phpMyAdmin 5.0.0 – SQL Injection
# Exploit Title: phpMyAdmin 5.0.0 - SQL Injection
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
RosarioSIS 6.7.2 – Cross Site Scripting (XSS)
# Exploit Title: RosarioSIS 6.7.2 - Cross Site Scripting (XSS)
RosarioSIS 6.7.2 – Cross-Site Scripting (XSS)
# Exploit Title: RosarioSIS 6.7.2 - Cross-Site Scripting (XSS)
PluckCMS 4.7.10 – Unrestricted File Upload
# Exploit Title: PluckCMS 4.7.10 - Unrestricted File Upload
openSIS Community Edition 8.0 – SQL Injection
# Exploit Title: openSIS Community Edition 8.0 - SQL Injection
YOURLS 1.8.2 – Cross-Site Request Forgery (CSRF)
# Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
phpMyFAQ 3.1.7 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
phpIPAM 1.5.1 – SQL Injection
# Exploit Title: phpIPAM 1.5.1 - SQL Injection
Piwigo 13.6.0 – SQL Injection
# Exploit Title: Piwigo 13.6.0 - SQL Injection
phpIPAM 1.6 – Reflected-Cross-Site Scripting (XSS)
# Exploit Title: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
phpIPAM 1.6 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
Flowise 3.0.4 – Remote Code Execution (RCE)
# Exploit Title: Flowise 3.0.4 - Remote Code Execution (RCE)
Casdoor 2.95.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)
Tourism Management System 2.0 – Arbitrary Shell Upload
# Exploit Title: Tourism Management System 2.0 - Arbitrary Shell Upload
Casdoor 2.55.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF)
dotCMS 25.07.02-1 – Authenticated Blind SQL Injection
#!/usr/bin/env python3
ELEX WooCommerce WordPress Plugin 1.4.3 – SQL Injection
#include <stdio.h>
Concrete CMS 9.4.3 – Stored XSS
# Exploit Title: Concrete CMS 9.4.3 - Stored XSS
StoryChief WordPress Plugin 1.0.42 – Arbitrary File Upload
# Exploit Title: StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
Lingdang CRM 8.6.4.7 – SQL Injection
# Exploit Title: Lingdang CRM 8.6.4.7 - SQL Injection
Birth Chart Compatibility WordPress Plugin 2.0 – Full Path Disclosure
#include<stdio.h>
Soosyze CMS 2.0 – Brute Force Login
# Exploit Title: Soosyze CMS 2.0 - Brute Force Login
RiteCMS 3.0.0 – Reflected Cross Site Scripting (XSS)
# Exploit Title: RiteCMS 3.0.0 – Reflected Cross-Site Scripting (XSS)
BigAnt Office Messenger 5.6.06 – SQL Injection
# Exploit Title: BigAnt Office Messenger 5.6.06 - SQL Injection
JetBrains TeamCity 2023.11.4 – Authentication Bypass
#!/usr/bin/env python3
ServiceNow Multiple Versions – Input Validation & Template Injection
#!/usr/bin/env python3
Ghost CMS 5.59.1 – Arbitrary File Read
#!/usr/bin/env python3
Ghost CMS 5.42.1 – Path Traversal
#!/usr/bin/env python3
VMware vSphere Client 8.0.3.0 – Reflected Cross-Site Scripting (XSS)
# VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)
Microsoft Edge Renderer Process (Mojo IPC) 134.0.6998.177 – Sandbox Escape
# Titles: Microsoft Edge Renderer Process (Mojo IPC) 134.0.6998.177 - Sandbox Escape
Grav CMS 1.7.48 – Remote Code Execution (RCE)
# Exploit Title: Grav CMS 1.7.48 - Remote Code Execution (RCE)
atjiu pybbs 6.0.0 – Cross Site Scripting (XSS)
#include <stdio.h>
projectworlds Online Admission System 1.0 – SQL Injection
#include <stdio.h>
Ultimate Member WordPress Plugin 2.6.6 – Privilege Escalation
#!/usr/bin/env python3
Copyparty 1.18.6 – Reflected Cross-Site Scripting (XSS)
allowing an attacker to inject and execute arbitrary JavaScript in a victim’s browser
Adobe ColdFusion 2023.6 – Remote File Read
# Exploit Title: Adobe ColdFusion 2023.6 - Remote File Read
Mezzanine CMS 6.1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Mezzanine CMS 6.1.0 Stored Cross Site Scripting (XSS)
XWiki 14 – SQL Injection via getdeleteddocuments.vm
# Exploit Title: XWiki 14 - SQL Injection via getdeleteddocuments.vm
Invision Community 4.7.20 – (calendar/view.php) SQL Injection
# Exploit Title: Invision Community
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Department Assignment Alias Nick Field
# Exploit Title: LiveHelperChat
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via the Chat Transfer Function
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via the Chat Transfer Function
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Personal Canned Messages
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Facebook Integration Page Name Field
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Operator Surname
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Operator Surname
LiveHelperChat 4.61 – Stored Cross Site Scripting (XSS) via Telegram Bot Username
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
Discourse 3.1.1 – Unauthenticated Chat Message Access
#!/usr/bin/env ruby