YzmCMS 5.3 – ‘Host’ Header Injection
# Exploit Title: YzmCMS 5.3 - 'Host' Header Injection
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
NPMJS gitlabhook 0.0.17 – ‘repository’ Remote Command Execution
# Exploit Title: NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution
WP Server Log Viewer 1.0 – ‘logfile’ Persistent Cross-Site Scripting
# Exploit Title: WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting
Microsoft SharePoint 2013 SP1 – ‘DestinationFolder’ Persistant Cross-Site Scripting
# Exploit Title: Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistent Cross-Site Scripting
Pfsense 2.3.4 / 2.4.4-p3 – Remote Code Injection
# Exploit Title: Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection
Gila CMS < 1.11.1 - Local File Inclusion
# Exploit Title: Authenticated Local File Inclusion(LFI) in GilaCMS
LayerBB < 1.1.4 - Cross-Site Request Forgery
# Exploit Title: LayerBB 1.1.3 - Multiple CSRF
GOautodial 4.0 – ‘CreateEvent’ Persistent Cross-Site Scripting
# Exploit Title: GOautodial 4.0 - 'CreateEvent' Persistent Cross-Site Scripting
DIGIT CENTRIS 4 ERP – ‘datum1’ SQL Injection
# Exploit Title: DIGIT CENTRIS 4 ERP - 'datum1' SQL Injection
Western Digital My Book World II NAS 1.02.12 – Authentication Bypass / Command Execution
# Exploit Title: Western Digital My Book World II NAS
Hospital-Management 1.26 – ‘fname’ SQL Injection
# Exploit Title: Hospital-Management 1.26 - 'fname' SQL Injection
CollegeManagementSystem-CMS 1.3 – ‘batch’ SQL Injection
# Exploit Title: CollegeManagementSystem-CMS 1.3 - 'batch' SQL Injection
Symantec Advanced Secure Gateway (ASG) / ProxySG – Unrestricted File Upload
===========Security Intelligence============
NetGain EM Plus 10.1.68 – Remote Command Execution
# Exploit Title: NetGain EM Plus
College-Management-System 1.2 – Authentication Bypass
# Exploit Title: College-Management-System 1.2 - Authentication Bypass
Ticket-Booking 1.4 – Authentication Bypass
# Exploit Title: Ticket-Booking 1.4 - Authentication Bypass
LimeSurvey 3.17.13 – Cross-Site Scripting
SEC Consult Vulnerability Lab Security Advisory < 20190912-0 >
phpMyAdmin 4.9.0.1 – Cross-Site Request Forgery
=============================================
Dolibarr ERP-CRM 10.0.1 – ‘User-Agent’ Cross-Site Scripting
# Exploit Title: Dolibarr ERP/CRM 10.0.1 - User-Agent Http Header Cross
eWON Flexy – Authentication Bypass
#!/usr/bin/env python
AVCON6 systems management platform – OGNL Remote Command Execution
# Exploit Title: AVCON6 systems management platform - OGNL - Remote root command execution
WordPress Plugin Photo Gallery 1.5.34 – Cross-Site Scripting (2)
# Exploit Title: WordPress Plugin Photo Gallery by 10Web
WordPress Plugin Photo Gallery 1.5.34 – Cross-Site Scripting
# Exploit Title: WordPress Plugin Photo Gallery by 10Web
WordPress Plugin Photo Gallery 1.5.34 – SQL Injection
# Exploit Title: WordPress Plugin Photo Gallery by 10Web Add new and in add galleries / Gallery groups. GET request ...
Dolibarr ERP-CRM 10.0.1 – SQL Injection
# Exploit Title: Dolibarr ERP/CRM - Multiple Sql Injection
WordPress Plugin Sell Downloads 1.0.86 – Cross-Site Scripting
# Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting
Online Appointment – SQL Injection
# Exploit Title: Online Appointment SQL Injection
Enigma NMS 65.0.0 – SQL Injection
#--------------------------------------------------------------------#
Enigma NMS 65.0.0 – OS Command Injection
#!/usr/bin/python
Enigma NMS 65.0.0 – Cross-Site Request Forgery
#--------------------------------------------------------------------#
Dolibarr ERP-CRM 10.0.1 – ‘elemid’ SQL Injection
# Exploit Title: Dolibarr ERP/CRM - elemid Sql Injection
WordPress Core 5.2.3 – Cross-Site Host Modification
#!/usr/bin/perl -w
Publisure Hybrid – Multiple Vulnerabilities
#####################################################################################
Inventory Webapp – ‘itemquery’ SQL injection
# Exploit Title: Inventory Webapp SQL injection
DASAN Zhone ZNID GPON 2426A EU – Multiple Cross-Site Scripting
Multiple Cross-Site Scripting (XSS) in the web interface of DASAN Zhone ZNID GPON 2426A EU version S3.1.285 applicati...
WordPress Plugin Download Manager 2.9.93 – Cross-Site Scripting
CVE:CVE-2019-15889
FileThingie 2.5.7 – Arbitrary File Upload
# Exploit Title: FileThingie 2.5.7 - Arbitrary File Upload
Craft CMS 2.7.9/3.2.5 – Information Disclosure
# Exploit Title : CraftCms Users information disclosure From uploaded File
Alkacon OpenCMS 10.5.x – Local File inclusion
# Exploit Title: Alkacon OpenCMS 10.5.x - Multiple LFI in Alkacon OpenCms
Alkacon OpenCMS 10.5.x – Cross-Site Scripting (2)
# Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Alkacon OpenCms
Alkacon OpenCMS 10.5.x – Cross-Site Scripting
# Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Apollo Template
WordPress Plugin Event Tickets 4.10.7.1 – CSV Injection
# Exploit Title: WordPress Plugin Event Tickets >= 4.10.7.1 - CSV Injection
Opencart 3.x – Cross-Site Scripting
# Exploit Title: Opencart 3.x.x Authenticated Stored XSS
WordPress Plugin WooCommerce Product Feed 2.2.18 – Cross-Site Scripting
# Exploit Title: WordPress Plugin WooCommerce Product Feed
YouPHPTube 7.4 – Remote Code Execution
# Exploit Title: YouPHPTube
DomainMod 4.13 – Cross-Site Scripting
# Exploit Title: DomainMod