PZ Frontend Manager WordPress Plugin 1.0.5 – Cross Site Request Forgery (CSRF)
# Exploit Title: PZ Frontend Manager WordPress Plugin 1.0.5 - Cross Site Request Forgery (CSRF)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
ChurchCRM 5.9.1 – SQL Injection
# Exploit Title: ChurchCRM 5.9.1 - SQL Injection
ResidenceCMS 2.10.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: ResidenceCMS 2.10.1 - Stored Cross-Site Scripting (XSS)
Apache HugeGraph Server 1.2.0 – Remote Code Execution (RCE)
# Exploit Title: Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
Zohocorp ManageEngine ADManager Plus 7210 – Elevation of Privilege
# Exploit Title: ManageEngine ADManager Plus Build < 7210 Elevation of
Artica Proxy 4.50 – Remote Code Execution (RCE)
# Exploit Title: Artica Proxy 4.50 - Remote Code Execution (RCE)
DocsGPT 0.12.0 – Remote Code Execution
# Exploit Title: DocsGPT 0.12.0 - Remote Code Execution
Intelight X-1L Traffic controller Maxtime 1.9.6 – Remote Code Execution (RCE)
# Exploit Title: Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)
GeoVision GV-ASManager 6.1.0.0 – Information Disclosure
# Exploit Title: Information Disclosure in GeoVision GV-ASManager
jQuery 3.3.1 – Prototype Pollution & XSS Exploit
# Exploit Title: jQuery Prototype Pollution & XSS Exploit (CVE-2019-11358 & CVE-2020-7656)
Jasmin Ransomware – Arbitrary File Download (Authenticated)
# Exploit Title: Jasmin Ransomware - (Authenticated) Arbitrary File Download
UNA CMS 14.0.0-RC – PHP Object Injection
# Exploit Title: UNA CMS
Nagios Xi 5.6.6 – Authenticated Remote Code Execution (RCE)
# Exploit Title: Nagiosxi authenticated Remote Code Execution
WordPress User Registration & Membership Plugin 4.1.1 – Unauthenticated Privilege Escalation
# Exploit Title: WordPress User Registration & Membership Plugin
XWiki Platform 15.10.10 – Remote Code Execution
# Exploit Title: XWiki Platform - Remote Code Execution
YesWiki 4.5.1 – Unauthenticated Path Traversal
# Exploit Title: YesWiki < 4.5.2 - Unauthenticated Path Traversal
Apache Tomcat 11.0.3 – Remote Code Execution
# Exploit Title: Apache Tomcat Path Equivalence - Remote Code Execution
WBCE CMS 1.6.3 – Authenticated Remote Code Execution (RCE)
# Exploit Title: WBCE CMS
Backup and Staging by WP Time Capsule 1.22.21 – Unauthenticated Arbitrary File Upload
# Exploit Title: WordPress Backup and Staging Plugin ≤ 1.21.16 - Arbitrary File Upload to RCE
Watcharr 1.43.0 – Remote Code Execution (RCE)
# Exploit Title : Watcharr 1.43.0 - Remote Code Execution (RCE)
Palo Alto Networks Expedition 1.2.90.1 – Admin Account Takeover
# Exploit Title: Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
DataEase 2.4.0 – Database Configuration Information Exposure
# Exploit Title: DataEase 2.4.0 - Database Configuration Information Exposure
Royal Elementor Addons and Templates 1.3.78 – Unauthenticated Arbitrary File Upload
# Exploit Title: WordPress Plugin Royal Elementor Addons
Exclusive Addons for Elementor 2.6.9 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Exclusive Addons for Elementor ≤ 2.6.9 - Authenticated Stored Cross-Site Scripting (XSS)
Kubio AI Page Builder 2.5.1 – Local File Inclusion (LFI)
# Exploit Title: Kubio AI Page Builder
Next.js Middleware 15.2.2 – Authorization Bypass
# Exploit Title: Next.js Middleware Bypass Vulnerability (CVE-2025-29927)
IBM Security Verify Access 10.0.0 – Open Redirect during OAuth Flow
# Exploit Title : IBM Security Verify Access 10.0.0 - Open Redirect during OAuth Flow
AppSmith 1.47 – Remote Code Execution (RCE)
# Exploit Title: AppSmith 1.47 - Remote Code Execution (RCE)
Nagios Log Server 2024R1.3.1 – Stored XSS
# Exploit Title: Stored XSS Vulnerability in Nagios Log Server (Privilege Escalation to Admin)
Webmin Usermin 2.100 – Username Enumeration
# Exploit Title: Webmin Usermin 2.100 - Username Enumeration
ABB Cylon Aspect 3.07.01 – Hard-coded Default Credentials
# Exploit Title : ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials
ABB Cylon Aspect 3.07.02 – File Disclosure
# Exploit Title : ABB Cylon Aspect 3.07.02 - File Disclosure
ABB Cylon Aspect 3.08.01 – Arbitrary File Delete
# Exploit Title : ABB Cylon Aspect 3.08.01 - Arbitrary File Delete
ABB Cylon Aspect 3.08.01 – Remote Code Execution (RCE)
# Exploit Title : ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)
Elaine’s Realtime CRM Automation 6.18.17 – Reflected XSS
# Exploit Title: Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
XWiki Standard 14.10 – Remote Code Execution (RCE)
# Exploit Title: CVE-2023-48292 Remote Code Execution Exploit
Progress Telerik Report Server 2024 Q1 (10.0.24.305) – Authentication Bypass
# Exploit Title: Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass
Rejetto HTTP File Server 2.3m – Remote Code Execution (RCE)
# Exploit Title: Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE)
Sonatype Nexus Repository 3.53.0-01 – Path Traversal
# Exploit Title: Sonatype Nexus Repository 3.53.0-01 - Path Traversal
CodeCanyon RISE CRM 3.7.0 – SQL Injection
# Exploit Title: CodeCanyon RISE CRM 3.7.0 - SQL Injection
Litespeed Cache 6.5.0.1 – Authentication Bypass
# Exploit Title: Litespeed Cache 6.5.0.1 - Authentication Bypass
X2CRM 8.5 – Stored Cross-Site Scripting (XSS)
# Exploit Title: X2CRM 8.5 - Stored Cross-Site Scripting (XSS)
KubeSphere 3.4.0 – Insecure Direct Object Reference (IDOR)
# Exploit Title: KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR)
MoziloCMS 3.0 – Remote Code Execution (RCE)
# Exploit Title: MoziloCMS 3.0 - Remote Code Execution (RCE)
TeamPass 3.0.0.21 – SQL Injection
# Exploit Title: TeamPass SQL Injection
Jasmin Ransomware – SQL Injection Login Bypass
# Exploit Title: Jasmin Ransomware SQL Injection Login Bypass
FluxBB 1.5.11 – Stored Cross-Site Scripting (XSS)
# Exploit Title: FluxBB 1.5.11 Stored xss
JUX Real Estate 3.4.0 – SQL Injection
# Exploit Title: JUX Real Estate 3.4.0 - SQL Injection
Gitea 1.24.0 – HTML Injection
# Exploit Title: Gitea 1.24.0 - HTML Injection
TranzAxis 3.2.41.10.26 – Stored Cross-Site Scripting (XSS) (Authenticated)
Exploit Title: TranzAxis 3.2.41.10.26 - Stored Cross-Site Scripting (XSS) (Authenticated)