GitLab 14.9 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Gitlab Stored XSS
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Gitlab 14.9 – Authentication Bypass
# Exploit Title: Gitlab 14.9 - Authentication Bypass
Fuel CMS 1.5.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)# Google Dork: NA
WordPress Plugin Elementor 3.6.2 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WordPress Plugin Elementor 3.6.2 - Remote Code Execution (RCE) (Authenticated)
PKP Open Journals System 3.3 – Cross-Site Scripting (XSS)
# Exploit Title: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
REDCap 11.3.9 – Stored Cross Site Scripting
# Exploit Title: REDCap 11.3.9 - Stored Cross-Site Scripting
WordPress Plugin Popup Maker 1.16.5 – Stored Cross-Site Scripting (Authenticated)
# Exploit Title: WordPress Plugin Popup Maker Add New Cookie > Add > Cookie Time (overwrite the default '1 month' w...
WordPress Plugin Videos sync PDF 1.7.4 – Stored Cross Site Scripting (XSS)
# Exploit Title: WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting (XSS)
Scriptcase 9.7 – Remote Code Execution (RCE)
# Exploit Title: Scriptcasr 9.7 arbitrary file upload getshell
Easy Appointments 1.4.2 – Information Disclosure
# Exploit Title: Easy Appointments 1.4.2 - Information Disclosure
WordPress Plugin Motopress Hotel Booking Lite 4.2.4 – SQL Injection
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
Razer Sila – Command Injection
# Exploit Title: Razer Sila - Command Injection
Razer Sila – Local File Inclusion (LFI)
# Exploit Title: Razer Sila - Local File Inclusion (LFI)
Telesquare TLR-2855KS6 – Arbitrary File Deletion
# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Deletion
Telesquare TLR-2855KS6 – Arbitrary File Creation
# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Creation
SAM SUNNY TRIPOWER 5.0 – Insecure Direct Object Reference (IDOR)
# Exploit Title: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
ICEHRM 31.0.0.0S – Cross-site Request Forgery (CSRF) to Account Deletion
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion
qdPM 9.2 – Cross-site Request Forgery (CSRF)
# Exploit Title: qdPM 9.2 - Cross-site Request Forgery (CSRF)
minewebcms 1.15.2 – Cross-site Scripting (XSS)
# Exploit Title: minewebcms 1.15.2 - Cross-site Scripting (XSS)
KLiK Social Media Website 1.0 – ‘Multiple’ SQLi
# Exploit Title: KLiK Social Media Website 1.0 - 'Multiple' SQLi
Zenario CMS 9.0.54156 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Zenario CMS 9.0.54156 - Remote Code Execution (RCE) (Authenticated)
WordPress Plugin Easy Cookie Policy 1.6.2 – Broken Access Control to Stored XSS
# Exploit Title: WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
CSZ CMS 1.2.9 – ‘Multiple’ Blind SQLi(Authenticated)
# Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
WordPress Plugin admin-word-count-column 2.2 – Local File Read
# Exploit Title: WordPress Plugin admin-word-count-column 2.2 - Local File Read
WordPress Plugin video-synchro-pdf 1.7.4 – Local File Inclusion
# Exploit Title: WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion
WordPress Plugin cab-fare-calculator 1.0.3 – Local File Inclusion
# Exploit Title: WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion
WordPress Plugin Curtain 1.0.2 – Cross-site Request Forgery (CSRF)
# Exploit Title: WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF)
Drupal avatar_uploader v7.x-1.0-beta8 – Cross Site Scripting (XSS)
# Exploit Title: Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS)
Atom CMS 2.0 – Remote Code Execution (RCE)
# Exploit Title: Atom CMS 2.0 - Remote Code Execution (RCE)
ImpressCMS 1.4.2 – Remote Code Execution (RCE)
# Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution (RCE)
WordPress Plugin amministrazione-aperta 3.7.3 – Local File Read – Unauthenticated
# Exploit Title: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
ICEHRM 31.0.0.0S – Cross-site Request Forgery (CSRF) to Account Takeover
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
WordPress Plugin iQ Block Country 1.2.13 – Arbitrary File Deletion via Zip Slip (Authenticated)
# Exploit Title: Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)
Tiny File Manager 2.4.6 – Remote Code Execution (RCE)
# Exploit Title: Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
Pluck CMS 4.7.16 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)
Moodle 3.11.5 – SQLi (Authenticated)
# Exploit Title: Moodle 3.11.5 - SQLi (Authenticated)
Baixar GLPI Project 9.4.6 – SQLi
# Exploit Title: Baixar GLPI Project 9.4.6 - SQLi
Zabbix 5.0.17 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Zabbix 5.0.17 - Remote Code Execution (RCE) (Authenticated)
Webmin 1.984 – Remote Code Execution (Authenticated)
# Exploit Title: Webmin 1.984 - Remote Code Execution (Authenticated)
Hasura GraphQL 2.2.0 – Information Disclosure
# Exploit Title: Hasura GraphQL 2.2.0 - Information Disclosure
Attendance and Payroll System v1.0 – SQLi Authentication Bypass
# Exploit Title: Attendance and Payroll System v1.0 - SQLi Authentication Bypass
Attendance and Payroll System v1.0 – Remote Code Execution (RCE)
# Exploit Title: Attendance and Payroll System v1.0 - Remote Code Execution (RCE)
part-db 0.5.11 – Remote Code Execution (RCE)
# Exploit Title: part-db 0.5.11 - Remote Code Execution (RCE)
Spring Cloud Gateway 3.1.0 – Remote Code Execution (RCE)
# Exploit Title: Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)
Zyxel ZyWALL 2 Plus Internet Security Appliance – Cross-Site Scripting (XSS)
# Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
Xerte 3.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Xerte 3.9 - Remote Code Execution (RCE) (Authenticated)
Xerte 3.10.3 – Directory Traversal (Authenticated)
# Exploit Title: Xerte 3.10.3 - Directory Traversal (Authenticated)
Casdoor 1.13.0 – SQL Injection (Unauthenticated)
// Exploit Title: Casdoor 1.13.0 - SQL Injection (Unauthenticated)
Cipi Control Panel 3.1.15 – Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated)
Microweber CMS 1.2.10 – Local File Inclusion (Authenticated) (Metasploit)
# Exploit Title: Microweber CMS v1.2.10 Local File Inclusion (Authenticated)