Expense Tracker 1.0 – ‘Expense Name’ Stored Cross-Site Scripting
# Exploit Title: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
IPeakCMS 3.5 – Boolean-based blind SQLi
# Exploit Title: IPeakCMS 3.5 - Boolean-based blind SQLi
Advanced Webhost Billing System 3.7.0 – Cross-Site Request Forgery (CSRF)
# Exploit Title: Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery (CSRF)
Online Movie Streaming 1.0 – Authentication Bypass
# Exploit Title: Online Movie Streaming 1.0 - Authentication Bypass
WordPress Plugin WP-Paginate 2.1.3 – ‘preset’ Stored XSS
# Exploit Title: WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS
WordPress Plugin Stripe Payments 2.0.39 – ‘AcceptStripePayments-settings[currency_code]’ Stored XSS
# Exploit Title: WordPress Plugin Stripe Payments 2.0.39 - 'AcceptStripePayments-settings[currency_code]' Stored XSS
Resumes Management and Job Application Website 1.0 – Authentication Bypass
# Exploit Title: Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection)
IncomCMS 2.0 – Insecure File Upload
# Exploit Title: IncomCMS 2.0 - Insecure File Upload
EgavilanMedia User Registration & Login System with Admin Panel 1.0 – Persistent Cross-Site Scripting
# Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scr...
Klog Server 2.4.1 – Command Injection (Unauthenticated)
# Exploit Title: Klog Server 2.4.1 - Command Injection (Unauthenticated)
Online Learning Management System 1.0 – RCE (Authenticated)
# Exploit Title: Online Learning Management System 1.0 - RCE (Authenticated)
CSZ CMS 1.2.9 – Multiple Cross-Site Scripting
# Exploit Title: CSZ CMS 1.2.9 - Multiple Cross-Site Scripting
Cassandra Web 0.5.0 – Remote File Read
# Exploit Title: Cassandra Web 0.5.0 - Remote File Read
HPE Edgeline Infrastructure Manager 1.0 – Multiple Remote Vulnerabilities
# Exploit Title: HPE Edgeline Infrastructure Manager 1.0 - Multiple Remote Vulnerabilities
Zoom Meeting Connector 4.6.239.20200613 – Remote Root Exploit (Authenticated)
# Exploit Title: Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated)
Responsive FileManager 9.13.4 – ‘path’ Path Traversal
# Exploit Title: Responsive FileManager 9.13.4 - 'path' Path Traversal
Baby Care System 1.0 – ‘Post title’ Stored XSS
# Exploit Title: Baby Care System 1.0 - 'Post title' Stored XSS
Responsive E-Learning System 1.0 – ‘id’ Sql Injection
# Exploit Title: Responsive E-Learning System 1.0 – 'id' Sql Injection
Arteco Web Client DVR/NVR – ‘SessionId’ Brute Force
# Exploit Title: Arteco Web Client DVR/NVR - 'SessionId' Brute Force
Click2Magic 1.1.5 – Stored Cross-Site Scripting
# Exploit Title: Click2Magic 1.1.5 - Stored Cross-Site Scripting
Subrion CMS 4.2.1 – ‘avatar[path]’ XSS
# Exploit Title: Subrion CMS 4.2.1 - 'avatar[path]' XSS
CMS Made Simple 2.2.15 – RCE (Authenticated)
# Exploit Title: CMS Made Simple 2.2.15 - RCE (Authenticated)
sar2html 3.2.1 – ‘plot’ Remote Code Execution
# Exploit Title: sar2html 3.2.1 - 'plot' Remote Code Execution
Advanced Comment System 1.0 – ‘ACS_path’ Path Traversal
# Exploit Title: Advanced Comment System 1.0 - 'ACS_path' Path Traversal
Mantis Bug Tracker 2.24.3 – ‘access’ SQL Injection
# Exploit Title: Mantis Bug Tracker 2.24.3 - 'access' SQL Injection
4images v1.7.11 – ‘Profile Image’ Stored Cross-Site Scripting
# Exploit Title: 4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting
WordPress Core 5.2.2 – ‘post previews’ XSS
# Exploit Title: Wordpress Core 5.2.2 - 'post previews' XSS
Apartment Visitors Management System 1.0 – Authentication Bypass
# Exploit Title: Apartment Visitors Management System 1.0 - Authentication Bypass
GitLab 11.4.7 – RCE (Authenticated) (2)
# Exploit Title: GitLab 11.4.7 RCE (POC)
WordPress Plugin Adning Advertising 1.5.5 – Arbitrary File Upload
# Exploit Title: WordPress Plugin Adning Advertising 1.5.5 - Arbitrary File Upload
WordPress Plugin WP-PostRatings 1.86 – ‘postratings_image’ Cross-Site Scripting
# Exploit Title: WordPress Plugin WP-PostRatings 1.86 - 'postratings_image' Cross-Site Scripting
Baby Care System 1.0 – ‘roleid’ SQL Injection
# Exploit Title: Baby Care System 1.0 - 'roleid' SQL Injection
Sales and Inventory System for Grocery Store 1.0 – Multiple Stored XSS
# Exploit Title: Sales and Inventory System for Grocery Store 1.0 - Multiple Stored XSS
WordPress Epsilon Framework Multiple Themes – Unauthenticated Function Injection
# Exploit Title: Wordpress Epsilon Framework Multiple Themes - Unauthenticated Function Injection
Online Learning Management System 1.0 – ‘id’ SQL Injection
# Exploit Title: Online Learning Management System 1.0 - 'id' SQL Injection
Online Learning Management System 1.0 – Multiple Stored XSS
# Exploit Title: Online Learning Management System 1.0 - Multiple Stored XSS
Online Learning Management System 1.0 – Authentication Bypass
# Exploit Title: Online Learning Management System 1.0 - Authentication Bypass
Class Scheduling System 1.0 – Multiple Stored XSS
# Exploit Title: Class Scheduling System 1.0 - Multiple Stored XSS
TerraMaster TOS 4.2.06 – RCE (Unauthenticated)
# Exploit Title: TerraMaster TOS 4.2.06 - RCE (Unauthenticated)
Faculty Evaluation System 1.0 – Stored XSS
# Exploit Title: Faculty Evaluation System 1.0 - Stored XSS
Artworks Gallery Management System 1.0 – ‘id’ SQL Injection
# Exploit Title: Artworks Gallery Management System 1.0 - 'id' SQL Injection
Multi Branch School Management System 3.5 – “Create Branch” Stored XSS
# Exploit Title: Multi Branch School Management System 3.5 - "Create Branch" Stored XSS
Library Management System 3.0 – “Add Category” Stored XSS
# Exploit Title: Library Management System 3.0 - "Add Category" Stored XSS
CSE Bookstore 1.0 – Multiple SQL Injection
# Exploit Title : CSE Bookstore 1.0 - Multiple SQL Injection
Pandora FMS 7.0 NG 750 – ‘Network Scan’ SQL Injection (Authenticated)
# Exploit Title: Pandora FMS 7.0 NG 750 - 'Network Scan' SQL Injection (Authenticated)
Victor CMS 1.0 – File Upload To RCE
# Exploit Title: Victor CMS 1.0 - File Upload To RCE
Online Marriage Registration System 1.0 – ‘searchdata’ SQL Injection
# Exploit Title: Online Marriage Registration System 1.0 - 'searchdata' SQL Injection