Life Insurance Management System 1.0 – File Upload RCE (Authenticated)
# Exploit Title: Life Insurance Management System 1.0 - File Upload RCE (Authenticated)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Life Insurance Management System 1.0 – ‘client_id’ SQL Injection
# Exploit Title: Life Insurance Management System 1.0 - 'client_id' SQL Injection
Xwiki CMS 12.10.2 – Cross Site Scripting (XSS)
# Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting (XSS)
Cisco UCS Manager 2.2(1d) – Remote Command Execution
# Exploit Title: Cisco UCS Manager 2.2(1d) - Remote Command Execution
E-Learning System 1.0 – Authentication Bypass
# Exploit Title: E-Learning System 1.0 - Authentication Bypass & RCE
Alumni Management System 1.0 – “Last Name field in Registration page” Stored XSS
# Exploit Title: Alumni Management System 1.0 - "Last Name field in Registration page" Stored XSS
EyesOfNetwork 5.3 – File Upload Remote Code Execution
# Exploit Title: EyesOfNetwork 5.3 - File Upload Remote Code Execution
Online Hotel Reservation System 1.0 – ‘person’ time-based SQL Injection
# Exploit Title: Online Hotel Reservation System 1.0 - 'person' time-based SQL Injection
Online Hotel Reservation System 1.0 – Cross-site request forgery (CSRF)
# Exploit Title: Online Hotel Reservation System 1.0 - Cross-site request forgery (CSRF)
Online Hotel Reservation System 1.0 – ‘id’ Time-based SQL Injection
# Exploit Title: Online Hotel Reservation System 1.0 - 'id' Time-based SQL Injection
Online Hotel Reservation System 1.0 – ‘description’ Stored Cross-site Scripting
# Exploit Title: Online Hotel Reservation System 1.0 - Stored Cross-site Scripting
WordPress Plugin Easy Contact Form 1.1.7 – ‘Name’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting (XSS)
PHP-Fusion CMS 9.03.90 – Cross-Site Request Forgery (Delete admin shoutbox message)
# Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
Laravel 8.4.2 debug mode – Remote code execution
# Exploit Title: Laravel 8.4.2 debug mode - Remote code execution
Online Shopping Cart System 1.0 – ‘id’ SQL Injection
# Exploit Title: Online Shopping Cart System 1.0 - 'id' SQL Injection
Nagios XI 5.7.X – Remote Code Execution RCE (Authenticated)
# Exploit Title: Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)
Online Movie Streaming 1.0 – Admin Authentication Bypass
# Exploit Title: Online Movie Streaming 1.0 - Admin Authentication Bypass
Online Hotel Reservation System 1.0 – Admin Authentication Bypass
# Exploit Title: Online Hotel Reservation System 1.0 - Admin Authentication Bypass
SmartAgent 3.1.0 – Privilege Escalation
# Exploit Title: SmartAgent 3.1.0 - Privilege Escalation
Cemetry Mapping and Information System 1.0 – Multiple SQL Injections
# Exploit Title: Cemetry Mapping and Information System 1.0 - Multiple SQL Injections
Gila CMS 2.0.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Gila CMS 2.0.0 - Remote Code Execution (Unauthenticated)
Prestashop 1.7.7.0 – ‘id_product’ Time Based Blind SQL Injection
# Exploit Title: Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection
OpenCart 3.0.36 – ATO via Cross Site Request Forgery
# Exploit Title: OpenCart 3.0.36 - ATO via Cross Site Request Forgery
WordPress Plugin Custom Global Variables 1.0.5 – ‘name’ Stored Cross-Site Scripting (XSS)
# Exploit Title: WordPress Plugin Custom Global Variables 1.0.5 - 'name' Stored Cross-Site Scripting (XSS)
Cemetry Mapping and Information System 1.0 – Multiple Stored Cross-Site Scripting
# Exploit Title: Cemetry Mapping and Information System 1.0 - Multiple Stored Cross-Site Scripting
EyesOfNetwork 5.3 – LFI
# Exploit Title: EyesOfNetwork 5.3 - LFI
Anchor CMS 0.12.7 – ‘markdown’ Stored Cross-Site Scripting
# Exploit Title: Anchor CMS 0.12.7 - 'markdown' Stored Cross-Site Scripting
EyesOfNetwork 5.3 – RCE & PrivEsc
# Exploit Title: EyesOfNetwork 5.3 - RCE & PrivEsc
Cockpit Version 234 – Server-Side Request Forgery (Unauthenticated)
# Exploit Title: Cockpit Version 234 - Server-Side Request Forgery (Unauthenticated)
Online Doctor Appointment System 1.0 – ‘Multiple’ Stored XSS
# Exploit Title: Online Doctor Appointment System 1.0 - 'Multiple' Stored XSS
Life Insurance Management System 1.0 – Multiple Stored XSS
# Exploit Title: Life Insurance Management System 1.0 - Multiple Stored XSS
CRUD Operation 1.0 – Multiple Stored XSS
# Exploit Title: CRUD Operation 1.0 - Multiple Stored XSS
ECSIMAGING PACS 6.21.5 – SQL injection
# Exploit Title: ECSIMAGING PACS 6.21.5 - SQL injection
Curfew e-Pass Management System 1.0 – Stored XSS
# Exploit Title: Curfew e-Pass Management System 1.0 - Stored XSS
Cockpit CMS 0.6.1 – Remote Code Execution
# Cockpit CMS 0.6.1 - Remote Code Execution
Employee Record System 1.0 – Unrestricted File Upload to Remote Code Execution
# Exploit Title: Employee Record System 1.0 - Unrestricted File Upload to Remote Code Execution
ECSIMAGING PACS 6.21.5 – Remote code execution
# Exploit Title: ECSIMAGING PACS 6.21.5 - Remote code execution
iBall-Baton WRA150N Rom-0 Backup – File Disclosure (Sensitive Information)
# Exploit Title: iBall-Baton WRA150N Rom-0 Backup - File Disclosure (Sensitive Information)
Sonatype Nexus 3.21.1 – Remote Code Execution (Authenticated)
# Exploit Title: Sonatype Nexus 3.21.1 - Remote Code Execution (Authenticated)
Gitea 1.7.5 – Remote Code Execution
# Exploit Title: Gitea 1.7.5 - Remote Code Execution
Resumes Management and Job Application Website 1.0 – RCE (Unauthenticated)
# Exploit Title: Resumes Management and Job Application Website 1.0 - RCE (Unauthenticated)
Newgen Correspondence Management System (corms) eGov 12.0 – IDOR
# Exploit Title: Newgen Correspondence Management System (corms) eGov 12.0 - IDOR
WordPress Plugin WP24 Domain Check 1.6.2 – ‘fieldnameDomain’ Stored Cross Site Scripting
# Exploit Title: WordPress Plugin WP24 Domain Check 1.6.2 - 'fieldnameDomain' Stored Cross Site Scripting
Responsive E-Learning System 1.0 – Stored Cross Site Scripting
# Exploit Title: Responsive E-Learning System 1.0 – Stored Cross Site Scripting
Responsive E-Learning System 1.0 – Unrestricted File Upload to RCE
# Exploit Title: Responsive E-Learning System 1.0 - Unrestricted File Upload to RCE
WordPress Plugin litespeed cache 3.6 – ‘server_ip’ Cross-Site Scripting
# Exploit Title: WordPress Plugin litespeed-cache 3.6 - 'server_ip' Cross-Site Scripting