Dingtian-DT-R002 3.1.276A – Authentication Bypass
# Exploit Title: Dingtian-DT-R002 3.1.276A - Authentication Bypass
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Geonetwork 4.2.0 – XML External Entity (XXE)
# Exploit Title: Geonetwork 4.2.0 - XML External Entity (XXE)
WordPress Plugin Visual Slide Box Builder 3.2.9 – SQLi
# Title: WordPress Plugin Visual Slide Box Builder 3.2.9 - SQLi
OctoBot WebInterface 0.4.3 – Remote Code Execution (RCE)
# Exploit Title: OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)
CodoForum v5.1 – Remote Code Execution (RCE)
# Exploit Title: CodoForum v5.1 - Remote Code Execution (RCE)
Magnolia CMS 6.2.19 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
Mailhog 1.0.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS)
WSO2 Management Console (Multiple Products) – Unauthenticated Reflected Cross-Site Scripting (XSS)
# Exploit Title: WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)
WordPress Plugin Weblizar 8.9 – Backdoor
# Exploit Title: WordPress Plugin Weblizar 8.9 - Backdoor
SolarView Compact 6.00 – ‘pow’ Cross-Site Scripting (XSS)
# Exploit Title: SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)
SolarView Compact 6.00 – ‘time_begin’ Cross-Site Scripting (XSS)
# Exploit Title: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS)
Old Age Home Management System 1.0 – SQLi Authentication Bypass
# Exploit Title: Old Age Home Management System 1.0 - SQLi Authentication Bypass
ChurchCRM 4.4.5 – SQLi
# Exploit Title: ChurchCRM 4.4.5 - SQLi
phpIPAM 1.4.5 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated)
Pandora FMS v7.0NG.742 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
Avantune Genialcloud ProJ 10 – Cross-Site Scripting (XSS)
# Exploit Title: Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)
Confluence Data Center 7.18.0 – Remote Code Execution (RCE)
# Exploit Title: Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
WordPress Plugin Motopress Hotel Booking Lite 4.2.4 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting (XSS)
Microweber CMS 1.2.15 – Account Takeover
# Exploit Title: Microweber CMS 1.2.15 - Account Takeover
Contao 4.13.2 – Cross-Site Scripting (XSS)
# Exploit Title: Contao 4.13.2 - Cross-Site Scripting (XSS)
qdPM 9.1 – Remote Code Execution (RCE) (Authenticated) (v2)
# Exploit Title: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)
m1k1o’s Blog v.10 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)
OpenCart v3.x Newsletter Module – Blind SQLi
# Exploit Title: OpenCart v3.x Newsletter Module - Blind SQLi
Showdoc 2.10.3 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
T-Soft E-Commerce 4 – SQLi (Authenticated)
# Exploit Title: T-Soft E-Commerce 4 - SQLi (Authenticated)
T-Soft E-Commerce 4 – ‘UrunAdi’ Stored Cross-Site Scripting (XSS)
# Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
Survey Sparrow Enterprise Survey Software 2022 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
TLR-2005KSH – Arbitrary File Delete
# Exploit Title: TLR-2005KSH - Arbitrary File Delete
Royal Event Management System 1.0 – ‘todate’ SQL Injection (Authenticated)
# Exploit Title: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
College Management System 1.0 – ‘course_code’ SQL Injection (Authenticated)
# Exploit Title: College Management System - 'course_code' SQL Injection (Authenticated)
TLR-2005KSH – Arbitrary File Upload
# Exploit Title: TLR-2005KSH - Arbitrary File Upload
WordPress Plugin stafflist 3.1.2 – SQLi (Authenticated)
# Exploit Title: WordPress Plugin stafflist 3.1.2 - SQLi (Authenticated)
Joomla Plugin SexyPolling 2.1.7 – SQLi
# Exploit Title: Joomla Plugin SexyPolling 2.1.7 - SQLi
WordPress Plugin Blue Admin 21.06.01 – Cross-Site Request Forgery (CSRF)
Exploit Title: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
MyBB 1.8.29 – MyBB 1.8.29 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)
Beehive Forum – Account Takeover
# Exploit Title: Beehive Forum - Account Takeover
PHProjekt PhpSimplyGest v1.3. – Stored Cross-Site Scripting (XSS)
# Exploit Title: PHProjekt PhpSimplyGest v1.3.0 - Stored Cross-Site Scripting (XSS)
Navigate CMS 2.9.4 – Server-Side Request Forgery (SSRF) (Authenticated)
#!/usr/bin/env python3
Explore CMS 1.0 – SQL Injection
# Exploit Title: Explore CMS 1.0 - SQL Injection
Anuko Time Tracker – SQLi (Authenticated)
# Exploit Title: Anuko Time Tracker - SQLi (Authenticated)
e107 CMS v3.2.1 – Multiple Vulnerabilities
# Exploit Title: e107 CMS v3.2.1 - Multiple Vulnerabilities
Cyclos 4.14.7 – ‘groupId’ DOM Based Cross-Site Scripting (XSS)
# Exploit Title: Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS)
Cyclos 4.14.7 – DOM Based Cross-Site Scripting (XSS)
# Exploit Title: Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS)
CSZ CMS 1.3.0 – ‘Multiple’ Blind SQLi
# Exploit Title: CSZ CMS 1.3.0 - 'Multiple' Blind SQLi
Bitrix24 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Bitrix24 - Remote Code Execution (RCE) (Authenticated)
Magento eCommerce CE v2.3.5-p2 – Blind SQLi
Exploit Title: Magento eCommerce CE v2.3.5-p2 - Blind SQLi
WordPress Plugin Advanced Uploader 4.2 – Arbitrary File Upload (Authenticated)
# Exploit Title: WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
WebTareas 2.4 – Blind SQLi (Authenticated)
# Exploit Title: WebTareas 2.4 - Blind SQLi (Authenticated)
Microfinance Management System 1.0 – ‘customer_number’ SQLi
# Exploit Title: Microfinance Management System 1.0 - 'customer_number' SQLi
ImpressCMS v1.4.4 – Unrestricted File Upload
# Exploit Title: ImpressCMS v1.4.4 - Unrestricted File Upload