross-Site Scripting Stored (Authenticated)

#!/usr/bin/python3

Ulicms 2023.1 – create admin user via mass assignment

#Exploit Title: Ulicms 2023.1 - create admin user via mass assignment

Zenphoto 1.6 – Multiple stored XSS

Exploit Title: Zenphoto 1.6 - Multiple stored XSS

WBCE CMS 1.6.1 – Multiple Stored Cross-Site Scripting (XSS)

Exploit Title: WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)

Service Provider Management System v1.0 – SQL Injection

# Exploit Title: Service Provider Management System v1.0 - SQL Injection

FusionInvoice 2023-1.0 – Stored XSS (Cross-Site Scripting)

# Exploit Title: FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)

CiviCRM 5.59.alpha1 – Stored XSS (Cross-Site Scripting)

# Exploit Title: CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)

ChurchCRM v4.5.4 – Reflected XSS via Image (Authenticated)

# Exploit Title: ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)

Bludit CMS v3.14.1 – Stored Cross-Site Scripting (XSS) (Authenticated)

# Exploit Title: Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)

GetSimple CMS v3.3.16 – Remote Code Execution (RCE)

# Exploit Title: GetSimple CMS v3.3.16 - Remote Code Execution (RCE)

Quicklancer v1.0 – SQL Injection

# Exploit Title: Quicklancer v1.0 - SQL Injection

Stackposts Social Marketing Tool v1.0 – SQL Injection

# Exploit Title: Stackposts Social Marketing Tool v1.0 - SQL Injection

Smart School v1.0 – SQL Injection

# Exploit Title: Smart School v1.0 - SQL Injection

LeadPro CRM v1.0 – SQL Injection

# Exploit Title: LeadPro CRM v1.0 - SQL Injection

Affiliate Me Version 5.0.1 – SQL Injection

[#] Exploit Title: Affiliate Me Version 5.0.1 - SQL Injection

eScan Management Console 14.0.1400.2281 – Cross Site Scripting

# Exploit Title: eScan Management Console 14.0.1400.2281 - Cross Site Scripting

eScan Management Console 14.0.1400.2281 – SQL Injection (Authenticated)

# Exploit Title: eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)

Webkul Qloapps 1.5.2 – Cross-Site Scripting (XSS)

# Exploit Title: Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)

SitemagicCMS 4.4.3 – Remote Code Execution (RCE)

#Exploit Title: SitemagicCMS 4.4.3 Remote Code Execution (RCE)

Prestashop 8.0.4 – CSV injection

Exploit Title: Prestashop 8.0.4 - CSV injection

Best POS Management System v1.0 – Unauthenticated Remote Code Execution

# Exploit Title: Best POS Management System v1.0 - Unauthenticated Remote Code Execution

PodcastGenerator 3.2.9 – Multiple Stored Cross-Site Scripting (XSS)

#Exploit Title: PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS)

PaperCut NG/MG 22.0.4 – Remote Code Execution (RCE)

# Exploit Title: PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)

WBiz Desk 1.2 – SQL Injection

[#] Exploit Title: WBiz Desk 1.2 - SQL Injection

thrsrossi Millhouse-Project 1.414 – Remote Code Execution