Water Billing System 1.0 – ‘username’ and ‘password’ parameters SQL Injection
# Exploit Title: Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
CMSUno 1.6.2 – ‘user’ Remote Code Execution (Authenticated)
# Exploit Title: CMSUno 1.6.2 - 'user' Remote Code Execution (Authenticated)
Customer Support System 1.0 – ‘username’ Authentication Bypass
# Title: Customer Support System 1.0 - 'username' Authentication Bypass
Customer Support System 1.0 – Cross-Site Request Forgery
# Exploit Title: Customer Support System 1.0 - Cross-Site Request Forgery (Admin Account Takeover)
Customer Support System 1.0 – ‘description’ Stored XSS in The Admin Panel
# Exploit Title: Customer Support System 1.0 - 'description' Stored XSS in The Admin Panel
Anuko Time Tracker 1.19.23.5325 – CSV/Formula Injection
# Exploit Title: Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
ShoreTel Conferencing 19.46.1802.0 – Reflected Cross-Site Scripting
# Exploit Title: ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting
Car Rental Management System 1.0 – SQL injection + Arbitrary File Upload
# Exploit Title: Car Rental Management System 1.0 - SQL injection + Arbitrary File Upload
Joplin 1.2.6 – ‘link’ Cross Site Scripting
# Exploit Title: Joplin 1.2.6 - 'link' Cross Site Scripting
SuiteCRM 7.11.15 – ‘last_name’ Remote Code Execution (Authenticated)
# Exploit Title: SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated)
Genexis Platinum-4410 P4410-V2-1.28 – Broken Access Control and CSRF
# Exploit Title: Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF
BlogEngine 3.3.8 – ‘Content’ Stored XSS
# Exploit Title: BlogEngine 3.3.8 - 'Content' Stored XSS
Sentrifugo Version 3.2 – ‘announcements’ Remote Code Execution (Authenticated)
# Exploit Title: Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)
Sentrifugo 3.2 – ‘assets’ Remote Code Execution (Authenticated)
# Exploit Title: Sentrifugo 3.2 - 'assets' Remote Code Execution (Authenticated)
CMSUno 1.6.2 – ‘lang’ Remote Code Execution (Authenticated)
# Exploit Title: CMSUno 1.6.2 - 'lang' Remote Code Execution (Authenticated)
SmartBlog 2.0.1 – ‘id_post’ Blind SQL injection
# Exploit Title: SmartBlog 2.0.1 - 'id_post' Blind SQL injection
iDS6 DSSPro Digital Signage System 6.2 – Improper Access Control Privilege Escalation
# Exploit Title: iDS6 DSSPro Digital Signage System 6.2 - Improper Access Control Privilege Escalation
iDS6 DSSPro Digital Signage System 6.2 – CAPTCHA Security Bypass
# Exploit Title: iDS6 DSSPro Digital Signage System 6.2 - CAPTCHA Security Bypass
iDS6 DSSPro Digital Signage System 6.2 – Cross-Site Request Forgery (CSRF)
# Exploit Title: iDS6 DSSPro Digital Signage System 6.2 - Cross-Site Request Forgery (CSRF)
Student Attendance Management System 1.0 – ‘username’ SQL Injection / Remote Code Execution
# Exploit Title: Student Attendance Management System 1.0 - 'username' SQL Injection / Remote Code Execution
School Log Management System 1.0 – ‘username’ SQL Injection / Remote Code Execution
# Exploit Title: School Log Management System 1.0 - 'username' SQL Injection / Remote Code Execution
PDW File Browser 1.3 – Remote Code Execution
# Exploit Title: PDW File Browser 1.3 - Remote Code Execution
Processwire CMS 2.4.0 – ‘download’ Local File Inclusion
# Exploit Title: [Local File Inclusion Processwire CMS 2.4.0]
Complaints Report Management System 1.0 – ‘username’ SQL Injection / Remote Code Execution
# Exploit Title: Complaints Report Management System 1.0 - 'username' SQL Injection / Remote Code Execution
Multi Restaurant Table Reservation System 1.0 – ‘table_id’ Unauthenticated SQL Injection
# Title: Multi Restaurant Table Reservation System 1.0 - 'table_id' Unauthenticated SQL Injection
Monitorr 1.7.6m – Authorization Bypass
#!/usr/bin/python
Monitorr 1.7.6m – Remote Code Execution (Unauthenticated)
#!/usr/bin/python
WordPress Plugin Simple File List 4.2.2 – Arbitrary File Upload
#!/usr/bin/python
Apache Flink 1.9.x – File Upload RCE (Unauthenticated)
#!/usr/bin/env python3
Simple College Website 1.0 – ‘username’ SQL Injection / Remote Code Execution
# Exploit Title: Simple College Website 1.0 - SQL Injection / Remote Code Execution
Online Job Portal 1.0 – ‘userid’ SQL Injection
# Exploit Title: Online Job Portal 1.0 - 'userid' SQL Injection
Citadel WebCit < 926 - Session Hijacking Exploit
# Exploit Title: Citadel WebCit < 926 - Session Hijacking Exploit
DedeCMS v.5.8 – “keyword” Cross-Site Scripting
# Exploit Title: DedeCMS v.5.8 - "keyword" Cross-Site Scripting
CSE Bookstore 1.0 – ‘quantity’ Persistent Cross-site Scripting
# Exploit Title: CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting
Genexis Platinum-4410 P4410-V2-1.28 – Cross Site Request Forgery to Reboot
# Exploit Title: Genexis Platinum-4410 P4410-V2-1.28 - Cross Site Request Forgery to Reboot
Mailman 1.x > 2.1.23 – Cross Site Scripting (XSS)
# Title: Mailman 1.x > 2.1.23 - Cross Site Scripting (XSS)
Online Examination System 1.0 – ‘name’ Stored Cross Site Scripting
# Exploit Title: Online examination system 1.0 - 'name' Stored Cross Site Scripting
Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 – ‘getPreviewImage’ Directory Traversal/Local File Inclusion
# Exploit Title: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewIma...
CSE Bookstore 1.0 – Authentication Bypass
# Exploit Title: CSE Bookstore Authentication Bypass
Nagios XI 5.7.3 – ‘mibs.php’ Remote Command Injection (Authenticated)
# Exploit Title: Nagios XI 5.7.3 - 'mibs.php' Remote Command Injection (Authenticated)
Sphider Search Engine 1.3.6 – ‘word_upper_bound’ RCE (Authenticated)
# Exploit Title: Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)
Client Management System 1.0 – ‘searchdata’ SQL injection
# Exploit Title: Client Management System 1.0 - 'searchdata' SQL injection
Sentrifugo 3.2 – File Upload Restriction Bypass (Authenticated)
# Exploit Title: Sentrifugo 3.2 - File Upload Restriction Bypass (Authenticated)
ReQuest Serious Play F3 Media Server 7.0.3 – Remote Code Execution (Unauthenticated)
# Exploit Title: ReQuest Serious Play F3 Media Server 7.0.3 - Remote Code Execution (Unauthenticated)
ReQuest Serious Play F3 Media Server 7.0.3 – Remote Denial of Service
# Exploit Title: ReQuest Serious Play F3 Media Server 7.0.3 - Remote Denial of Service
ReQuest Serious Play F3 Media Server 7.0.3 – Debug Log Disclosure
# Exploit Title: ReQuest Serious Play F3 Media Server 7.0.3 - Debug Log Disclosure
ReQuest Serious Play Media Player 3.0 – Directory Traversal File Disclosure
# Exploit Title: ReQuest Serious Play Media Player 3.0 - Directory Traversal File Disclosure Vulnerability
Genexis Platinum-4410 – ‘SSID’ Persistent XSS
# Exploit Title: Persistent XSS in SSID
PDW File Browser 1.3 – ‘new_filename’ Cross-Site Scripting (XSS)
# Exploit Title: PDW File Browser