Grav CMS 1.7.10 – Server-Side Template Injection (SSTI) (Authenticated)
# Title: Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Rocket.Chat 3.12.1 – NoSQL Injection (Unauthenticated)
# Title: Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated)
WordPress Plugin Smart Slider-3 3.5.0.8 – ‘name’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Smart Slider-3 3.5.0.8 - 'name' Stored Cross-Site Scripting (XSS)
OptiLink ONT1GEW GPON 2.1.11_X101 Build 1127.190306 – Remote Code Execution (Authenticated)
# Exploit Title: OptiLink ONT1GEW GPON 2.1.11_X101 Build 1127.190306 - Remote Code Execution (Authenticated)
Gitlab 13.10.2 – Remote Code Execution (Authenticated)
# Exploit Title: Gitlab 13.10.2 - Remote Code Execution (Authenticated)
Monstra CMS 3.0.4 – Remote Code Execution (Authenticated)
# Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)
4Images 1.8 – ‘redirect’ Reflected XSS
# Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS
Gitlab 13.9.3 – Remote Code Execution (Authenticated)
# Exploit Title: Gitlab 13.9.3 - Remote Code Execution (Authenticated)
FUDForum 3.1.0 – ‘author’ Reflected XSS
# Exploit Title: FUDForum 3.1.0 - 'author' Reflected XSS
FUDForum 3.1.0 – ‘srch’ Reflected XSS
# Exploit Title: FUDForum 3.1.0 - 'srch' Reflected XSS
CHIYU IoT Devices – Denial of Service (DoS)
# Exploit Title: CHIYU IoT Devices - Denial of Service (DoS)
Seo Panel 4.8.0 – ‘from_time’ Reflected XSS
# Exploit Title: Seo Panel 4.8.0 - 'from_time' Reflected XSS
PHP 8.1.0-dev – ‘User-Agentt’ Remote Code Execution
# Exploit Title: PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution
Seo Panel 4.8.0 – ‘category’ Reflected XSS
# Exploit Title: Seo Panel 4.8.0 - 'category' Reflected XSS
Seo Panel 4.8.0 – ‘search_name’ Reflected XSS
# Exploit Title: Seo Panel 4.8.0 - 'search_name' Reflected XSS
Products.PluggableAuthService 2.6.0 – Open Redirect
# Exploit Title: Products.PluggableAuthService 2.6.0 - Open Redirect
GetSimple CMS 3.3.4 – Information Disclosure
# Exploit Title: GetSimple CMS 3.3.4 - Information Disclosure
Apache Airflow 1.10.10 – ‘Example Dag’ Remote Code Execution
# Exploit Title: Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
Thecus N4800Eco Nas Server Control Panel – Comand Injection
# Exploit Title: Thecus N4800Eco Nas Server Control Panel - Comand Injection
Atlassian Jira 8.15.0 – Information Disclosure (Username Enumeration)
# Exploit Title: Atlassian Jira 8.15.0 - Information Disclosure (Username Enumeration)
CHIYU TCP/IP Converter devices – CRLF injection
# Exploit Title: CHIYU TCP/IP Converter devices - CRLF injection
CHIYU IoT devices – ‘Multiple’ Cross-Site Scripting (XSS)
# Exploit Title: CHIYU IoT devices - 'Multiple' Cross-Site Scripting (XSS)
WordPress Plugin WP Prayer version 1.6.1 – ‘prayer_messages’ Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: WordPress Plugin WP Prayer version 1.6.1 - 'prayer_messages' Stored Cross-Site Scripting (XSS) (Auth...
Ubee EVW327 – ‘Enable Remote Access’ Cross-Site Request Forgery (CSRF)
# Exploit Title: Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)
ProjeQtOr Project Management 9.1.4 – Remote Code Execution
# Exploit Title: ProjeQtOr Project Management 9.1.4 - Remote Code Execution
LogonTracer 1.2.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated)
Selenium 3.141.59 – Remote Code Execution (Firefox/geckodriver)
# Exploit Title: Selenium 3.141.59 - Remote Code Execution (Firefox/geckodriver)
Trixbox 2.8.0.4 – ‘lang’ Path Traversal
# Exploit Title: Trixbox 2.8.0.4 - 'lang' Path Traversal
Trixbox 2.8.0.4 – ‘lang’ Remote Code Execution (Unauthenticated)
# Exploit Title: Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
WordPress Plugin LifterLMS 4.21.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS)
PHPFusion 9.03.50 – Remote Code Execution
# Exploit Title: PHPFusion 9.03.50 - Remote Code Execution
Postbird 0.8.4 – Javascript Injection
# Exploit Title: Postbird 0.8.4 - Javascript Injection
Pluck CMS 4.7.13 – File Upload Remote Code Execution (Authenticated)
# Exploit Title: Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)
Codiad 2.8.4 – Remote Code Execution (Authenticated) (3)
# Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated) (3)
WordPress Plugin Cookie Law Bar 1.2.1 – ‘clb_bar_msg’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)
Gadget Works Online Ordering System 1.0 – ‘Category’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS)
WordPress Plugin ReDi Restaurant Reservation 21.0307 – ‘Comment’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)
Codiad 2.8.4 – Remote Code Execution (Authenticated) (2)
# Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated) (2)
Shopizer 2.16.0 – ‘Multiple’ Cross-Site Scripting (XSS)
# Exploit Title: Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS)
Schlix CMS 2.2.6-6 – Arbitary File Upload (Authenticated)
# Exploit Title: Schlix CMS 2.2.6-6 - Arbitary File Upload And Directory Traversal Leads To RCE (Authenticated)
Microsoft Exchange 2019 – Unauthenticated Email Download (Metasploit)
# Exploit Title: Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)
WordPress Plugin WP Statistics 13.0.7 – Time-Based Blind SQL Injection (Unauthenticated)
# Exploit Title: WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated)
Spotweb 1.4.9 – DOM Based Cross-Site Scripting (XSS)
# Exploit Title: Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS)
COVID19 Testing Management System 1.0 – ‘Admin name’ Cross-Site Scripting (XSS)
# Exploit Title: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)
COVID19 Testing Management System 1.0 – SQL Injection (Auth Bypass)
# Exploit Title: COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)
ManageEngine ADSelfService Plus 6.1 – CSV Injection
# Exploit Title: ManageEngine ADSelfService Plus 6.1 - CSV Injection
In4Suit ERP 3.2.74.1370 – ‘txtLoginId’ SQL injection
# Exploit Title: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
WordPress Plugin Stop Spammers 2021.8 – ‘log’ Reflected Cross-site Scripting (XSS)
# Exploit Title: WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)
Microsoft Exchange 2019 – Unauthenticated Email Download
# Exploit Title: Microsoft Exchange 2019 - Unauthenticated Email Download
EgavilanMedia PHPCRUD 1.0 – ‘First Name’ SQL Injection
# Exploit Title: EgavilanMedia PHPCRUD 1.0 - 'First Name' SQL Injection