Online Student’s Management System 1.0 – Remote Code Execution (Authenticated)
# Exploit Title: Online Student's Management System 1.0 - Remote Code Execution (Authenticated)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Nagios XI 5.7.3 – ‘SNMP Trap Interface’ Authenticated SQL Injection
# Exploit Title: Nagios XI 5.7.3 - 'SNMP Trap Interface' Authenticated SQL Injection
Nagios XI 5.7.3 – ‘Manage Users’ Authenticated SQL Injection
# Exploit Title: Nagios XI 5.7.3 - 'Manage Users' Authenticated SQL Injection
Nagios XI 5.7.3 – ‘Contact Templates’ Persistent Cross-Site Scripting
# Exploit Title: Nagios XI 5.7.3 - 'Contact Templates' Persistent Cross-Site Scripting
Tourism Management System 1.0 – Arbitrary File Upload
#Exploit Title: Tourism Management System 1.0 - Arbitrary File Upload
CS-Cart 1.3.3 – authenticated RCE
# Exploit Title: CS-Cart authenticated RCE
CS-Cart 1.3.3 – ‘classes_dir’ LFI
# Exploit Title: CS-Cart unauthenticated LFI
Seat Reservation System 1.0 – Unauthenticated SQL Injection
# Title: Seat Reservation System 1.0 - Unauthenticated SQL Injection
Hotel Management System 1.0 – Remote Code Execution (Authenticated)
# Exploit Title: Hotel Management System 1.0 - Remote Code Execution (Authenticated)
Seat Reservation System 1.0 – Remote Code Execution (Unauthenticated)
# Exploit Title: Seat Reservation System 1.0 - Unauthenticated Remote Code Execution
aaPanel 6.6.6 – Privilege Escalation & Remote Code Execution (Authenticated)
# Exploit Title: [aaPanel 6.6.6 - Authenticated Privilege Escalation]
Restaurant Reservation System 1.0 – ‘date’ SQL Injection (Authenticated)
# Exploit Title: Restaurant Reservation System 1.0 - 'date' SQL Injection (Authenticated)
Company Visitor Management System (CVMS) 1.0 – Authentication Bypass
# Exploit Title: Company Visitor Management System (CVMS) 1.0 - Authentication Bypass
Alumni Management System 1.0 – Authentication Bypass
#Exploit Title: Alumni Management System 1.0 - Authentication Bypass
Employee Management System 1.0 – Authentication Bypass
#Exploit Title: Employee Management System 1.0 - Authentication Bypass
Employee Management System 1.0 – Cross Site Scripting (Stored)
#Exploit Title: Employee Management System 1.0 - Stored Cross Site Scripting
Zoo Management System 1.0 – Authentication Bypass
# Exploit Title: Zoo Management System 1.0 - Authentication Bypass
Simple Grocery Store Sales And Inventory System 1.0 – Authentication Bypass
# Exploit Title: Simple Grocery Store Sales And Inventory System 1.0 - Authentication Bypass
rConfig 3.9.5 – Remote Code Execution (Unauthenticated)
# Exploit Title: rConfig 3.9.5 - Remote Code Execution (Unauthenticated)
Vehicle Parking Management System 1.0 – Authentication Bypass
# Exploit Title: Vehicle Parking Management System 1.0 - Authentication Bypass
NodeBB Forum 1.12.2-1.14.2 – Account Takeover
# Exploit Title: NodeBB Forum 1.12.2-1.14.2 - Account Takeover
berliCRM 1.0.24 – ‘src_record’ SQL Injection
# Exploit Title: berliCRM 1.0.24 - 'src_record' SQL Injection
Cisco ASA and FTD 9.6.4.42 – Path Traversal
# Exploit Title: Cisco ASA and FTD 9.6.4.42 - Path Traversal
Online Students Management System 1.0 – ‘username’ SQL Injections
# Title: Online Students Management System 1.0 - 'username' SQL Injections
Liman 0.7 – Cross-Site Request Forgery (Change Password)
# Exploit Title: Liman 0.7 - Cross-Site Request Forgery (Change Password)
MedDream PACS Server 6.8.3.751 – Remote Code Execution (Unauthenticated)
#!/usr/bin/python
Small CRM 2.0 – ’email’ SQL Injection
# Exploit Title: Small CRM 2.0 - 'email' SQL Injection
openMAINT 1.1-2.4.2 – Arbitrary File Upload
# Exploit Title: openMAINT 1.1-2.4.2 - Arbitrary File Upload
DynPG 4.9.1 – Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: DynPG 4.9.1 - Persistent Cross-Site Scripting (Authenticated)
Kentico CMS 9.0-12.0.49 – Persistent Cross Site Scripting
# Exploit Title: Kentico CMS 9.0-12.0.49 - Persistent Cross Site Scripting
D-Link DSR-250N 3.12 – Denial of Service (PoC)
# Exploit Title: D-Link DSR-250N 3.12 - Denial of Service (PoC)
SEO Panel 4.6.0 – Remote Code Execution (1)
# Exploit Title: SEO Panel 4.6.0 - Remote Code Execution
Textpattern CMS 4.6.2 – ‘body’ Persistent Cross-Site Scripting
# Exploit Title: Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting
EasyPMS 1.0.0 – Authentication Bypass
# Exploit Title: EasyPMS 1.0.0 - Authentication Bypass
Karel IP Phone IP1211 Web Management Panel – Directory Traversal
# Exploit Title: Karel IP Phone IP1211 Web Management Panel - Directory Traversal
SpamTitan 7.07 – Unauthenticated Remote Code Execution
# Exploit Title: SpamTitan 7.07 - Unauthenticated Remote Code Execution
Photo Share Website 1.0 – Persistent Cross-Site Scripting
# Exploit Title: Photo Share Website 1.0 - Persistent Cross-Site Scripting
MedDream PACS Server 6.8.3.751 – Remote Code Execution (Authenticated)
#!/usr/bin/python
Typesetter CMS 5.1 – ‘Site Title’ Persistent Cross-Site Scripting
# Exploit Title: Typesetter CMS 5.1 - 'Site Title' Persistent Cross-Site Scripting
GetSimple CMS 3.3.16 – Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)
WebsiteBaker 2.12.2 – ‘display_name’ SQL Injection (authenticated)
# Exploit Title: WebsiteBaker 2.12.2 - 'display_name' SQL Injection (authenticated)
MonoCMS Blog 1.0 – Arbitrary File Deletion (Authenticated)
# Exploit Title: MonoCMS Blog 1.0 - Arbitrary File Deletion (Authenticated)
SpinetiX Fusion Digital Signage 3.4.8 – Username Enumeration
# Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration
SpinetiX Fusion Digital Signage 3.4.8 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - Cross-Site Request Forgery (Add Admin)
SpinetiX Fusion Digital Signage 3.4.8 – Database Backup Disclosure
# Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - Database Backup Disclosure
BrightSign Digital Signage Diagnostic Web Server 8.2.26 – File Delete Path Traversal
# Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - File Delete Path Traversal
BrightSign Digital Signage Diagnostic Web Server 8.2.26 – Server-Side Request Forgery (Unauthenticated)
# Exploit Title: BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated)
CMS Made Simple 2.2.14 – Persistent Cross-Site Scripting (Authenticated)
# Exploit Title: CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated)
WebsiteBaker 2.12.2 – Remote Code Execution
# Exploit Title: WebsiteBaker 2.12.2 - Remote Code Execution
Joplin 1.0.245 – Arbitrary Code Execution (PoC)
# Exploit Title: Joplin 1.0.245 - Arbitrary Code Execution (PoC)