Simple Food Ordering System v1.0 – Cross-Site Scripting (XSS)
# Exploit Title: Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Music Gallery Site v1.0 – SQL Injection on page Master.php
# Exploit Title: Music Gallery Site v1.0 - SQL Injection on page Master.php
Music Gallery Site v1.0 – SQL Injection on page view_music_details.php
# Exploit Title: Music Gallery Site v1.0 - SQL Injection on page view_music_details.php
Music Gallery Site v1.0 – Broken Access Control
# Exploit Title: Music Gallery Site v1.0 - Broken Access Control
Music Gallery Site v1.0 – SQL Injection on music_list.php
# Exploit Title: Music Gallery Site v1.0 - SQL Injection on music_list.php
Employee Task Management System v1.0 – SQL Injection on edit-task.php
# Exploit Title: Employee Task Management System v1.0 - SQL Injection on edit-task.php
Employee Task Management System v1.0 – SQL Injection on (task-details.php?task_id=?)
# Exploit Title: Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?)
Employee Task Management System v1.0 – Broken Authentication
# Exploit Title: Employee Task Management System v1.0 - Broken Authentication
Auto Dealer Management System v1.0 – SQL Injection on manage_user.php
# Exploit Title: Auto Dealer Management System v1.0 - SQL Injection on manage_user.php
Auto Dealer Management System v1.0 – SQL Injection in sell_vehicle.php
# Exploit Title: Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php
Auto Dealer Management System v1.0 – SQL Injection
# Exploit Title: Auto Dealer Management System v1.0 - SQL Injection
Auto Dealer Management System 1.0 – Broken Access Control Exploit
# Exploit Title: Auto Dealer Management System 1.0 - Broken Access Control Exploit
Best pos Management System v1.0 – Remote Code Execution (RCE) on File Upload
# Exploit Title: Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload
Best pos Management System v1.0 – SQL Injection
# Exploit Title: Best pos Management System v1.0 - SQL Injection
Kimai-1.30.10 – SameSite Cookie-Vulnerability session hijacking
## Exploit Title: Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking
POLR URL 2.3.0 – Shortener Admin Takeover
# Exploit Title: POLR URL 2.3.0 - Shortener Admin Takeover
modoboa 2.0.4 – Admin TakeOver
# Description: Authentication Bypass by Primary Weakness
LDAP Tool Box Self Service Password v1.5.2 – Account takeover
# Exploit Title: LDAP Tool Box Self Service Password v1.5.2 - Account takeover
Intern Record System v1.0 – SQL Injection (Unauthenticated)
# Exploit Title: Intern Record System v1.0 - SQL Injection (Unauthenticated)
Simple Task Managing System v1.0 – SQL Injection (Unauthenticated)
# Exploit Title: Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)
Art Gallery Management System Project in PHP v 1.0 – SQL injection
# Exploit Title: Art Gallery Management System Project in PHP v 1.0 - SQL injection
atrocore 1.5.25 User interaction – Unauthenticated File upload – RCE
## Exploit Title: atrocore 1.5.25 User interaction - Unauthenticated File upload - RCE
Dompdf 1.2.1 – Remote Code Execution (RCE)
#!/usr/bin/python3
Provide Server v.14.4 XSS – CSRF & Remote Code Execution (RCE)
# Exploit Title: Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE)
Froxlor 2.0.3 Stable – Remote Code Execution (RCE)
#!/usr/bin/python3
CKEditor 5 35.4.0 – Cross-Site Scripting (XSS)
# Exploit Title: CKEditor 5 35.4.0 - Cross-Site Scripting (XSS)
Answerdev 1.0.3 – Account Takeover
# Exploit Title: Answerdev 1.0.3 - Account Takeover
ERPNext 12.29 – Cross-Site Scripting (XSS)
# Exploit Title: ERPNext 12.29 - Cross-Site Scripting (XSS)
BTCPay Server v1.7.4 – HTML Injection
# Exploit Title: BTCPay Server v1.7.4 - HTML Injection
itech TrainSmart r1044 – SQL injection
# Exploit Title: itech TrainSmart r1044 - SQL injection
Responsive FileManager 9.9.5 – Remote Code Execution (RCE)
# Exploit Title: Responsive FileManager 9.9.5 - Remote Code Execution (RCE)
Control Web Panel 7 (CWP7) v0.9.8.1147 – Remote Code Execution (RCE)
// Exploit Title: Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE)
Online Eyewear Shop 1.0 – SQL Injection (Unauthenticated)
# Exploit Title: Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated)
bgERP v22.31 (Orlovets) – Cookie Session vulnerability & Cross-Site Scripting (XSS)
## Title: bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS)
Liferay Portal 6.2.5 – Insecure Permissions
# Exploit Title: Liferay Portal 6.2.5 - Insecure Permissions
Bus Pass Management System 1.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Bus Pass Management System 1.0 - Stored Cross-Site Scripting (XSS)
Calendar Event Multi View 1.4.07 – Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)
# Exploit Title: Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting...
zstore 6.6.0 – Cross-Site Scripting (XSS)
## Exploit Title: zstore 6.6.0 - Cross-Site Scripting (XSS)
projectSend r1605 – Remote Code Exectution RCE
Exploit Title: projectSend r1605 - Remote Code Exectution RCE
Secure Web Gateway 10.2.11 – Cross-Site Scripting (XSS)
Exploit Title: Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS)
PhotoShow 3.0 – Remote Code Execution
# Exploit Title: PhotoShow 3.0 - Remote Code Execution
Paid Memberships Pro v2.9.8 (WordPress Plugin) – Unauthenticated SQL Injection
#!/usr/bin/env python
GLPI Cartography Plugin v6.0.0 – Unauthenticated Remote Code Execution (RCE)
# Exploit Title: GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
GLPI v10.0.2 – SQL Injection (Authentication Depends on Configuration)
# ADVISORY INFORMATION
GLPI Activity v3.1.0 – Authenticated Local File Inclusion on Activity plugin
# Exploit Title: GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin
GLPI Glpiinventory v1.0.1 – Unauthenticated Local File Inclusion
# ADVISORY INFORMATION
GLPI 4.0.2 – Unauthenticated Local File Inclusion on Manageentities plugin
# ADVISORY INFORMATION
Roxy WI v6.1.1.0 – Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload
# ADVISORY INFORMATION
Roxy WI v6.1.0.0 – Unauthenticated Remote Code Execution (RCE)
# ADVISORY INFORMATION
Roxy WI v6.1.0.0 – Improper Authentication Control
# Exploit Title: Roxy WI v6.1.0.0 - Improper Authentication Control