WhatsUpGold 21.0.3 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Dairy Farm Shop Management System 1.0 – SQL Injection Authentication Bypass
# Exploit Title: Dairy Farm Shop Management System 1.0 - SQL Injection Authentication Bypass
Vehicle Service Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Vehicle Service Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Phpwcms 1.9.30 – Arbitrary File Upload
# Exploit Title: Phpwcms 1.9.30 - Arbitrary File Upload
Blood Bank System 1.0 – Authentication Bypass
# Exploit Title: Blood Bank System 1.0 - Authentication Bypass
Drupal Module MiniorangeSAML 8.x-2.22 – Privilege escalation
# Exploit Title: Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation via XML Signature Wrapping
Exam Form Submission System 1.0 – SQL Injection Authentication Bypass
# Exploit Title: Exam Form Submission System 1.0 - SQL Injection Authentication Bypass
Pharmacy Point of Sale System 1.0 – ‘Multiple’ SQL Injection (SQLi)
# Exploit Title: Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi)
Cmsimple 5.4 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
Cyber Cafe Management System Project (CCMS) 1.0 – SQL Injection Authentication Bypass
# Exploit Title: Cyber Cafe Management System Project (CCMS) 1.0 - SQL Injection Authentication Bypass
Pet Shop Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Title: Pet Shop Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
OpenSIS 8.0 – ‘cp_id_miss_attn’ Reflected Cross-Site Scripting (XSS)
# Exploit Title: OpenSIS 8.0 - 'cp_id_miss_attn' Reflected Cross-Site Scripting (XSS)
WordPress Plugin Redirect 404 to Parent 1.3.0 – Reflected Cross-Site Scripting
# Exploit Title: WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting (XSS)
WordPress Plugin Select All Categories and Taxonomies 1.3.1 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)
Storage Unit Rental Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Storage Unit Rental Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
WordPress Plugin Popup 1.10.4 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)
WordPress Plugin Ultimate Maps 1.2.4 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)
WordPress Plugin Contact Form 1.7.14 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Contact Form 1.7.14 - Reflected Cross-Site Scripting (XSS)
WordPress Plugin TranslatePress 2.0.8 – Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: WordPress Plugin TranslatePress 2.0.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 – Remote Privilege Escalation
# Exploit Title: FatPipe Networks MPVPN 10.2.2 - Remote Privilege Escalation
FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 – Hidden Backdoor Account (Write Access)
# Exploit Title: FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Hidden Backdoor Account (Write Access)
FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 – Config Download (Unauthenticated)
# Exploit Title: FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Config Download (Unauthenticated)
FatPipe Networks WARP 10.2.2 – Authorization Bypass
# Exploit Title: FatPipe Networks WARP 10.2.2 - Authorization Bypass
FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 – ‘Add Admin’ Cross-Site Request Forgery (CSRF)
# Exploit Title: FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - 'Add Admin' Cross-Site Request Forgery (CSRF)
Library System 1.0 – ‘student_id’ SQL injection (Authenticated)
# Exploit Title: Library System 1.0 - 'student_id' SQL injection (Authenticated)
WordPress Plugin Wappointment 2.2.4 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS)
Pharmacy Point of Sale System 1.0 – SQLi Authentication BYpass
# Exploit Title: Pharmacy Point of Sale System 1.0 - SQLi Authentication Bypass
SmarterTools SmarterTrack 7922 – ‘Multiple’ Information Disclosure
# Exploit Title: SmarterTools SmarterTrack 7922 - 'Multiple' Information Disclosure
Police Crime Record Management Project 1.0 – Time Based SQLi
# Exploit Title: Police Crime Record Management Project 1.0 - Time Based SQLi
Budget and Expense Tracker System 1.0 – Arbitrary File Upload
# Exploit Title: Budget and Expense Tracker System 1.0 - Arbitrary File Upload
WordPress Plugin Fitness Calculators 1.9.5 – Cross-Site Request Forgery (CSRF)
# Exploit Title: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF)
WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting (XSS)
Backdrop CMS 1.20.0 – ‘Multiple’ Cross-Site Request Forgery (CSRF)
# Exploit Title: Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
WordPress Plugin 3DPrint Lite 1.9.1.4 – Arbitrary File Upload
# Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload
Gurock Testrail 7.2.0.3014 – ‘files.md5’ Improper Access Control
# Exploit Title: Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control
Online Reviewer System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Online Reviewer System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Sentry 8.2.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Sentry 8.2.0 - Remote Code Execution (RCE) (Authenticated)
Cloudron 6.2 – ‘returnTo ‘ Cross Site Scripting (Reflected)
# Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
OpenCats 0.9.4-2 – ‘docx ‘ XML External Entity Injection (XXE)
# Exploit Title: OpenCats 0.9.4-2 - 'docx ' XML External Entity Injection (XXE)
e107 CMS 2.3.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: e107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated)
Filerun 2021.03.26 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Filerun 2021.03.26 - Remote Code Execution (RCE) (Authenticated)
Simple Attendance System 1.0 – Unauthenticated Blind SQLi
# Exploit Title: Simple Attendance System 1.0 - Unauthenticated Blind SQLi
WebsiteBaker 2.13.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)
Budget and Expense Tracker System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Budget and Expense Tracker System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Budget and Expense Tracker System 1.0 – Authenticated Bypass
# Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass
Church Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Church Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Online Food Ordering System 2.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Online Food Ordering System 2.0 - Remote Code Execution (RCE) (Unauthenticated)
WordPress 5.7 – ‘Media Library’ XML External Entity Injection (XXE) (Authenticated)
# Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)
Church Management System 1.0 – ‘search’ SQL Injection (Unauthenticated)
# Exploit Title: Church Management System 1.0 - 'search' SQL Injection (Unauthenticated)
T-Soft E-Commerce 4 – change ‘admin credentials’ Cross-Site Request Forgery (CSRF)
# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)