Basic Shopping Cart 1.0 – Authentication Bypass
# Exploit Title: Basic Shopping Cart 1.0 - Authentication Bypass
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Simple Food Website 1.0 – Authentication Bypass
# Exploit Title: Simple Food Website 1.0 - Authentication Bypass
F5 BIG-IP 16.0.x – iControl REST Remote Code Execution (Unauthenticated)
# Exploit Title: F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated)
ZBL EPON ONU Broadband Router 1.0 – Remote Privilege Escalation
# Exploit Title: ZBL EPON ONU Broadband Router 1.0 - Remote Privilege Escalation
phpPgAdmin 7.13.0 – COPY FROM PROGRAM Command Execution (Authenticated)
# Exploit Title: phpPgAdmin 7.13.0 - COPY FROM PROGRAM Command Execution (Authenticated)
ScadaBR 1.0 – Arbitrary File Upload (Authenticated) (2)
# Exploit Title: ScadaBR 1.0 - Arbitrary File Upload (Authenticated) (2)
ScadaBR 1.0 – Arbitrary File Upload (Authenticated) (1)
# Exploit Title: ScadaBR 1.0 - Arbitrary File Upload (Authenticated) (1)
Latrix 0.6.0 – ‘txtaccesscode’ SQL Injection
# Exploit Title: Latrix 0.6.0 – 'txtaccesscode' SQL Injection
CourseMS 2.1 – ‘name’ Stored XSS
# Exploit Title: CourseMS 2.1 - 'name' Stored XSS
Zabbix 3.4.7 – Stored XSS
# Exploit Title: Zabbix 3.4.7 - Stored XSS
Openlitespeed 1.7.9 – ‘Notes’ Stored Cross-Site Scripting
# Exploit Title: Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting
GetSimple CMS 3.3.16 – Persistent Cross-Site Scripting
# Exploit Title: GetSimple CMS 3.3.16 - Reflected XSS to RCE
SyncBreeze 10.1.16 – XML Parsing Stack-based Buffer Overflow
# Exploit Title: SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow
Novel Boutique House-plus 3.5.1 – Arbitrary File Download
# Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download
Budget Management System 1.0 – ‘Budget title’ Stored XSS
# Exploit Title: Budget Management System 1.0 - 'Budget title' Stored XSS
Equipment Inventory System 1.0 – ‘multiple’ Stored XSS
# Exploit Title: Equipment Inventory System 1.0 - 'multiple' Stored XSS
Concrete5 8.5.4 – ‘name’ Stored XSS
# Exploit Title: Concrete5 8.5.4 - 'name' Stored XSS
TP-Link Devices – ‘setDefaultHostname’ Stored Cross-site Scripting (Unauthenticated)
# Exploit Title: TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)
WordPress Plugin WP Super Cache 1.7.1 – Remote Code Execution (Authenticated)
# Exploit Title: WordPress Plugin WP Super Cache 1.7.1 - Remote Code Execution (Authenticated)
Moodle 3.10.3 – ‘label’ Persistent Cross Site Scripting
# Exploit Title: Moodle 3.10.3 - 'label' Persistent Cross Site Scripting
Regis Inventory And Monitoring System 1.0 – ‘Item List’ Persistent Cross-Site Scripting
# Title: Regis Inventory And Monitoring System 1.0 - 'Item List' Persistent Cross-Site Scripting
‘customhs_js_content’ – ‘customhs_js_content’ Cross-Site Request Forgery
# Exploit Title: GetSimple CMS Custom JS Plugin 0.1 - 'customhs_js_content' Cross-Site Request Forgery
Dolibarr ERP 11.0.4 – File Upload Restrictions Bypass (Authenticated RCE)
# Exploit Title: Dolibarr ERP/CRM 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE)
Genexis Platinum-4410 P4410-V2-1.31A – ‘start_addr’ Persistent Cross-Site Scripting
# Exploit Title: Genexis Platinum-4410 P4410-V2-1.31A - 'start_addr' Persistent Cross-Site Scripting
Linksys EA7500 2.0.8.194281 – Cross-Site Scripting
# Exploit Title: Linksys EA7500 2.0.8.194281 - Cross-Site Scripting
Ovidentia 6 – ‘id’ SQL injection (Authenticated)
# Exploit Title: Ovidentia 6 - 'id' SQL injection (Authenticated)
Codiad 2.8.4 – Remote Code Execution (Authenticated)
# Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated)
Hotel And Lodge Management System 1.0 – ‘Customer Details’ Stored XSS
# Exploit Title: Hotel And Lodge Management System 1.0 - 'Customer Details' Stored XSS
MyBB 1.8.25 – Poll Vote Count SQL Injection
# Exploit Title: MyBB 1.8.25 - Poll Vote Count SQL Injection
MyBB 1.8.25 – Chained Remote Command Execution
# Exploit Title: MyBB 1.8.25 - Chained Remote Command Execution
WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 – Path Traversal
# Exploit Title: WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal
Online News Portal 1.0 – ‘Multiple’ Stored Cross-Site Scripting
# Exploit Title: Online News Portal 1.0 - 'Multiple' Stored Cross-Site Scripting
Online News Portal 1.0 – ‘name’ SQL Injection
# Exploit Title: Online News Portal 1.0 - 'name' SQL Injection
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 – Config Download (Unauthenticated)
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Config Download (Unauthenticated)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 – Factory Reset (Unauthenticated)
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Factory Reset (Unauthenticated)
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 – Remote Code Execution
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Remote Code Execution
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 – Authentication Bypass
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Authentication Bypass
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 – Command Injection (Authenticated)
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Command Injection (Authenticated)
SOYAL Biometric Access Control System 5.0 – ‘Change Admin Password’ CSRF
# Exploit Title: SOYAL Biometric Access Control System 5.0 - 'Change Admin Password' CSRF
SOYAL Biometric Access Control System 5.0 – Master Code Disclosure
# Exploit Title: SOYAL Biometric Access Control System 5.0 - Master Code Disclosure
CouchCMS 2.2.1 – Server-Side Request Forgery
# Exploit Title: CouchCMS 2.2.1 - SSRF via SVG file upload
VestaCP 0.9.8 – ‘v_sftp_licence’ Command Injection
# Title: VestaCP 0.9.8 - 'v_sftp_licence' Command Injection
Profiling System for Human Resource Management 1.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Profiling System for Human Resource Management 1.0 - Remote Code Execution (Unauthenticated)
Boonex Dolphin 7.4.2 – ‘width’ Stored XSS
# Exploit Title: Boonex Dolphin 7.4.2 - 'width' Stored XSS
LiveZilla Server 8.0.1.0 – ‘Accept-Language’ Reflected XSS
# Exploit Title: LiveZilla Server 8.0.1.0 - 'Accept-Language' Reflected XSS
Plone CMS 5.2.3 – ‘Title’ Stored XSS
# Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS
Hestia Control Panel 1.3.2 – Arbitrary File Write
# Title: Hestia Control Panel 1.3.2 - Arbitrary File Write
SEO Panel 4.8.0 – ‘order_col’ Blind SQL Injection (1)
# Exploit Title: SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (1)
rConfig 3.9.6 – Arbitrary File Upload to Remote Code Execution (Authenticated) (1)
# Exploit Title: rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1)
VestaCP 0.9.8 – ‘v_interface’ Add IP Stored XSS
# Title: VestaCP 0.9.8 - 'v_interface' Add IP Stored XSS