WordPress Plugin Plainview Activity Monitor 20161228 – Remote Code Execution (RCE) (Authenticated) (2)
# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Online Covid Vaccination Scheduler System 1.0 – ‘username’ time-based blind SQL Injection
# Exploit Title: Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection
Rocket.Chat 3.12.1 – NoSQL Injection to RCE (Unauthenticated) (2)
# Title: Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) (2)
WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 – Directory Traversal
# Exploit Title: WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal
Phone Shop Sales Managements System 1.0 – Arbitrary File Upload
# Exploit Title: Phone Shop Sales Managements System 1.0 - 'Multiple' Arbitrary File Upload to Remote Code Execution
Phone Shop Sales Managements System 1.0 – Authentication Bypass (SQLi)
# Exploit Title: Phone Shop Sales Managements System 1.0 - Authentication Bypass (SQLi)
Visual Tools DVR VX16 4.2.28 – Local Privilege Escalation
# Exploit Title: Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation
Exam Hall Management System 1.0 – Unrestricted File Upload (Unauthenticated)
# Exploit Title: Exam Hall Management System 1.0 - Unrestricted File Upload (Unauthenticated)
Billing System Project 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Billing System Project 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Pallets Werkzeug 0.15.4 – Path Traversal
# Exploit Title: Pallets Werkzeug 0.15.4 - Path Traversal
Black Box Kvm Extender 3.4.31307 – Local File Inclusion
# Exploit Title: Black Box Kvm Extender 3.4.31307 - Local File Inclusion
Netgear DGN2200v1 – Remote Command Execution (RCE) (Unauthenticated)
# Exploit Title: Netgear DGN2200v1 - Remote Command Execution (RCE) (Unauthenticated)
Visual Tools DVR VX16 4.2.28.0 – OS Command Injection (Unauthenticated)
# Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)
perfexcrm 1.10 – ‘State’ Stored Cross-site scripting (XSS)
# Exploit Title: perfexcrm 1.10 - 'State' Stored Cross-site scripting (XSS)
Ricon Industrial Cellular Router S9922XL – Remote Command Execution (RCE)
# Exploit Title: Ricon Industrial Cellular Router S9922XL - Remote Command Execution (RCE)
TextPattern CMS 4.9.0-dev – Remote Command Execution (RCE) (Authenticated)
# Exploit Title: TextPattern CMS 4.9.0-dev - Remote Command Execution (RCE) (Authenticated)
Simple Client Management System 1.0 – Remote Code Execution (RCE)
# Exploit Title: Simple Client Management System 1.0 - Remote Code Execution (RCE)
WordPress Plugin Backup Guard 1.5.8 – Remote Code Execution (Authenticated)
# Exploit Title: Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution (Authenticated)
Church Management System 1.0 – ‘password’ SQL Injection (Authentication Bypass)
# Exploit Title: Church Management System 1.0 - 'password' SQL Injection (Authentication Bypass)
Church Management System 1.0 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Church Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
Church Management System 1.0 – Arbitrary File Upload (Authenticated)
# Exploit Title: Church Management System 1.0 - Unrestricted File Upload to Remote Code Execution (Authenticated)
Online Birth Certificate System 1.1 – ‘Multiple’ Stored Cross-Site Scripting (XSS)
# Exploit Title: Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
Online Voting System 1.0 – SQLi (Authentication Bypass) + Remote Code Execution (RCE)
# Exploit Title: Online Voting System 1.0 - SQLi (Authentication Bypass) + Remote Code Execution (RCE)
OpenEMR 5.0.1.7 – ‘fileName’ Path Traversal (Authenticated) (2)
# Title: OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) (2)
WordPress Plugin WP Learn Manager 1.1.2 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin WP Learn Manager 1.1.2 - Stored Cross-Site Scripting (XSS)
Garbage Collection Management System 1.0 – SQL Injection (Unauthenticated)
# Exploit Title: Garbage Collection Management System 1.0 - SQL Injection (Unauthenticated)
WordPress Plugin Modern Events Calendar 5.16.2 – Event export (Unauthenticated)
# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)
WordPress Plugin Modern Events Calendar 5.16.2 – Remote Code Execution (Authenticated)
# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated)
b2evolution 7.2.2 – ‘edit account details’ Cross-Site Request Forgery (CSRF)
# Exploit Title: b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)
AKCP sensorProbe SPX476 – ‘Multiple’ Cross-Site Scripting (XSS)
# Exploit Title: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)
Scratch Desktop 3.17 – Remote Code Execution
# Exploit Title: Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution (XSS/RCE)
Vianeos OctoPUS 5 – ‘login_user’ SQLi
# Exploit Title: Vianeos OctoPUS 5 - 'login_user' SQLi
WordPress Plugin XCloner 4.2.12 – Remote Code Execution (Authenticated)
# Exploit Title: Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated)
Online Voting System 1.0 – Remote Code Execution (Authenticated)
# Exploit Title: Online Voting System 1.0 - Remote Code Execution (Authenticated)
Online Voting System 1.0 – Authentication Bypass (SQLi)
# Exploit Title: Online Voting System 1.0 - Authentication Bypass (SQLi)
Doctors Patients Management System 1.0 – SQL Injection (Authentication Bypass)
# Exploit Title: Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
Simple Traffic Offense System 1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Simple Traffic Offense System 1.0 - 'Multiple' Stored Cross Site Scripting (XSS)
Apache Superset 1.1.0 – Time-Based Account Enumeration
# Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration
phpAbook 0.9i – SQL Injection
# Exploit Title: phpAbook 0.9i - SQL Injection
Netgear WNAP320 2.0.3 – ‘macAddress’ Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)
Atlassian Jira Server Data Center 8.16.0 – Reflected Cross-Site Scripting (XSS)
# Exploit Title: Atlassian Jira Server/Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
WordPress Plugin YOP Polls 6.2.7 – Stored Cross Site Scripting (XSS)
# Exploit Title: WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)
Simple Client Management System 1.0 – ‘uemail’ SQL Injection (Unauthenticated)
# Exploit Title: Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
Seeddms 5.1.10 – Remote Command Execution (RCE) (Authenticated)
# Exploit Title: Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated)
TP-Link TL-WR841N – Command Injection
# Exploit Title: TP-Link TL-WR841N - Command Injection
Adobe ColdFusion 8 – Remote Command Execution (RCE)
# Exploit Title: Adobe ColdFusion 8 - Remote Command Execution (RCE)
VMware vCenter Server 7.0 – Remote Code Execution (RCE) (Unauthenticated)
# Exploit Title: VMware vCenter Server RCE 6.5 / 6.7 / 7.0 - Remote Code Execution (RCE) (Unauthenticated)
Simple CRM 3.0 – ’email’ SQL injection (Authentication Bypass)
# Exploit Title: Simple CRM 3.0 - 'email' SQL injection (Authentication Bypass)
Online Library Management System 1.0 – Arbitrary File Upload Remote Code Execution (Unauthenticated)
# Exploit Title: Online Library Management System 1.0 - Arbitrary File Upload Remote Code Execution (Unauthenticated)