Printable Staff ID Card Creator System 1.0 – ’email’ SQL Injection
# Exploit Title: Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Subrion CMS 4.2.1 – Arbitrary File Upload
# Exploit Title: Subrion CMS 4.2.1 - File Upload Bypass to RCE (Authenticated)
Advanced Guestbook 2.4.4 – ‘Smilies’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)
Billing Management System 2.0 – Union based SQL injection (Authenticated)
# Exploit Title: Billing Management System 2.0 - Union based SQL injection (Authenticated)
Simple Chatbot Application 1.0 – ‘Category’ Stored Cross site Scripting
# Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting
Dental Clinic Appointment Reservation System 1.0 – Cross Site Request Forgery (Add Admin)
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Cross Site Request Forgery (Add Admin)
Dental Clinic Appointment Reservation System 1.0 – ‘Firstname’ Persistent Cross Site Scripting (Authenticated)
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'Firstname' Persistent Cross Site Scripting (Auth...
IPFire 2.25 – Remote Code Execution (Authenticated)
# Exploit Title: IPFire 2.25 - Remote Code Execution (Authenticated)
Customer Relationship Management (CRM) System 1.0 – ‘Category’ Persistent Cross site Scripting
# Exploit Title: Customer Relationship Management (CRM) System 1.0 - 'Category' Persistent Cross site Scripting
Chamilo LMS 1.11.14 – Remote Code Execution (Authenticated)
# Exploit Title: Chamilo LMS 1.11.14 - Remote Code Execution (Authenticated)
Podcast Generator 3.1 – ‘Long Description’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Podcast Generator 3.1 - 'Long Description' Persistent Cross-Site Scripting (XSS)
Student Management System 1.0 – ‘message’ Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting (Authenticated)
ZeroShell 3.9.0 – Remote Command Execution
# Exploit Title: ZeroShell 3.9.0 - Remote Command Execution
Dental Clinic Appointment Reservation System 1.0 – ‘date’ UNION based SQL Injection (Authenticated)
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'date' UNION based SQL Injection (Authenticated)
Dental Clinic Appointment Reservation System 1.0 – Authentication Bypass (SQLi)
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass (SQLi)
Chevereto 3.17.1 – Cross Site Scripting (Stored)
# Exploit Title: Chevereto 3.17.1 - Cross Site Scripting (Stored)
Microweber CMS 1.1.20 – Remote Code Execution (Authenticated)
# Exploit Title: Microweber CMS 1.1.20 - Remote Code Execution (Authenticated)
Human Resource Information System 0.1 – ‘First Name’ Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: Human Resource Information System 0.1 - 'First Name' Persistent Cross-Site Scripting (Authenticated)
PHP Timeclock 1.04 – ‘Multiple’ Cross Site Scripting (XSS)
# Exploit Title: PHP Timeclock 1.04 - 'Multiple' Cross Site Scripting (XSS)
PHP Timeclock 1.04 – Time and Boolean Based Blind SQL Injection
# Exploit Title: PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection
Human Resource Information System 0.1 – Remote Code Execution (Unauthenticated)
# Exploit Title: Human Resource Information System 0.1 - Remote Code Execution (Unauthenticated)
Voting System 1.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Voting System 1.0 - Remote Code Execution (Unauthenticated)
Voting System 1.0 – Authentication Bypass (SQLI)
# Exploit Title: Voting System 1.0 - Authentication Bypass (SQLI)
b2evolution 7-2-2 – ‘cf_name’ SQL Injection
# Exploit Title: b2evolution 7-2-2 - 'cf_name' SQL Injection
WordPress Plugin WP Super Edit 2.5.4 – Remote File Upload
# Title: Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload
Schlix CMS 2.2.6-6 – Remote Code Execution (Authenticated)
# Exploit Title: Schlix CMS 2.2.6-6 - Remote Code Execution (Authenticated)
Schlix CMS 2.2.6-6 – ‘title’ Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)
Anote 1.0 – Persistent Cross-Site Scripting
# Exploit Title: Anote 1.0 - Persistent Cross-Site Scripting
Markdownify 1.2.0 – Persistent Cross-Site Scripting
# Exploit Title: Markdownify 1.2.0 - Persistent Cross-Site Scripting
Markright 1.0 – Persistent Cross-Site Scripting
# Exploit Title: Markright 1.0 - Persistent Cross-Site Scripting
Freeter 1.2.1 – Persistent Cross-Site Scripting
# Exploit Title: Freeter 1.2.1 - Persistent Cross-Site Scripting
StudyMD 0.3.2 – Persistent Cross-Site Scripting
# Exploit Title: StudyMD 0.3.2 - Persistent Cross-Site Scripting
Marky 0.0.1 – Persistent Cross-Site Scripting
# Exploit Title: Marky 0.0.1 - Persistent Cross-Site Scripting
Moeditor 0.2.0 – Persistent Cross-Site Scripting
# Exploit Title: Moeditor 0.2.0 - Persistent Cross-Site Scripting
SnipCommand 0.1.0 – Persistent Cross-Site Scripting
# Exploit Title: SnipCommand 0.1.0 - XSS to RCE
Tagstoo 2.0.1 – Persistent Cross-Site Scripting
# Exploit Title: Tagstoo 2.0.1 - Stored XSS to RCE
Xmind 2020 – Persistent Cross-Site Scripting
# Exploit Title: Xmind 2020 - XSS to RCE
Markdown Explorer 0.1.1 – Persistent Cross-Site Scripting
# Exploit Title: Markdown Explorer 0.1.1 - XSS to RCE
Savsoft Quiz 5 – ‘User Account Settings’ Persistent Cross-Site Scripting
# Exploit Title: Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting
Internship Portal Management System 1.0 – Remote Code Execution(Unauthenticated)
# Exploit Title: Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated)
GitLab Community Edition (CE) 13.10.3 – ‘Sign_Up’ User Enumeration
# Exploit Title: GitLab Community Edition (CE) 13.10.3 - 'Sign_Up' User Enumeration
GitLab Community Edition (CE) 13.10.3 – User Enumeration
# Exploit Title: GitLab Community Edition (CE) 13.10.3 - User Enumeration
Piwigo 11.3.0 – ‘language’ SQL
# Exploit Title: Piwigo 11.3.0 - 'language' SQL
Voting System 1.0 – Time based SQLI (Unauthenticated SQL injection)
# Exploit Title: Voting System 1.0 - Time based SQLI (Unauthenticated SQL injection)
GetSimple CMS Custom JS 0.1 – Cross-Site Request Forgery
# Exploit Title: GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE
Moodle 3.6.1 – Persistent Cross-Site Scripting (XSS)
# Exploit Title: Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)
NodeBB Plugin Emoji 3.2.1 – Arbitrary File Write
# Exploit Title: NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write
FOGProject 1.5.9 – File Upload RCE (Authenticated)
# Exploit Title: FOGProject 1.5.9 - File Upload RCE (Authenticated)
Cacti 1.2.12 – ‘filter’ SQL Injection
# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution
Kirby CMS 3.5.3.1 – ‘file’ Cross-Site Scripting (XSS)
# Exploit Title: Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)