qdPM 9.1 – Remote Code Execution (Authenticated)
# Exploit Title: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
WordPress Plugin WP Customize Login 1.1 – ‘Change Logo Title’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WP Customize Login 1.1 - 'Change Logo Title' Stored Cross-Site Scripting (XSS)
Hotel Management System 1.0 – Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)
# Exploit Title: Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution...
Panasonic Sanyo CCTV Network Camera 2.03-0x – Cross-Site Request Forgery (Change Password)
# Exploit Title: Panasonic Sanyo CCTV Network Camera 2.03-0x - 'Disable Authentication / Change Password' CSRF
Online Hotel Reservation System 1.0 – ‘Multiple’ Cross-site scripting (XSS)
# Exploit Title: Online Hotel Reservation System 1.0 - 'Multiple' Cross-site scripting (XSS)
Men Salon Management System 1.0 – SQL Injection Authentication Bypass
# Exploit Title: Men Salon Management System 1.0 - SQL Injection Authentication Bypass
Oracle Fatwire 6.3 – Multiple Vulnerabilities
# Exploit Title: Oracle Fatwire 6.3 - Multiple Vulnerabilities
CloverDX 5.9.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: CloverDX 5.9.0 - Cross-Site Request Forgery (CSRF) to Remote Code Execution (RCE)
Care2x Integrated Hospital Info System 2.7 – ‘Multiple’ SQL Injection
# Exploit Title: Care2x Integrated Hospital Info System 2.7 - 'Multiple' SQL Injection
IntelliChoice eFORCE Software Suite 2.5.9 – Username Enumeration
# Exploit Title: IntelliChoice eFORCE Software Suite 2.5.9 - Username Enumeration
Longjing Technology BEMS API 1.21 – Remote Arbitrary File Download
# Exploit Title: Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download
Denver IP Camera SHO-110 – Unauthenticated Snapshot
# Exploit Title: Denver IP Camera SHO-110 - Unauthenticated Snapshot
TripSpark VEO Transportation – Blind SQL Injection
# Exploit Title: TripSpark VEO Transportation - 'editOEN' Blind SQL Injection
Event Registration System with QR Code 1.0 – Authentication Bypass
# Exploit Title: Event Registration System with QR Code 1.0 - Authentication Bypass & RCE
Customer Relationship Management System (CRM) 1.0 – Sql Injection Authentication Bypass
# Exploit Title: Customer Relationship Management System (CRM) 1.0 - Sql Injection Authentication Bypass
PHP 7.3.15-3 – ‘PHP_SESSION_UPLOAD_PROGRESS’ Session Data Injection
# Exploit Title: PHP 7.3.15-3 - 'PHP_SESSION_UPLOAD_PROGRESS' Session Data Injection
XOS Shop 1.0.9 – ‘Multiple’ Arbitrary File Deletion (Authenticated)
# Exploit Title: XOS Shop 1.0.9 - 'Multiple' Arbitrary File Deletion (Authenticated)
NoteBurner 2.35 – Denial Of Service (DoS) (PoC)
# Exploit Title: NoteBurner 2.35 - Denial Of Service (DoS) (PoC)
Elasticsearch ECE 7.13.3 – Anonymous Database Dump
# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump
Microsoft SharePoint Server 2019 – Remote Code Execution (2)
# Exploit Title: Microsoft SharePoint Server 2019 - Remote Code Execution (2)
WordPress Plugin Simple Post 1.1 – ‘Text field’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting (XSS)
ElasticSearch 7.13.3 – Memory disclosure
# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure
CSZ CMS 1.2.9 – ‘Multiple’ Arbitrary File Deletion
# Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Arbitrary File Deletion
KevinLAB BEMS 1.0 – File Path Traversal Information Disclosure (Authenticated)
# Exploit Title: KevinLAB BEMS 1.0 - File Path Traversal Information Disclosure (Authenticated)
KevinLAB BEMS 1.0 – Authentication Bypass
# Exploit Title: KevinLAB BEMS 1.0 - Unauthenticated SQL Injection / Authentication Bypass
Webmin 1.973 – ‘run.cgi’ Cross-Site Request Forgery (CSRF)
# Exploit Title: Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)
WordPress Plugin KN Fix Your Title 1.0.1 – ‘Separator’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin KN Fix Your Title 1.0.1 - 'Separator' Stored Cross-Site Scripting (XSS)
PEEL Shopping 9.3.0 – ‘id’ Time-based SQL Injection
# Exploit Title: PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection
WordPress Plugin Mimetic Books 0.2.13 – ‘Default Publisher ID field’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Mimetic Books 0.2.13 - 'Default Publisher ID field' Stored Cross-Site Scripting (XSS)
WordPress Plugin LearnPress 3.2.6.8 – Privilege Escalation
# Exploit Title: WordPress Plugin LearnPress 3.2.6.8 - Privilege Escalation
WordPress Plugin LearnPress 3.2.6.7 – ‘current_items’ SQL Injection (Authenticated)
# Exploit Title: WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)
Seagate BlackArmor NAS sg2000-2000.1331 – Command Injection
# Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
ForgeRock Access Manager 14.6.3 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: ForgeRock Access Manager/OpenAM 14.6.3 - Remote Code Execution (RCE) (Unauthenticated)
WordPress Plugin Popular Posts 5.3.2 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated)
osCommerce 2.3.4.1 – Remote Code Execution (2)
# Exploit Title: osCommerce 2.3.4.1 - Remote Code Execution (2)
WordPress Plugin Current Book 1.0.1 – ‘Book Title’ Persistent Cross-Site Scripting
# Exploit Title: WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting (XSS)
Webmin 1.973 – ‘save_user.cgi’ Cross-Site Request Forgery (CSRF)
# Exploit Title: Webmin 1.973 - 'save_user.cgi' Cross-Site Request Forgery (CSRF)
Garbage Collection Management System 1.0 – SQL Injection + Arbitrary File Upload
# Exploit Title: Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload
OpenEMR 5.0.1.3 – ‘manage_site_files’ Remote Code Execution (Authenticated) (2)
# Title: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2)
Invoice System 1.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
WordPress Plugin WPFront Notification Bar 1.9.1.04012 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WPFront Notification Bar 1.9.1.04012 - Stored Cross-Site Scripting (XSS)
Apache Tomcat 9.0.0.M1 – Cross-Site Scripting (XSS)
# Exploit Title: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS)
Apache Tomcat 9.0.0.M1 – Open Redirect
# Exploit Title: Apache Tomcat 9.0.0.M1 - Open Redirect
Zoo Management System 1.0 – ‘Multiple’ Persistent Cross-Site-Scripting (XSS)
# Exploit Title: Zoo Management System 1.0 - 'Multiple' Stored Cross-Site-Scripting (XSS)
Church Management System 1.0 – SQL Injection (Authentication Bypass) + Arbitrary File Upload + RCE
# Exploit Title: Church Management System 1.0 - SQL Injection (Authentication Bypass) + Arbitrary File Upload + RCE
WordPress Plugin SP Project & Document Manager 4.21 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: Wordpress Plugin SP Project & Document Manager 4.21 - Remote Code Execution (RCE) (Authenticated)
Online Covid Vaccination Scheduler System 1.0 – Arbitrary File Upload to Remote Code Execution (Unauthenticated)
# Exploit Title: Online Covid Vaccination Scheduler System 1.0 - Arbitrary File Upload to Remote Code Execution (Unau...
Wyomind Help Desk 1.3.6 – Remote Code Execution (RCE)
# Exploit Title: Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE)
Employee Record Management System 1.2 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS)
Exam Hall Management System 1.0 – Unrestricted File Upload + RCE (Unauthenticated)
# Exploit Title: Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)