webapps

e107 v2.3.2 – Reflected XSS

# Exploit Title: e107 v2.3.2 - Reflected XSS

PnPSCADA v2.x – Unauthenticated PostgreSQL Injection

# Exploit Title: PnPSCADA v2.x - Unauthenticated PostgreSQL Injection

Apache Superset 2.0.0 – Authentication Bypass

# Exploit Title: Apache Superset 2.0.0 - Authentication Bypass

Cameleon CMS 2.7.4 – Persistent Stored XSS in Post Title

# Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4

WordPress Plugin Backup Migration 1.2.8 – Unauthenticated Database Backup

# Exploit Title: WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup

TinyWebGallery v2.5 – Remote Code Execution (RCE)

#Exploit Title: TinyWebGallery v2.5 - Remote Code Execution (RCE)

TinyWebGallery v2.5 – Stored Cross-Site Scripting (XSS)

#Exploit Title: TinyWebGallery v2.5 - Stored Cross-Site Scripting (XSS)

Job Portal 1.0 – File Upload Restriction Bypass

Online Clinic Management System 2.2 – Multiple Stored Cross-Site Scripting (XSS)

# Exploit Title: Online Clinic Management System 2.2 - Multiple Stored Cross-Site Scripting (XSS)

RockMongo 1.1.7 – Stored Cross-Site Scripting (XSS)

# Exploit Title: RockMongo 1.1.7 - Stored Cross-Site Scripting (XSS)

File Thingie 2.5.7 – Remote Code Execution (RCE)

#!/usr/bin/python

Ulicms-2023.1 sniffing-vicuna – Stored Cross-Site Scripting (XSS)

#Exploit Title: Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)

Ulicms-2023.1 sniffing-vicuna – Remote Code Execution (RCE)

#Exploit Title: Ulicms-2023.1 sniffing-vicuna - Remote Code Execution (RCE)

Ulicms-2023.1-sniffing-vicuna – Privilege escalation

#Exploit Title: Ulicms 2023.1 sniffing-vicuna - Privilege escalation

Online Pizza Ordering System v1.0 – Unauthenticated File Upload

# Exploit Title: Online Pizza Ordering System 1.0 - Unauthenticated File Upload

EasyPHP Webserver 14.1 – Multiple Vulnerabilities (RCE and Path Traversal)

# Exploit Title: EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and

Jedox 2022.4.2 – Disclosure of Database Credentials via Connection Checks

# Exploit Title: Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks

Jedox 2020.2.5 – Disclosure of Database Credentials via Improper Access Controls

# Exploit Title: Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls

Jedox 2020.2.5 – Remote Code Execution via Executable Groovy-Scripts

# Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts

Jedox 2020.2.5 – Remote Code Execution via Configurable Storage Path

# Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path

Jedox 2020.2.5 – Stored Cross-Site Scripting in Log-Module

# Exploit Title: Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module

Jedox 2022.4.2 – Remote Code Execution via Directory Traversal

# Exploit Title: Jedox 2022.4.2 - Remote Code Execution via Directory Traversal

Jedox 2022.4.2 – Code Execution via RPC Interfaces

# Exploit Title: Jedox 2022.4.2 - Code Execution via RPC Interfaces

Cmaps v8.0 – SQL injection

# Exploit Title: Cmaps v8.0 - SQL injection

Wolf CMS 0.8.3.1 – Remote Code Execution (RCE)

# Exploit Title: Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)

pluck v4.7.18 – Stored Cross-Site Scripting (XSS)

Exploit Title: pluck v4.7.18 - Stored Cross-Site Scripting (XSS)

KodExplorer v4.51.03 – Pwned-Admin File-Inclusion – Remote Code Execution (RCE)

## Title: KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE)

GLPI 9.5.7 – Username Enumeration

# Exploit Title: GLPI 9.5.7 - Username Enumeration

Companymaps v8.0 – Stored Cross Site Scripting (XSS)

# Exploit Title: Companymaps V8.0 - Stored Cross Site Scripting (XSS)

PHPJabbers Simple CMS 5.0 – SQL Injection

# Exploit Title: PHPJabbers Simple CMS 5.0 - SQL Injection

PHPJabbers Simple CMS V5.0 – Stored Cross-Site Scripting (XSS)

# Exploit Title: PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)

OpenEMR v7.0.1 – Authentication credentials brute force

# Exploit Title: OpenEMR v7.0.1 - Authentication credentials brute force

PHPFusion 9.10.30 – Stored Cross-Site Scripting (XSS)

Exploit Title: PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS)

SoftExpert (SE) Suite v2.1.3 – Local File Inclusion

# Exploit Title: SoftExpert (SE) Suite v2.1.3 - Local File Inclusion

Serendipity 2.4.0 – File Inclusion RCE

## Exploit Title: Serendipity 2.4.0 - File Inclusion RCE

admidio v4.2.5 – CSV Injection

Exploit Title: admidio v4.2.5 - CSV Injection

revive-adserver v5.4.1 – Cross-Site Scripting (XSS)

Exploit Title: revive-adserver v5.4.1 - Cross-Site Scripting (XSS)

projectSend r1605 – Private file download

Exploit Title: projectSend r1605 - Private file download

phpMyFAQ v3.1.12 – CSV Injection

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection

PHP Restaurants 1.0 – SQLi Authentication Bypass & Cross Site Scripting

# Exploit Title: PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting (XSS)

Sophos Web Appliance 4.3.10.4 – Pre-auth command injection

#!/bin/bash

Multi-Vendor Online Groceries Management System 1.0 – Remote Code Execution

# Exploit Title: Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution (RCE)

Mars Stealer 8.3 – Admin Account Takeover

# Exploit Title: Mars Stealer 8.3 - Admin Account Takeover

PaperCut NG/MG 22.0.4 – Authentication Bypass

# Exploit Title: PaperCut NG/MG 22.0.4 - Authentication Bypass

KodExplorer 4.49 – CSRF to Arbitrary File Upload

# Exploit Title: KodExplorer

ProjeQtOr Project Management System 10.3.2 – Remote Code Execution (RCE)

Exploit Title: ProjeQtOr Project Management System 10.3.2 -Remote Code Execution (RCE)

Piwigo 13.6.0 – Stored Cross-Site Scripting (XSS)

Exploit Title: Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)

FUXA V.1.1.13-1186 – Unauthenticated Remote Code Execution (RCE)

# Exploit Title: FUXA V.1.1.13-1186- Unauthenticated Remote Code Execution (RCE)

Chitor-CMS v1.1.2 – Pre-Auth SQL Injection

#!/usr/bin/python3

GDidees CMS 3.9.1 – Local File Disclosure

# Exploit Title: GDidees CMS 3.9.1 - Local File Disclosure