webapps

webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。

SonicWall SSL-VPN 8.0.0.0 – ‘visualdoor’ Remote Code Execution (Unauthenticated)

# Exploit Title: SonicWall SSL-VPN 8.0.0.0 - 'shellshock/visualdoor' Remote Code Execution (Unauthenticated)

2021-01-29 Darren Martyn webapps

Simple Public Chat Room 1.0 – ‘msg’ Stored Cross-Site Scripting

# Exploit Title: Simple Public Chat Room 1.0 - 'msg' Stored Cross-Site Scripting

2021-01-29 Richard Jones webapps

Simple Public Chat Room 1.0 – Authentication Bypass SQLi

# Exploit Title: Simple Public Chat Room 1.0 - Authentication Bypass SQLi

2021-01-29 Richard Jones webapps

MyBB Hide Thread Content Plugin 1.0 – Information Disclosure

# Exploit Title: MyBB Hide Thread Content Plugin 1.0 - Information Disclosure

2021-01-29 0xB9 webapps

Home Assistant Community Store (HACS) 1.10.0 – Directory Traversal

# Exploit Title: Home Assistant Community Store (HACS) 1.10.0 - Path Traversal to Account Takeover

2021-01-29 Lyghtnox webapps

Quick.CMS 6.7 – Remote Code Execution (Authenticated)

# Exploit Title: Quick.CMS 6.7 - Remote Code Execution (Authenticated)

2021-01-29 mari0x00 webapps

Online Grading System 1.0 – ‘uname’ SQL Injection

# Exploit Title: Online Grading System 1.0 - 'uname' SQL Injection

2021-01-29 Ruchi Tiwari webapps

BloofoxCMS 0.5.2.1 – ‘text’ Stored Cross Site Scripting

# Title: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting

2021-01-29 LiPeiYi webapps

WordPress Plugin SuperForms 4.9 – Arbitrary File Upload

# Exploit Title: WordPress Plugin SuperForms 4.9 - Arbitrary File Upload to Remote Code Execution

2021-01-28 ABDO10 webapps

Umbraco CMS 7.12.4 – Remote Code Execution (Authenticated)

# Exploit Title: Umbraco CMS 7.12.4 - Remote Code Execution (Authenticated)

2021-01-28 Alexandre ZANNI webapps

Fuel CMS 1.4.1 – Remote Code Execution (2)

# Title: Fuel CMS 1.4.1 - Remote Code Execution (2)

2021-01-28 Alexandre ZANNI webapps

OpenEMR 5.0.1 – Remote Code Execution (Authenticated) (2)

# Title: OpenEMR 5.0.1 - Remote Code Execution (Authenticated) (2)

2021-01-28 Alexandre ZANNI webapps

CMSUno 1.6.2 – ‘lang’ Remote Code Execution (Authenticated)

# Exploit Title: CMSUno 1.6.2 - 'lang/user' Remote Code Execution (Authenticated)

2021-01-28 Alexandre ZANNI webapps

EgavilanMedia PHPCRUD 1.0 – ‘Full Name’ Stored Cross Site Scripting

# Exploit Title: EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting

2021-01-28 Mahendra Purbia webapps

Openlitespeed Web Server 1.7.8 – Command Injection (Authenticated) (1)

# Exploit Title: Openlitespeed WebServer 1.7.8 - Command Injection (Authenticated)

2021-01-27 SunCSR webapps

STVS ProVision 5.9.10 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: STVS ProVision 5.9.10 - Cross-Site Request Forgery (Add Admin)

2021-01-27 LiquidWorm webapps

STVS ProVision 5.9.10 – File Disclosure (Authenticated)

# Exploit Title: STVS ProVision 5.9.10 - File Disclosure (Authenticated)

2021-01-27 LiquidWorm webapps

Oracle WebLogic Server 12.2.1.0 – RCE (Unauthenticated)

# Exploit Title: Oracle WebLogic Server 12.2.1.0 - RCE (Unauthenticated)

2021-01-26 CHackA0101 webapps

Tenda AC5 AC1200 Wireless – ‘WiFi Name & Password’ Stored Cross Site Scripting

# Exploit Title: Tenda AC5 AC1200 Wireless - 'WiFi Name & Password' Stored Cross Site Scripting

2021-01-26 Chiragh Arora webapps

Simple College Website 1.0 – ‘full’ Stored Cross Site Scripting

# Exploit Title: Simple College Website 1.0 - 'full' Stored Cross Site Scripting

2021-01-26 Marco Catalano webapps

Simple College Website 1.0 – ‘name’ Sql Injection (Authentication Bypass)

# Exploit Title: Simple College Website 1.0 - 'name' Sql Injection (Authentication Bypass)

2021-01-26 Marco Catalano webapps

Cemetry Mapping and Information System 1.0 – ‘user_email’ Sql Injection (Authentication Bypass)

# Exploit Title: Cemetry Mapping and Information System 1.0 - 'user_email' Sql Injection (Authentication Bypass)

2021-01-26 Marco Catalano webapps

Klog Server 2.4.1 – Unauthenticated Command Injection (Metasploit)

##

2021-01-25 Metin Yunus Kandemir webapps

Library System 1.0 – ‘category’ SQL Injection

# Exploit Title: Library System 1.0 - 'category' SQL Injection

2021-01-25 Aitor Herrero webapps

CASAP Automated Enrollment System 1.0 – ‘route’ Stored XSS

# Exploit Title: CASAP Automated Enrollment System 1.0 - 'route' Stored XSS

2021-01-25 Richard Jones webapps

CASAP Automated Enrollment System 1.0 – ‘First Name’ Stored XSS

# Exploit Title: CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS

2021-01-25 Anita Gaud webapps

Collabtive 3.1 – ‘address’ Persistent Cross-Site Scripting

# Exploit Title: Collabtive 3.1 - 'address' Persistent Cross-Site Scripting

2021-01-25 Deha Berkin Bir webapps

MyBB Timeline Plugin 1.0 – Persistent Cross-Site Scripting

# Exploit Title: MyBB Timeline Plugin 1.0 - Cross-Site Scripting / CSRF

2021-01-25 0xB9 webapps

Atlassian Confluence Widget Connector Macro – SSTI

# Exploit Title: Atlassian Confluence Widget Connector Macro - SSTI

2021-01-22 46o60 webapps

ERPNext 12.14.0 – SQL Injection (Authenticated)

# Exploit Title: ERPNext 12.14.0 - SQL Injection (Authenticated)

2021-01-22 Hodorsec webapps

CASAP Automated Enrollment System 1.0 – Authentication Bypass

# Exploit Title: CASAP Automated Enrollment System 1.0 - Authentication Bypass

2021-01-22 Himanshu Shukla webapps

Library System 1.0 – Authentication Bypass

# Exploit Title: Library System 1.0 - Authentication Bypass Via SQL Injection

2021-01-22 Himanshu Shukla webapps

Oracle WebLogic Server 14.1.1.0 – RCE (Authenticated)

# Exploit Title: Oracle WebLogic Server 14.1.1.0 - RCE (Authenticated)

2021-01-22 Photubias webapps

Selea Targa IP OCR-ANPR Camera – ‘addr’ Remote Code Execution (Unauthenticated)

# Exploit Title: Selea Targa IP OCR-ANPR Camera - 'addr' Remote Code Execution (Unauthenticated)

2021-01-22 LiquidWorm webapps

Selea Targa 512 IP OCR-ANPR Camera – Stream Disclosure (Unauthenticated)

# Exploit Title: Selea Targa IP OCR-ANPR Camera - RTP/RTSP/M-JPEG Stream Disclosure (Unauthenticated)

2021-01-22 LiquidWorm webapps

Selea Targa IP OCR-ANPR Camera – CSRF Add Admin

# Exploit Title: Selea Targa IP OCR-ANPR Camera - CSRF Add Admin

2021-01-22 LiquidWorm webapps

Selea Targa IP OCR-ANPR Camera – Multiple SSRF (Unauthenticated)

# Exploit Title: Selea Targa IP OCR-ANPR Camera - Multiple SSRF (Unauthenticated)

2021-01-22 LiquidWorm webapps

Selea Targa IP OCR-ANPR Camera – Directory Traversal File Disclosure (Unauthenticated)

# Exploit Title: Selea Targa IP OCR-ANPR Camera - Directory Traversal File Disclosure (Unauthenticated)

2021-01-22 LiquidWorm webapps

Selea Targa IP OCR-ANPR Camera – Developer Backdoor Config Overwrite

# Exploit Title: Selea Targa IP OCR-ANPR Camera - Developer Backdoor Config Overwrite

2021-01-22 LiquidWorm webapps

Selea Targa IP OCR-ANPR Camera – ‘files_list’ Remote Stored XSS

# Exploit Title: Selea Targa IP OCR-ANPR Camera - 'files_list' Remote Stored XSS

2021-01-22 LiquidWorm webapps

Selea CarPlateServer (CPS) 4.0.1.6 – Remote Program Execution

# Exploit Title: Selea CarPlateServer (CPS) 4.0.1.6 - Remote Program Execution

2021-01-22 LiquidWorm webapps

Anchor CMS 0.12.7 – CSRF (Delete user)

# Exploit Title: Anchor CMS 0.12.7 - CSRF (Delete user)

2021-01-21 Ninad Mishra webapps

WordPress Plugin Simple Job Board 2.9.3 – Authenticated File Read (Metasploit)

##

2021-01-21 SunCSR Team webapps

Nagios XI 5.7.5 – Multiple Persistent Cross-Site Scripting

# Exploit Title: Nagios XI 5.7.5 - Multiple Persistent Cross-Site Scripting

2021-01-21 Matthew Aberegg webapps

Apartment Visitors Management System 1.0 – ’email’ SQL Injection

# Exploit Title: Apartment Visitors Management System 1.0 - 'email' SQL Injection

2021-01-21 CANKAT ÇAKMAK webapps

Online Documents Sharing Platform 1.0 – ‘user’ SQL Injection

# Exploit Title: Online Documents Sharing Platform 1.0 - 'user' SQL Injection

2021-01-21 CANKAT ÇAKMAK webapps

Voting System 1.0 – File Upload RCE (Authenticated Remote Code Execution)

# Exploit Title: Voting System 1.0 - File Upload RCE (Authenticated Remote Code Execution)

2021-01-20 Richard Jones webapps

Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 – Stored XSS

# Exploit Title: Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 - Stored XSS

2021-01-20 omurugur webapps

ChurchRota 2.6.4 – RCE (Authenticated)

# Exploit Title: ChurchRota 2.6.4 - RCE (Authenticated)

2021-01-20 Rob McCarthy webapps

osTicket 1.14.2 – SSRF

# Exploit Title: osTicket 1.14.2 - SSRF

2021-01-19 Talat Mehmood webapps