Boa Web Server v0.94.14 – Authentication Bypass
# Exploit Title: Boa Web Server v0.94.14 - Authentication Bypass
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
myBB forums 1.8.26 – Stored Cross-Site Scripting (XSS)
# Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)
ClicShopping v3.402 – Cross-Site Scripting (XSS)
## Title: ClicShopping v3.402 - Cross-Site Scripting (XSS)
Dreamer CMS v4.0.0 – SQL Injection
# Exploit Title: Dreamer CMS v4.0.0 - SQL Injection
Revenue Collection System v1.0 – Remote Code Execution (RCE)
# Exploit Title: Revenue Collection System v1.0 - Remote Code Execution (RCE)
Helmet Store Showroom v1.0 – SQL Injection
# Exploit Title: Helmet Store Showroom v1.0 - SQL Injection
Uniview NVR301-04S2-P4 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: Uniview NVR301-04S2-P4 - Reflected Cross-Site Scripting (XSS)
Human Resource Management System 1.0 – SQL Injection (unauthenticated)
# Exploit Title: Human Resource Management System - SQL Injection (unauthenticated)
Book Store Management System 1.0.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Book Store Management System 1.0.0 - Stored Cross-Site Scripting (XSS)
WP All Import v3.6.7 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated)
rukovoditel 3.2.1 – Cross-Site Scripting (XSS)
## Title: rukovoditel 3.2.1 - Cross-Site Scripting (XSS)
Senayan Library Management System v9.5.0 – SQL Injection
## Title: Senayan Library Management System v9.5.0 - SQL Injection
iBooking v1.0.8 – Arbitrary File Upload
# Exploit Title: iBooking v1.0.8 - Arbitrary File Upload
ReQlogic v11.3 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)
Social-Share-Buttons v2.2.3 – SQL Injection
## Title: Social-Share-Buttons v2.2.3 - SQL Injection
Moodle LMS 4.0 – Cross-Site Scripting (XSS)
# Exploit Title: Moodle LMS 4.0 - Cross-Site Scripting (XSS)
OPSWAT Metadefender Core – Privilege Escalation
# Exploit Title: OPSWAT Metadefender Core - Privilege Escalation
ZKTeco ZEM/ZMM 8.88 – Missing Authentication
# Exploit Title: ZKTeco ZEM/ZMM 8.88 - Missing Authentication
Subrion CMS 4.2.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS)
Label Studio 1.5.0 – Authenticated Server Side Request Forgery (SSRF)
# Exploit Title: Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF)
BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)
# Exploit Title: BoxBilling
Jetpack 11.4 – Cross Site Scripting (XSS)
# Exploit Title: Jetpack 11.4 - Cross Site Scripting (XSS)
Online shopping system advanced 1.0 – Multiple Vulnerabilities
# Exploit Title: Online shopping system advanced 1.0 - Multiple
YouPHPTube<= 7.8 - Multiple Vulnerabilities
# Exploit Title: YouPHPTube
Pega Platform 8.1.0 – Remote Code Execution (RCE)
# Exploit Title: Pega Platform 8.1.0 - Remote Code Execution (RCE)
Beauty-salon v1.0 – Remote Code Execution (RCE)
## Exploit Title: Beauty-salon v1.0 - Remote Code Execution (RCE)
FortiOS, FortiProxy, FortiSwitchManager v7.2.1 – Authentication Bypass
# Exploit Title: Fortinet Authentication Bypass v7.2.1 - (FortiOS, FortiProxy, FortiSwitchManager)
WebTareas 2.4 – RCE (Authorized)
# Exploit Title: WebTareas 2.4 - RCE (Authorized)
WebTareas 2.4 – Reflected XSS (Unauthorised)
# Exploit Title: WebTareas 2.4 - Reflected XSS (Unauthorised)
WebTareas 2.4 – SQL Injection (Unauthorised)
# Exploit Title: WebTareas 2.4 - SQL Injection (Unauthorised)
Atom CMS v2.0 – SQL Injection (no auth)
# Exploit Title: Atom CMS v2.0 - SQL Injection (no auth)
Aero CMS v0.0.1 – PHP Code Injection (auth)
# Exploit Title: Aero CMS v0.0.1 - PHP Code Injection (auth)
Aero CMS v0.0.1 – SQL Injection (no auth)
# Exploit Title: Aero CMS v0.0.1 - SQL Injection (no auth)
Desktop Central 9.1.0 – Multiple Vulnerabilities
# Exploit Title: Desktop Central 9.1.0 - Multiple Vulnerabilities
WPN-XM Serverstack for Windows 0.8.6 – Multiple Vulnerabilities
# Exploit Title: WPN-XM Serverstack for Windows 0.8.6 - Multiple Vulnerabilities
Webgrind 1.1 – Reflected Cross-Site Scripting (XSS) & Remote Command Execution (RCE)
# Exploit Title: Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) & Remote Command Execution (RCE)
Grafana <=6.2.4 - HTML Injection
# Exploit Title: Grafana
Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass
# Exploit Title: Zoneminder v1.36.26 - Log Injection -> CSRF Bypass -> Stored Cross-Site Scripting (XSS)
Clansphere CMS 2011.4 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Clansphere CMS 2011.4 - Stored Cross-Site Scripting (XSS)
Zentao Project Management System 17.0 – Authenticated Remote Code Execution (RCE)
# Exploit Title: Zentao Project Management System 17.0 - Authenticated Remote Code Execution (RCE)
FlatCore CMS 2.1.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: FlatCore CMS 2.1.1 -Stored Cross Site Scripting
eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)
# Exploit Title: eXtplorerpython eXtplorer_auth_bypass.py -t https://target.com
Canteen-Management v1.0 – SQL Injection
## Exploit Title: Canteen-Management v1.0 - SQL Injection
Canteen-Management v1.0 – XSS-Reflected
## Exploit Title: Canteen-Management v1.0 - XSS-Reflected
PHPGurukul Online Birth Certificate System V 1.2 – Blind XSS
Exploit Title: PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS
Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution
# Exploit Title: Composr-CMS Version Commandr
MODX Revolution v2.8.3-pl – Authenticated Remote Code Execution
# Exploit Title: MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution
Abantecart v1.3.2 – Authenticated Remote Code Execution
# Exploit Title: Abantecart v1.3.2 - Authenticated Remote Code Execution
SimpleMachinesForum v2.1.1 – Authenticated Remote Code Execution
# Exploit Title: SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution
ImpressCMS v1.4.3 – Authenticated SQL Injection
# Exploit Title: Authenticated Sql Injection in ImpressCMS v1.4.3