Bus Pass Management System 1.0 – ‘viewid’ SQL Injection
# Exploit Title: Bus Pass Management System 1.0 - 'viewid' SQL Injection
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Usermin 1.820 – Remote Code Execution (RCE) (Authenticated)
# Title: Usermin 1.820 - Remote Code Execution (RCE) (Authenticated)
ZesleCP 3.1.9 – Remote Code Execution (RCE) (Authenticated)
# Title: ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)
COMMAX UMS Client ActiveX Control 1.7.0.2 – ‘CNC_Ctrl.dll’ Heap Buffer Overflow
# Exploit Title: COMMAX UMS Client ActiveX Control 1.7.0.2 - 'CNC_Ctrl.dll' Heap Buffer Overflow
COMMAX WebViewer ActiveX Control 2.1.4.5 – ‘Commax_WebViewer.ocx’ Buffer Overflow
# Exploit Title: COMMAX WebViewer ActiveX Control 2.1.4.5 - 'Commax_WebViewer.ocx' Buffer Overflow
CyberPanel 2.1 – Remote Code Execution (RCE) (Authenticated)
# Title: CyberPanel 2.1 - Remote Code Execution (RCE) (Authenticated)
ProcessMaker 3.5.4 – Local File inclusion
# Exploit Title: ProcessMaker 3.5.4 - Local File inclusion
Online Leave Management System 1.0 – Arbitrary File Upload to Shell (Unauthenticated)
# Exploit Title: Online Leave Management System 1.0 - Arbitrary File Upload to Shell (Unauthenticated)
HP OfficeJet 4630/7110 MYM1FN2025AR/2117A – Stored Cross-Site Scripting (XSS)
# Exploit Title: HP OfficeJet 4630/7110 MYM1FN2025AR 2117A – Stored Cross-Site Scripting (XSS)
WordPress Plugin Mail Masta 1.0 – Local File Inclusion (2)
# Exploit Title: WordPress Plugin Mail Masta 1.0 - Local File Inclusion (2)
RaspAP 2.6.6 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)
Simple Phone Book 1.0 – ‘Username’ SQL Injection (Unauthenticated)
# Exploit Title: Simple Phone book/directory 1.0 - 'Username' SQL Injection (Unauthenticated)
Online Traffic Offense Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Online Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Laundry Booking Management System 1.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
Laundry Booking Management System 1.0 – ‘Multiple’ SQL Injection
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' SQL Injection
Online Traffic Offense Management System 1.0 – ‘id’ SQL Injection (Authenticated)
# Exploit Title: Online Traffic Offense Management System 1.0 - 'id' SQL Injection (Authenticated)
Charity Management System CMS 1.0 – Multiple Vulnerabilities
# Exploit Title: Charity Management System CMS 1.0 - Multiple Vulnerabilities
COVID19 Testing Management System 1.0 – ‘Multiple’ SQL Injections
# Exploit Title: COVID19 Testing Management System 1.0 - 'Multiple' SQL Injections
Simple Image Gallery 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Crime records Management System 1.0 – ‘Multiple’ SQL Injection (Authenticated)
# Exploit Title: Crime records Management System 1.0 - 'Multiple' SQL Injection (Authenticated)
GeoVision Geowebserver 5.3.3 – Local FIle Inclusion
# Exploit Title: GeoVision Geowebserver 5.3.3 - LFI / XSS / HHI / RCE
COMMAX CVD-Axx DVR 5.1.4 – Weak Default Credentials Stream Disclosure
# Exploit Title: COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure
COMMAX Smart Home Ruvie CCTV Bridge DVR Service – Config Write / DoS (Unauthenticated)
# Exploit Title: COMMAX Smart Home Ruvie CCTV Bridge DVR Service - Config Write / DoS (Unauthenticated)
COMMAX Smart Home Ruvie CCTV Bridge DVR Service – RTSP Credentials Disclosure
# Exploit Title: COMMAX Smart Home Ruvie CCTV Bridge DVR Service - RTSP Credentials Disclosure
COMMAX Smart Home IoT Control System CDP-1020n – SQL Injection Authentication Bypass
# Exploit Title: COMMAX Smart Home IoT Control System CDP-1020n - SQL Injection Authentication Bypass
COMMAX Biometric Access Control System 1.0.0 – Authentication Bypass
# Exploit Title: COMMAX Biometric Access Control System 1.0.0 - Authentication Bypass
Simple Water Refilling Station Management System 1.0 – Remote Code Execution (RCE) through File Upload
# Exploit Title: Simple Water Refilling Station Management System 1.0 - Remote Code Execution (RCE) through File Upload
Simple Water Refilling Station Management System 1.0 – Authentication Bypass
# Exploit Title: Simple Water Refilling Station Management System 1.0 - Authentication Bypass
NetGear D1500 V1.0.0.21_1.0.1PE – ‘Wireless Repeater’ Stored Cross-Site Scripting (XSS)
# Exploit Title: NetGear D1500 V1.0.0.21_1.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting (XSS)
CentOS Web Panel 0.9.8.1081 – Stored Cross-Site Scripting (XSS)
# Exploit Title: CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting (XSS)
RATES SYSTEM 1.0 – Authentication Bypass
# Exploit Title: RATES SYSTEM 1.0 - Authentication Bypass
Simple Image Gallery System 1.0 – ‘id’ SQL Injection
# Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection
Care2x Open Source Hospital Information Management 2.7 Alpha – ‘Multiple’ Stored XSS
# Exploit Title: Care2x Open Source Hospital Information Management 2.7 Alpha - 'Multiple' Stored XSS
Police Crime Record Management System 1.0 – ‘casedetails’ SQL Injection
# Exploit Title: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection
Police Crime Record Management System 1.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
easy-mock 1.6.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: easy-mock 1.6.0 - Remote Code Execution (RCE) (Authenticated)
4images 1.8 – ‘limitnumber’ SQL Injection (Authenticated)
# Exploit Title: 4images 1.8 - 'limitnumber' SQL Injection (Authenticated)
RATES SYSTEM 1.0 – ‘Multiple’ SQL Injections
# Exploit Title: RATES SYSTEM 1.0 - 'Multiple' SQL Injections
Altova MobileTogether Server 7.3 – XML External Entity Injection (XXE)
# Exploit Title: Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE)
COVID19 Testing Management System 1.0 – ‘searchdata’ SQL Injection
# Exploit Title: COVID19 Testing Management System 1.0 - 'searchdata' SQL Injection
Simple Library Management System 1.0 – ‘rollno’ SQL Injection
# Exploit Title: Simple Library Management System 1.0 - 'rollno' SQL Injection
WordPress Plugin Picture Gallery 1.4.2 – ‘Edit Content URL’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Picture Gallery 1.4.2 - 'Edit Content URL' Stored Cross-Site Scripting (XSS)
Cockpit CMS 0.11.1 – ‘Username Enumeration & Password Reset’ NoSQL Injection
# Exploit Title: Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection
IPCop 2.1.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: IPCop 2.1.9 - Remote Code Execution (RCE) (Authenticated)
GFI Mail Archiver 15.1 – Telerik UI Component Arbitrary File Upload (Unauthenticated)
# Exploit Title: GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload (Unauthenticated)
Moodle 3.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Moodle 3.9 - Remote Code Execution (RCE) (Authenticated)
CMSuno 1.7 – ‘tgo’ Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: CMSuno 1.7 - 'tgo' Stored Cross-Site Scripting (XSS) (Authenticated)
ApacheOfBiz 17.12.01 – Remote Command Execution (RCE)
# Exploit Title: ApacheOfBiz 17.12.01 - Remote Command Execution (RCE) via Unsafe Deserialization of XMLRPC arguments
Client Management System 1.1 – ‘cname’ Stored Cross-site scripting (XSS)
# Exploit Title: Client Management System 1.1 - 'cname' Stored Cross-site scripting (XSS)
qdPM 9.2 – Password Exposure (Unauthenticated)
# Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)