Gitea 1.12.5 – Remote Code Execution (Authenticated)
# Exploit Title: Gitea 1.12.5 - Remote Code Execution (Authenticated)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Billing Management System 2.0 – ’email’ SQL injection Auth Bypass
# Exploit Title: Billing Management System 2.0 - 'email' SQL injection Auth Bypass
Faulty Evaluation System 1.0 – ‘multiple’ Stored Cross-Site Scripting
# Exploit Title: Faulty Evaluation System 1.0 - 'multiple' Stored Cross-Site Scripting
BlackCat CMS 1.3.6 – ‘Display name’ Cross Site Scripting (XSS)
# Exploit Title: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)
Online Internship Management System 1.0 – ’email’ SQL injection Auth Bypass
# Exploit Title: Online Internship Management System 1.0 - 'email' SQL injection Auth Bypass
Teachers Record Management System 1.0 – ‘searchteacher’ SQL Injection
# Exploit Title: Teachers Record Management System 1.0 - 'searchteacher' SQL Injection
TestLink 1.9.20 – Unrestricted File Upload (Authenticated)
# Exploit Title: TestLink 1.9.20 - Unrestricted File Upload (Authenticated)
School Event Attendance Monitoring System 1.0 – ‘Item Name’ Stored Cross-Site Scripting
# Exploit Title: School Event Attendance Monitoring System 1.0 - 'Item Name' Stored Cross-Site Scripting
School File Management System 1.0 – ‘multiple’ Stored Cross-Site Scripting
# Exploit Title: School File Management System 1.0 - 'multiple' Stored Cross-Site Scripting
Online Marriage Registration System (OMRS) 1.0 – Remote code execution (3)
# Exploit Title: Online Marriage Registration System (OMRS) 1.0 - Remote code execution (3)
Openlitespeed WebServer 1.7.8 – Command Injection (Authenticated) (2)
# Exploit Title: Openlitespeed WebServer 1.7.8 - Command Injection (Authenticated) (2)
b2evolution 6.11.6 – ‘tab3’ Reflected XSS
# Exploit Title: b2evolution 6.11.6 - 'tab3' Reflected XSS
b2evolution 6.11.6 – ‘redirect_to’ Open Redirect
# Exploit Title: b2evolution 6.11.6 - 'redirect_to' Open Redirect
PEEL Shopping 9.3.0 – ‘address’ Stored Cross-Site Scripting
# Exploit Title: PEEL Shopping 9.3.0 - 'address' Stored Cross-Site Scripting
Node.JS – ‘node-serialize’ Remote Code Execution (2)
# Exploit Title: Node.JS - 'node-serialize' Remote Code Execution (2)
b2evolution 6.11.6 – ‘plugin name’ Stored XSS
# Exploit Title: b2evolution 6.11.6 - 'plugin name' Stored XSS
Adobe Connect 10 – Username Disclosure
# Title: Adobe Connect 10 - Username Disclosure
Online Car Rental System 1.0 – Stored Cross Site Scripting
# Exploit Title: Online Car Rental System 1.0 - Stored Cross Site Scripting
WordPress Plugin Supsystic Backup 2.3.9 – Local File Inclusion
# Exploit Title: WordPress Plugin Supsystic Backup 2.3.9 - Local File Inclusion
WordPress Plugin Supsystic Contact Form 1.7.5 – Multiple Vulnerabilities
# Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.5 - Multiple Vulnerabilities
WordPress Plugin Supsystic Data Tables Generator 1.9.96 – Multiple Vulnerabilities
# Exploit Title: WordPress Plugin Supsystic Data Tables Generator 1.9.96 - Multiple Vulnerabilities
WordPress Plugin Supsystic Digital Publications 1.6.9 – Multiple Vulnerabilities
# Exploit Title: WordPress Plugin Supsystic Digital Publications 1.6.9 - Multiple Vulnerabilities
WordPress Plugin Supsystic Membership 1.4.7 – ‘sidx’ SQL injection
# Exploit Title: WordPress Plugin Supsystic Membership 1.4.7 - 'sidx' SQL injection
WordPress Plugin Supsystic Newsletter 1.5.5 – ‘sidx’ SQL injection
# Exploit Title: WordPress Plugin Supsystic Newsletter 1.5.5 - 'sidx' SQL injection
Alt-N MDaemon webmail 20.0.0 – ‘file name’ Stored Cross Site Scripting (XSS)
# Exploit Title: Alt-N MDaemon webmail 20.0.0 - 'file name' Stored Cross Site Scripting (XSS)
Alt-N MDaemon webmail 20.0.0 – ‘Contact name’ Stored Cross Site Scripting (XSS)
# Exploit Title: Alt-N MDaemon webmail 20.0.0 - 'Contact name' Stored Cross Site Scripting (XSS)
YetiShare File Hosting Script 5.1.0 – ‘url’ Server-Side Request Forgery
# Title: YetiShare File Hosting Script 5.1.0 - 'url' Server-Side Request Forgery
WordPress Plugin Supsystic Pricing Table 1.8.7 – Multiple Vulnerabilities
# Exploit Title: WordPress Plugin Supsystic Pricing Table 1.8.7 - Multiple Vulnerabilities
WordPress Plugin Supsystic Ultimate Maps 1.1.12 – ‘sidx’ SQL injection
# Exploit Title: WordPress Plugin Supsystic Ultimate Maps 1.1.12 - 'sidx' SQL injection
WordPress Plugin Welcart e-Commerce 2.0.0 – ‘search[order_column][0]’ SQL injection
# Exploit Title: WordPress Plugin Welcart e-Commerce 2.0.0 - 'search[order_column][0]' SQL injection
Jenzabar 9.2.2 – ‘query’ Reflected XSS.
# Exploit Title: Jenzabar 9.2.2 - 'query' Reflected XSS.
SmartFoxServer 2X 2.17.0 – God Mode Console WebSocket XSS
# Exploit Title: SmartFoxServer 2X 2.17.0 - God Mode Console WebSocket XSS
SEO Panel 4.6.0 – Remote Code Execution (2)
# Exploit Title: SEO Panel 4.6.0 - Remote Code Execution (2)
PhreeBooks 5.2.3 ERP – Remote Code Execution (2)
# Exploit Title: PhreeBooks 5.2.3 - Remote Code Execution
LiteSpeed Web Server Enterprise 5.4.11 – Command Injection (Authenticated)
# Exploit Title: LiteSpeed Web Server Enterprise 5.4.11 - Command Injection (Authenticated)
Car Rental Project 2.0 – Arbitrary File Upload to Remote Code Execution
# Exploit Title: Car Rental Project 2.0 - Arbitrary File Upload to Remote Code Execution
Pixelimity 1.0 – ‘password’ Cross-Site Request Forgery
# Exploit Title: Pixelimity 1.0 - 'password' Cross-Site Request Forgery
Student Record System 4.0 – ‘cid’ SQL Injection
# Exploit Title: Student Record System 4.0 - 'cid' SQL Injection
WordPress 5.0.0 – Image Remote Code Execution
# Exploit Title: WordPress 5.0.0 - Image Remote Code Execution
Klog Server 2.4.1 – Command Injection (Authenticated)
# Exploit Title: Klog Server 2.4.1 - Command Injection (Authenticated)
Roundcube Webmail 1.2 – File Disclosure
# Exploit Title: Roundcube Webmail 1.2 - File Disclosure
Vehicle Parking Tracker System 1.0 – ‘Owner Name’ Stored Cross-Site Scripting
# Exploit Title: Vehicle Parking Tracker System 1.0 - 'Owner Name' Stored Cross-Site Scripting
H8 SSRMS – ‘id’ IDOR
# Exploit Title: H8 SSRMS - 'id' IDOR
bloofoxCMS 0.5.2.1 – CSRF (Add user)
# Title: bloofoxCMS 0.5.2.1 - CSRF (Add user)
MyBB Thread Redirect Plugin 0.2.1 – Cross-Site Scripting
# Exploit Title: MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting
MyBB Trending Widget Plugin 1.2 – Cross-Site Scripting
# Exploit Title: MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting
Park Ticketing Management System 1.0 – ‘viewid’ SQL Injection
# Exploit Title: Park Ticketing Management System 1.0 - 'viewid' SQL Injection
User Management System 1.0 – ‘uid’ SQL Injection
# Exploit Title: User Management System 1.0 - 'uid' SQL Injection
Zoo Management System 1.0 – ‘anid’ SQL Injection
# Exploit Title: Zoo Management System 1.0 - 'anid' SQL Injection
MyBB Delete Account Plugin 1.4 – Cross-Site Scripting
# Exploit Title: MyBB Delete Account Plugin 1.4 - Cross-Site Scripting