VestaCP 0.9.8 – File Upload CSRF
# Exploit Title: VestaCP 0.9.8 - File Upload CSRF
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
WoWonder Social Network Platform 3.1 – ‘event_id’ SQL Injection
# Exploit Title: WoWonder Social Network Platform 3.1 - 'event_id' SQL Injection
Alphaware E-Commerce System 1.0 – Unauthenicated Remote Code Execution (File Upload + SQL injection)
# Exploit Title: Alphaware E-Commerce System 1.0 - Unauthenicated Remote Code Execution (File Upload + SQL injection)
Sonlogger 4.2.3.3 – SuperAdmin Account Creation / Information Disclosure
# Exploit Title: Sonlogger 4.2.3.3 - SuperAdmin Account Creation / Information Disclosure
openMAINT openMAINT 2.1-3.3-b – ‘Multiple’ Persistent Cross-Site Scripting
# Exploit Title: openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting
rConfig 3.9.6 – ‘path’ Local File Inclusion (Authenticated)
# Exploit Title: rConfig 3.9.6 - 'path' Local File Inclusion (Authenticated)
MagpieRSS 0.72 – ‘url’ Command Injection
# Exploit Title: MagpieRSS 0.72 - 'url' Command Injection and Server Side Request Forgery
Zenario CMS 8.8.53370 – ‘id’ Blind SQL Injection
# Exploit Title: Zenario CMS 8.8.53370 - 'id' Blind SQL Injection
Monitoring System (Dashboard) 1.0 – File Upload RCE (Authenticated)
# Exploit Title: Monitoring System (Dashboard) 1.0 - File Upload RCE (Authenticated)
Monitoring System (Dashboard) 1.0 – ‘uname’ SQL Injection
# Exploit Title: Monitoring System (Dashboard) 1.0 - 'uname' SQL Injection
Microsoft Exchange 2019 – Server-Side Request Forgery (Proxylogon) (PoC)
# Exploit Title: Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon)
CouchCMS 2.2.1 – Persistent Cross-Site Scripting
# Exploit Title: CouchCMS 2.2.1 - XSS via SVG file upload
MyBB OUGC Feedback Plugin 1.8.22 – Cross-Site Scripting
# Exploit Title: MyBB OUGC Feedback Plugin 1.8.22 - Cross-Site Scripting
NuCom 11N Wireless Router 5.07.90 – Remote Privilege Escalation
# Exploit Title: NuCom 11N Wireless Router 5.07.90 - Remote Privilege Escalation
Atlassian JIRA 8.11.1 – User Enumeration
# Title: Atlassian JIRA 8.11.1 - User Enumeration
GLPI 9.5.3 – ‘fromtype’ Unsafe Reflection
# Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection
Joomla JCK Editor 6.4.4 – ‘parent’ SQL Injection (2)
# Exploit Title: Joomla JCK Editor 6.4.4 - 'parent' SQL Injection (2)
Hotel and Lodge Management System 1.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated)
Fluig 1.7.0 – Path Traversal
# Exploit Title: Fluig 1.7.0 - Path Traversal
Textpattern 4.8.3 – Remote code execution (Authenticated) (2)
# Exploit Title: Textpattern 4.8.3 - Remote code execution (Authenticated) (2)
Web Based Quiz System 1.0 – ‘eid’ Union Based Sql Injection (Authenticated)
# Exploit Title: Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated)
Online Ordering System 1.0 – Blind SQL Injection (Unauthenticated)
# Exploit Title: Online Ordering System 1.0 - Blind SQL Injection (Unauthenticated)
Textpattern CMS 4.9.0-dev – ‘Excerpt’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Textpattern CMS 4.9.0-dev - 'Excerpt' Persistent Cross-Site Scripting (XSS)
Textpattern CMS 4.8.4 – ‘Comments’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Textpattern CMS 4.8.4 - 'Comments' Persistent Cross-Site Scripting (XSS)
Online Ordering System 1.0 – Arbitrary File Upload
# Exploit Title: Online Ordering System 1.0 - Arbitrary File Upload to Remote Code Execution
e107 CMS 2.3.0 – CSRF
# Exploit Title: e107 CMS 2.3.0 - CSRF
Local Services Search Engine Management System (LSSMES) 1.0 – Blind & Error based SQL injection (Authenticated)
# Exploit Title: Local Services Search Engine Management System (LSSMES) 1.0 - Blind & Error based SQL injection (Aut...
Local Services Search Engine Management System (LSSMES) 1.0 – ‘name’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Local Services Search Engine Management System (LSSMES) 1.0 - 'name' Persistent Cross-Site Scripting...
Web Based Quiz System 1.0 – ‘name’ Persistent Cross-Site Scripting
# Exploit Title: Web Based Quiz System 1.0 - 'name' Persistent/Stored Cross-Site Scripting
Tiny Tiny RSS – Remote Code Execution
# Exploit Title: Tiny Tiny RSS - Remote Code Execution
Web Based Quiz System 1.0 – ‘MCQ options’ Persistent Cross-Site Scripting
# Exploit Title: Web Based Quiz System 1.0 - 'MCQ options' Persistent/Stored Cross-Site Scripting
Covid-19 Contact Tracing System 1.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Covid-19 Contact Tracing System 1.0 - Remote Code Execution (Unauthenticated)
Online Catering Reservation System 1.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Online Catering Reservation System 1.0 - Unauthenticated Remote Code Execution
VMware vCenter Server 7.0 – Unauthenticated File Upload
# Exploit Title: VMware vCenter Server 7.0 - Unauthenticated File Upload
LightCMS 1.3.4 – ‘exclusive’ Stored XSS
# Exploit Title: LightCMS 1.3.4 - 'exclusive' Stored XSS
Triconsole 3.75 – Reflected XSS
# Exploit Title: Triconsole 3.75 - Reflected XSS
Simple Employee Records System 1.0 – File Upload RCE (Unauthenticated)
# Exploit Title: Simple Employee Records System 1.0 - File Upload RCE (Unauthenticated)
Vehicle Parking Management System 1.0 – ‘catename’ Persistent Cross-Site Scripting (XSS)
# Exploit Title: Vehicle Parking Management System 1.0 - 'catename' Persistent Cross-Site Scripting (XSS)
LayerBB 1.1.4 – ‘search_query’ SQL Injection
# Exploit Title: LayerBB 1.1.4 - 'search_query' SQL Injection
Batflat CMS 1.3.6 – ‘multiple’ Stored XSS
# Exploit Title: Batflat CMS 1.3.6 - 'multiple' Stored XSS
Monica 2.19.1 – ‘last_name’ Stored XSS
# Exploit Title: Monica 2.19.1 - 'last_name' Stored XSS
Beauty Parlour Management System 1.0 – ‘sername’ SQL Injection
# Exploit Title: Beauty Parlour Management System 1.0 - 'sername' SQL Injection
OpenText Content Server 20.3 – ‘multiple’ Stored Cross-Site Scripting
# Exploit Title: OpenText Content Server 20.3 - 'multiple' Stored Cross-Site Scripting
Online Exam System With Timer 1.0 – ’email’ SQL injection Auth Bypass
# Exploit Title: Online Exam System With Timer 1.0 - 'email' SQL injection Auth Bypass
Comment System 1.0 – ‘multiple’ Stored Cross-Site Scripting
# Exploit Title: Comment System 1.0 - 'multiple' Stored Cross-Site Scripting
PEEL Shopping 9.3.0 – ‘Comments’ Persistent Cross-Site Scripting
# Exploit Title: PEEL Shopping 9.3.0 - 'Comments/Special Instructions' Stored Cross-Site Scripting
Batflat CMS 1.3.6 – Remote Code Execution (Authenticated)
# Exploit Title: Batflat CMS 1.3.6 - Remote Code Execution (Authenticated)