Password Manager for IIS v2.0 – XSS
# Exploit Title: Password Manager for IIS v2.0 - XSS
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Bus Pass Management System 1.0 – Cross-Site Scripting (XSS)
# Exploit Title: Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)
GuppY CMS v6.00.10 – Remote Code Execution
# Exploit Title: GuppY CMS v6.00.10 - Remote Code Execution
Lavalite v9.0.0 – XSRF-TOKEN cookie File path traversal
## Exploit Title: Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal
Employee Performance Evaluation System v1.0 – File Inclusion and RCE
## Exploit Title: Employee Performance Evaluation System v1.0 - File Inclusion and RCE
Yoga Class Registration System v1.0 – Multiple SQLi
# Exploit Title: Yoga Class Registration System v1.0 - Multiple SQLi
Human Resources Management System v1.0 – Multiple SQLi
# Exploit Title: Human Resources Management System v1.0 - Multiple SQLi
Online Diagnostic Lab Management System v1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated)
Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection
# Exploit Title: Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection
NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
# Exploit Title: NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
“camp” Raspberry Pi camera server 1.0 – Authentication Bypass
# Exploit Title: "camp" Raspberry Pi camera server 1.0 - Authentication Bypass
Bitbucket v7.0.0 – RCE
# Exploit Title: Bitbucket v7.0.0 - RCE
wkhtmltopdf 0.12.6 – Server Side Request Forgery
# Exploit Title: wkhtmltopdf 0.12.6 - Server Side Request Forgery
WorkOrder CMS 0.1.0 – SQL Injection
# Exploit Title: WorkOrder CMS 0.1.0 - SQL Injection
MAN-EAM-0003 V3.2.4 – XXE
# Exploit Title: MAN-EAM-0003 V3.2.4 - XXE
Owlfiles File Manager 12.0.1 – Multiple Vulnerabilities
# Exploit Title: Owlfiles File Manager 12.0.1 - Multiple Vulnerabilities
Linksys AX3200 V1.1.00 – Command Injection
# Exploit Title: Linksys AX3200 V1.1.00 - Command Injection
VIAVIWEB Wallpaper Admin 1.0 – Multiple Vulnerabilities
# Exploit Title: VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities
pfBlockerNG 2.1.4_26 – Remote Code Execution (RCE)
# Exploit Title: pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)
CVAT 2.0 – Server Side Request Forgery
#Exploit Title: CVAT 2.0 - SSRF (Server Side Request Forgery)
Open Web Analytics 1.7.3 – Remote Code Execution
# Exploit Title: Open Web Analytics 1.7.3 - Remote Code Execution (RCE)
WordPress Plugin ImageMagick-Engine 1.7.4 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Wordpress Plugin ImageMagick-Engine 1.7.4 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Zephyr Project Manager 3.2.42 – Multiple SQLi
# Exploit Title: Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi
Testa 3.5.1 Online Test Management System – Reflected Cross-Site Scripting (XSS)
# Exploit Title: Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)
Aero CMS v0.0.1 – SQLi
# Title: Aero CMS v0.0.1 - SQLi
WordPress Plugin 3dady real-time web stats 1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)
WordPress Plugin WP-UserOnline 2.88.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)
Feehi CMS 2.1.1 – Remote Code Execution (Authenticated)
# Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)
TP-Link Tapo c200 1.1.15 – Remote Code Execution (RCE)
# Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
Bookwyrm v0.4.3 – Authentication Bypass
# Exploit Title: Bookwyrm v0.4.3 - Authentication Bypass
Buffalo TeraStation Network Attached Storage (NAS) 1.66 – Authentication Bypass
# Exploit Title: Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass
Gitea 1.16.6 – Remote Code Execution (RCE) (Metasploit)
# Exploit Title: Gitea Git Fetch Remote Code Execution
WordPress Plugin Netroics Blog Posts Grid 1.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Netroics Blog Posts Grid 1.0 - Stored Cross-Site Scripting (XSS)
WordPress Plugin Testimonial Slider and Showcase 2.2.6 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Testimonial Slider and Showcase 2.2.6 - Stored Cross-Site Scripting (XSS)
Sophos XG115w Firewall 17.0.10 MR-10 – Authentication Bypass
# Exploit Title: Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass
ThingsBoard 3.3.1 ‘description’ – Stored Cross-Site Scripting (XSS)
# Exploit Title: ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)
ThingsBoard 3.3.1 ‘name’ – Stored Cross-Site Scripting (XSS)
# Exploit Title: ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)
Feehi CMS 2.1.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
Prestashop blockwishlist module 2.1.0 – SQLi
# Exploit Title: Prestashop blockwishlist module 2.1.0 - SQLi
Webmin 1.996 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)
NanoCMS v0.4 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: NanoCMS v0.4 - Remote Code Execution (RCE) (Authenticated)
mPDF 7.0 – Local File Inclusion
# Exploit Title: mPDF 7.0 - Local File Inclusion
CuteEditor for PHP 6.6 – Directory Traversal
# Exploit Title: CuteEditor for PHP 6.6 - Directory Traversal
WordPress Plugin Duplicator 1.4.7 – Information Disclosure
# Exploit Title: WordPress Plugin Duplicator 1.4.7 - Information Disclosure
WordPress Plugin Duplicator 1.4.6 – Unauthenticated Backup Download
# Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
Wavlink WN530HG4 – Password Disclosure
# Exploit Title: Wavlink WN530HG4 - Password Disclosure
Wavlink WN533A8 – Password Disclosure
# Exploit Title: Wavlink WN533A8 - Password Disclosure
Wavlink WN533A8 – Cross-Site Scripting (XSS)
# Exploit Title: Wavlink WN533A8 - Cross-Site Scripting (XSS)
WordPress Plugin WP-UserOnline 2.87.6 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
Carel pCOWeb HVAC BACnet Gateway 2.1.0 – Directory Traversal
# Exploit Title: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal