Rest – Cafe and Restaurant Website CMS – ‘slug’ SQL Injection
# Exploit Title: Rest - Cafe and Restaurant Website CMS - SQL Injection
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Sar2HTML 3.2.1 – Remote Command Execution
# Exploit Title: sar2html Remote Code Execution
Cisco Catalyst 3850 Series Device Manager – Cross-Site Request Forgery
# Product : Catalyst 3850 Series Device Manager
WebIncorp ERP – SQL injection
# Exploit Title: WebIncorp ERP - SQL injection
Ultimate Loan Manager 2.0 – Cross-Site Scripting
# Exploit Title:Web Studio Ultimate Loan Manager V2.0 - Persistent Cross Site Scripting
Oracle Hyperion Planning 11.1.2.3 – XML External Entity
- Exploit Title: XXE Injection Oracle Hyperion
GigToDo 1.3 – Cross-Site Scripting
# Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection
WordPress Theme Real Estate 2.8.9 – Cross-Site Scripting
# Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9
WordPress Plugin Simple Membership 3.8.4 – Cross-Site Request Forgery
# Exploit Title: Cross Site Request Forgery in Wordpress Simple Membership plugin
Ahsay Backup 7.x – 8.1.1.50 – XML External Entity Injection
# Unauthenticated XML External Entity (XXE) in Ahsay Backup v7.x - v8.1.0.50.
Ahsay Backup 7.x – 8.1.1.50 – Authenticated Arbitrary File Upload / Remote Code Execution (Metasploit)
# Exploit Title: Authenticated insecure file upload and code execution flaw in Ahsay Backup v7.x - v8.1.1.50. (Metasp...
Ahsay Backup 8.1.1.50 – Insecure File Upload and Code Execution (Authenticated)
# Exploit Title: Ahsay Backup 8.1.1.50 - Insecure File Upload and Code Execution (Authenticated)
Moodle Filepicker 3.5.2 – Server Side Request Forgery
# Exploit Title: Server Side Request Forgery in Moodle Filepicker
MyBB < 1.8.21 - Remote Code Execution
# Exploit Title: MyBB < 1.8.21 Authenticated RCE
Ovidentia 8.4.3 – SQL Injection
#-------------------------------------------------------
Ovidentia 8.4.3 – Cross-Site Scripting
#-------------------------------------------------------
WordPress Plugin Hybrid Composer 1.4.6 – Improper Access Restrictions
# Exploit Title: Wordpress Hybrid Composer
Cisco Wireless Controller 3.6.10E – Cross-Site Request Forgery
# Product : Cisco Wireless Controller
NoviSmart CMS – SQL injection
# Exploit Title: NoviSmart CMS SQL injection
Axway SecureTransport 5 – Unauthenticated XML Injection
# Title: Axway SecureTransport 5 - Unauthenticated XML Injection
REDCap < 9.1.2 - Cross-Site Scripting
# Exploit Title: REDCap < 9.1.2 - Cross-Site Scripting
Web Ofisi Firma 13 – ‘oz’ SQL Injection
# Exploit Title: Web Ofisi Firma 13 - 'oz' SQL Injection
Web Ofisi Rent a Car 3 – ‘klima’ SQL Injection
# Exploit Title: Web Ofisi Rent a Car 3 - 'klima' SQL Injection
Web Ofisi Firma Rehberi 1 – ‘il’ SQL Injection
# Exploit Title: Web Ofisi Firma Rehberi 1 - 'il' SQL Injection
Web Ofisi Emlak 3 – ’emlak_durumu’ SQL Injection
# Exploit Title: Web Ofisi Emlak 3 - 'emlak_durumu' SQL Injection
Web Ofisi Emlak 2 – ‘ara’ SQL Injection
# Exploit Title: Web Ofisi Emlak 2 - 'ara' SQL Injection
Web Ofisi Platinum E-Ticaret 5 – ‘q’ SQL Injection
# Exploit Title: Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection
Web Ofisi E-Ticaret 3 – ‘a’ SQL Injection
# Exploit Title: Web Ofisi E-Ticaret 3 - 'a' SQL Injection
fuel CMS 1.4.1 – Remote Code Execution (1)
# Exploit Title: fuel CMS 1.4.1 - Remote Code Execution (1)
WordPress Plugin OneSignal 1.17.5 – ‘subdomain’ Persistent Cross-Site Scripting
# Exploit Title: WordPress Plugin OneSignal 1.17.5 - Persistent Cross-Site Scripting
Oracle Siebel CRM 19.0 – Persistent Cross-Site Scripting
# Exploit Title: Oracle Siebel CRM 19.0 - Persistent Cross-Site Scripting
CentOS Control Web Panel 0.9.8.838 – User Enumeration
# Exploit Title: CWP (CentOS Control Web Panel) < 0.9.8.848 User Enumeration via HTTP Response Message
CentOS Control Web Panel 0.9.8.836 – Privilege Escalation
//====================================================================\\
CentOS Control Web Panel 0.9.8.836 – Authentication Bypass
# Exploit Title: CWP (CentOS Control Web Panel) < 0.9.8.847 Bypass Login
FlightPath < 4.8.2 / < 5.0-rc2 - Local File Inclusion
# Exploit Title: FlightPath < 4.8.2 & < 5.0-rc2 - Local File Inclusion
CISCO Small Business 200 / 300 / 500 Switches – Multiple Vulnerabilities
# Exploit Title: CISCO Small Business 200, 300, 500 Switches Multiple Vulnerabilities.
Netgear WiFi Router JWNR2010v5 / R6080 – Authentication Bypass
# Exploit Title: NETGEAR WiFi Router R6080 - Security Questions Answers Disclosure
Citrix SD-WAN Appliance 10.2.2 – Authentication Bypass / Remote Command Execution
# Exploit Title: Citrix SD-WAN Appliance 10.2.2 Auth Bypass and Remote Command Execution
Jenkins Dependency Graph View Plugin 0.13 – Persistent Cross-Site Scripting
# Exploit Title: Persistent XSS - Dependency Graph View Plugin(v0.13)
Sahi Pro 8.0.0 – Remote Command Execution
# Exploit Title: Sahi Pro V8.0.0 - Unauthenticated Remote Command Execution
MyT Project Management 1.5.1 – User[username] Persistent Cross-Site Scripting
# Exploit Title: MyT Project Management - User[username] Stored Cross Site
Tenda D301 v2 Modem Router – Persistent Cross-Site Scripting
# Exploit Title: tenda D301 v2 modem router stored xss CVE-2019-13492
Sitecore 9.0 rev 171002 – Persistent Cross-Site Scripting
# Exploit Title: Stored Cross Site Scripting (XSS) in Sitecore 9.0 rev 171002
WordPress Plugin Like Button 1.6.0 – Authentication Bypass
Exploit Title: WP Like Button 1.6.0 - Auth Bypass
Karenderia Multiple Restaurant System 5.3 – SQL Injection
===========================================================================================
Karenderia Multiple Restaurant System 5.3 – Local File Inclusion
===========================================================================================
Symantec DLP 15.5 MP1 – Cross-Site Scripting
# Exploit Title: Persistent XSS on Symantec DLP
Centreon 19.04 – Remote Code Execution
#!/usr/bin/python
FaceSentry Access Control System 6.4.8 – Remote Root Exploit
#!/usr/bin/env python