InoERP 0.7.2 – Remote Code Execution (Unauthenticated)
#!/usr/bin/python
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Online Health Care System 1.0 – Multiple Cross Site Scripting (Stored)
# Exploit Title: Online Health Care System 1.0 - Multiple Cross Site Scripting (Stored)
CMS Made Simple 2.1.6 – ‘cntnt01detailtemplate’ Server-Side Template Injection
# Exploit Title: CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection
TextPattern CMS 4.8.3 – Remote Code Execution (Authenticated)
#!/usr/bin/python3
Bludit 3.9.2 – Auth Bruteforce Bypass
#!/usr/bin/python3
Gym Management System 1.0 – Stored Cross Site Scripting
# Exploit Title: Gym Management System 1.0 - Stored Cross Site Scripting
Gym Management System 1.0 – Authentication Bypass
# Exploit Title: Gym Management System 1.0 - Authentication Bypass
School Faculty Scheduling System 1.0 – ‘username’ SQL Injection
# Exploit Title: School Faculty Scheduling System 1.0 - 'username' SQL Injection
School Faculty Scheduling System 1.0 – ‘id’ SQL Injection
# Exploit Title: School Faculty Scheduling System 1.0 - 'id' SQL Injection
Point of Sales 1.0 – ‘username’ SQL Injection
# Exploit Title: Point of Sales 1.0 - 'username' SQL Injection
Gym Management System 1.0 – ‘id’ SQL Injection
# Exploit Title: Gym Management System 1.0 - 'id' SQL Injection
Lot Reservation Management System 1.0 – Cross-Site Scripting (Stored)
#Exploit Title: lot reservation management system 1.0 - Stored Cross Site Scripting
Lot Reservation Management System 1.0 – Authentication Bypass
#Exploit Title: lot reservation management system 1.0 - Authentication Bypass
Point of Sales 1.0 – ‘id’ SQL Injection
#Exploit Title: Point of Sales 1.0 - SQL Injection
User Registration & Login and User Management System 2.1 – SQL Injection
# Exploit Title: User Registration & Login and User Management System 2.1 - SQL Injection
Car Rental Management System 1.0 – Arbitrary File Upload
# Exploit Title: Car Rental Management System 1.0 - Arbitrary File Upload
Stock Management System 1.0 – ‘brandId and categoriesId’ SQL Injection
# Exploit Title: Stock Management System 1.0 - SQL Injection
Ajenti 2.1.36 – Remote Code Execution (Authenticated)
#!/usr/bin/python3
Online Library Management System 1.0 – Arbitrary File Upload
# Exploit Title: Online Library Management System 1.0 - Arbitrary File Upload
Tiki Wiki CMS Groupware 21.1 – Authentication Bypass
# Exploit Title: Tiki Wiki CMS Groupware 21.1 - Authentication Bypass
Stock Management System 1.0 – ‘Brand Name’ Persistent Cross-Site Scripting
# Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting (Brand Name)
Stock Management System 1.0 – ‘Categories Name’ Persistent Cross-Site Scripting
# Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting (Categories Name)
Stock Management System 1.0 – ‘Product Name’ Persistent Cross-Site Scripting
# Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting (Product Name)
GOautodial 4.0 – Authenticated Shell Upload
# Exploit Title: GOautodial 4.0 - Authenticated Shell Upload
School Faculty Scheduling System 1.0 – Authentication Bypass POC
# Exploit Title: School Faculty Scheduling System 1.0 - Authentication Bypass
School Faculty Scheduling System 1.0 – Stored Cross Site Scripting POC
# Exploit Title: School Faculty Scheduling System 1.0 - Stored Cross Site Scripting
Hrsale 2.0.0 – Local File Inclusion
# Exploit Title: Hrsale 2.0.0 - Local File Inclusion
WordPress Plugin Colorbox Lightbox v1.1.1 – Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting Vulnerability (Authentic...
WordPress Plugin Rest Google Maps < 7.11.18 - SQL Injection
# Exploit Title: WordPress Rest Google Maps Plugin SQL Injection
Apache Struts 2 – DefaultActionMapper Prefixes OGNL Code Execution
# Exploit Title: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
Mobile Shop System v1.0 – SQL Injection Authentication Bypass
# Title: Mobile Shop System v1.0 - SQLi lead to authentication bypass
RiteCMS 2.2.1 – Remote Code Execution (Authenticated)
# Exploit Title: RiteCMS 2.2.1 - Authenticated Remote Code Execution
User Registration & Login and User Management System With admin panel 2.1 – Persistent XSS
# Exploit Title: User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS
WordPress Plugin HS Brand Logo Slider 2.1 – ‘logoupload’ File Upload
# Exploit Title: WordPress Plugin HS Brand Logo Slider 2.1 - 'logoupload' File Upload
Ultimate Project Manager CRM PRO Version 2.0.5 – SQLi (Authenticated)
# Exploit Title: Ultimate Project Manager CRM PRO 2.0.5 - SQLi Credentials Leakage
Visitor Management System in PHP 1.0 – SQL Injection (Authenticated)
# Title: Visitor Management System in PHP 1.0 - Authenticated SQL Injection
WordPress Plugin WP Courses < 2.0.29 - Broken Access Controls leading to Courses Content Disclosure
# Exploit Title: WP Courses < 2.0.29 - Broken Access Controls leading to
Loan Management System 1.0 – Multiple Cross Site Scripting (Stored)
# Exploit Title: Loan Management System 1.0 - Multiple Cross Site Scripting (Stored)
Comtrend AR-5387un router – Persistent XSS (Authenticated)
#!/usr/bin/env python3
Textpattern CMS 4.6.2 – Cross-site Request Forgery
# Exploit Title: Textpattern CMS 4.6.2 - Cross-site Request Forgery
Typesetter CMS 5.1 – Arbitrary Code Execution (Authenticated)
# Exploit Title: Typesetter CMS 5.1 - Arbitrary Code Execution
Hostel Management System 2.1 – Cross Site Scripting (Multiple Fields)
# Exploit Title: PHPGurukul hostel-management-system 2.1 allows XSS via
Jenkins 2.63 – Sandbox bypass in pipeline: Groovy plug-in
# Exploit Title: Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in
HiSilicon Video Encoders – Unauthenticated RTSP buffer overflow (DoS)
#!/usr/bin/env bash
HiSilicon Video Encoders – Full admin access via backdoor password
#!/usr/bin/env bash
HiSilicon video encoders – RCE via unauthenticated upload of malicious firmware
#!/usr/bin/env bash
HiSilicon Video Encoders – RCE via unauthenticated command injection
#!/usr/bin/env bash
HiSilicon Video Encoders – Unauthenticated file disclosure via path traversal
#!/usr/bin/env bash
Online Job Portal 1.0 – Cross Site Scripting (Stored)
# Exploit Title: Online Job Portal 1.0 Cross Site Scripting (Stored)
Online Discussion Forum Site 1.0 – XSS in Messaging System
# Exploit Title: Online Discussion Forum Site 1.0 - XSS in Messaging System