Joomla JS Jobs plugin 1.4.2 – SQL injection
# Exploit Title: Joomla JS Jobs plugin 1.4.2 - SQL injection
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Pie Register WordPress Plugin 3.7.1.4 – Authentication Bypass to RCE
# Exploit Title: Pie Register WordPress Plugin 3.7.1.4 - Authentication Bypass to RCE
Simple File List WordPress Plugin 4.2.2 – File Upload to RCE
# Exploit Title: Simple File List WordPress Plugin 4.2.2 - File Upload to RCE
WP Publications WordPress Plugin 1.2 – Stored XSS
# Exploit Title: WP Publications WordPress Plugin 1.2 - Stored XSS
White Star Software Protop 4.4.2-2024-11-27 – Local File Inclusion (LFI)
# Exploit Title: White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI)
SugarCRM 14.0.0 – SSRF/Code Injection
# Exploit Title : SugarCRM 14.0.0 - SSRF/Code Injection
Langflow 1.2.x – Remote Code Execution (RCE)
#!/usr/bin/env python3
PivotX 3.0.0 RC3 – Remote Code Execution (RCE)
# Exploit Title: PivotX v3.0.0 RC3 - Stored XSS to Remote Code Execution (RCE)
Discourse 3.2.x – Anonymous Cache Poisoning
#!/usr/bin/env python3
Stacks Mobile App Builder 5.2.3 – Authentication Bypass via Account Takeover
# Exploit Title: Stacks Mobile App Builder 5.2.3 - Authentication Bypass via Account Takeover
Moodle 4.4.0 – Authenticated Remote Code Execution
# Exploit Title: Moodle 4.4.0 - Authenticated Remote Code Execution
Social Warfare WordPress Plugin 3.5.2 – Remote Code Execution (RCE)
#!/usr/bin/env python3
Sitecore 10.4 – Remote Code Execution (RCE)
# Exploit Title: Sitecore 10.4 - Remote Code Execution (RCE)
Pterodactyl Panel 1.11.11 – Remote Code Execution (RCE)
# Exploit Title: Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE)
Skyvern 0.1.85 – Remote Code Execution (RCE) via SSTI
# Exploit Title: Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI
PHP CGI Module 8.3.4 – Remote Code Execution (RCE)
#!/usr/bin/env python3
Litespeed Cache WordPress Plugin 6.3.0.1 – Privilege Escalation
# Exploit Title: Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation
Anchor CMS 0.12.7 – Stored Cross Site Scripting (XSS)
# Exploit Title: Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS)
Laravel Pulse 1.3.1 – Arbitrary Code Injection
#!/usr/bin/env python3
CloudClassroom PHP Project 1.0 – SQL Injection
# Exploit Title: CloudClassroom PHP Project 1.0 - SQL Injection
WordPress Digits Plugin 8.4.6.1 – Authentication Bypass via OTP Bruteforcing
# Exploit Title: WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing
Campcodes Online Hospital Management System 1.0 – SQL Injection
# Exploit Title: Campcodes Online Hospital Management System 1.0 - SQL Injection
Java-springboot-codebase 1.1 – Arbitrary File Read
# Exploit Title: Java-springboot-codebase 1.1 - Arbitrary File Read
WordPress User Registration & Membership Plugin 4.1.2 – Authentication Bypass
#!/usr/bin/env python3
Kentico Xperience 13.0.178 – Cross Site Scripting (XSS)
# Exploit Title: Kentico Xperience 13.0.178 - Cross Site Scripting (XSS)
WordPress Frontend Login and Registration Blocks Plugin 1.0.7 – Privilege Escalation
# Exploit Title: WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
SureTriggers OttoKit Plugin 1.0.82 – Privilege Escalation
# Exploit Title: SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation
WordPress Depicter Plugin 3.6.1 – SQL Injection
# Exploit Title: WordPress Depicter Plugin 3.6.1 - SQL Injection
ERPNext 14.82.1 – Account Takeover via Cross-Site Request Forgery (CSRF)
# Exploit Title: ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery (CSRF)
Grokability Snipe-IT 8.0.4 – Insecure Direct Object Reference (IDOR)
# Exploit Title: Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)
Casdoor 1.901.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: Casdoor 1.901.0 - Cross-Site Request Forgery (CSRF)
WordPress Core 6.2 – Directory Traversal
# Exploit Title: WordPress Core 6.2 - Directory Traversal
FoxCMS 1.2.5 – Remote Code Execution (RCE)
# Date: 2025-04-17
Drupal 11.x-dev – Full Path Disclosure
#!/usr/bin/env python
KiviCare Clinic & Patient Management System (EHR) 3.6.4 – Unauthenticated SQL Injection
# Exploit Title: KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection
UJCMS 9.6.3 – User Enumeration via IDOR
# Exploit Title: UJCMS 9.6.3 User Enumeration via IDOR
Inventio Lite 4 – SQL Injection
# Exploit Title: Inventio Lite 4 - SQL Injection
Apache Commons Text 1.10.0 – Remote Code Execution
# Exploit Title: Apache Commons Text 1.10.0 - Remote Code Execution
Tatsu 3.3.11 – Unauthenticated RCE
# Exploit Title:Tatsu 3.3.11 - Unauthenticated RCE
Hunk Companion Plugin 1.9.0 – Unauthenticated Plugin Installation
# Exploit Title: Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation
compop.ca 3.5.3 – Arbitrary code Execution
# Exploit Title: compop.ca 3.5.3 - Arbitrary code Execution
Blood Bank & Donor Management System 2.4 – CSRF Improper Input Validation
#Exploit Title: Blood Bank & Donor Management System 2.4 - CSRF Improper
Usermin 2.100 – Username Enumeration
# Exploit Title: Usermin 2.100 - Username Enumeration
Angular-Base64-Upload Library 0.1.21 – Unauthenticated Remote Code Execution (RCE)
# Exploit Title: Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
Smart Manager 8.27.0 – Post-Authenticated SQL Injection
# Exploit Title: Smart Manager 8.27.0 - Post-Authenticated SQL Injection
KodExplorer 4.52 – Open Redirect
# Exploit Title: KodExplorer 4.52 - Open Redirect
Car Rental Project 1.0 – Remote Code Execution
# Exploit Title: Car Rental Project 1.0 - Remote Code Execution
Ethercreative Logs 3.0.3 – Path Traversal
# Exploit Title: Ethercreative Logs 3.0.3 - Path Traversal
FLIR AX8 1.46.16 – Remote Command Injection
# Exploit Title: FLIR AX8 1.46.16 - Remote Command Injection