Extensive VC Addons for WPBakery page builder 1.9.0 – Remote Code Execution (RCE)
# Exploit Title: Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Loaded Commerce 6.6 – Client-Side Template Injection(CSTI)
# Exploit Title: Loaded Commerce 6.6 Client-Side Template Injection(CSTI)
Chamilo LMS 1.11.24 – Remote Code Execution (RCE)
# Exploit Title: Chamilo LMS 1.11.24 - Remote Code Execution (RCE)
SOPlanning 1.52.01 (Simple Online Planning Tool) – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: SOPlanning 1.52.01 (Simple Online Planning Tool) - Remote Code Execution (RCE) (Authenticated)
reNgine 2.2.0 – Command Injection (Authenticated)
# Exploit Title: reNgine 2.2.0 - Command Injection (Authenticated)
openSIS 9.1 – SQLi (Authenticated)
# Exploit Title: openSIS 9.1 - SQLi (Authenticated)
dizqueTV 1.5.3 – Remote Code Execution (RCE)
# Exploit Title: dizqueTV 1.5.3 - Remote Code Execution (RCE)
NoteMark < 0.13.0 - Stored XSS
# Exploit Title: Stored XSS in NoteMark
Gitea 1.22.0 – Stored XSS
# Exploit Title: Stored XSS in Gitea
Invesalius3 – Remote Code Execution
# Exploit Title: Invesalius 3.1 - Remote Code Execution (RCE)
Aurba 501 – Authenticated RCE
# Exploit Title: Remote Command Execution | Aurba 501
HughesNet HT2000W Satellite Modem – Password Reset
# Exploit Title: HughesNet HT2000W Satellite Modem (Arcadyan httpd 1.0) - Password Reset
Elber Wayber Analog/Digital Audio STL 4.00 – Device Config Disclosure
Elber Wayber Analog/Digital Audio STL 4.00 Device Config
Elber Wayber Analog/Digital Audio STL 4.00 – Authentication Bypass
Elber Wayber Analog/Digital Audio STL 4.00 Authentication Bypass
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x – Device Config
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x Device Config
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x – Authentication Bypass
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x Authentication Bypass
Helpdeskz v2.0.2 – Stored XSS
# Exploit Title: Stored XSS Vulnerability via File Name
Calibre-web 0.6.21 – Stored XSS
# Exploit Title: Stored XSS in Calibre-web
Devika v1 – Path Traversal via ‘snapshot_path’
# Exploit Title: Devika v1 - Path Traversal via 'snapshot_path' Parameter
Ivanti vADC 9.9 – Authentication Bypass
# Exploit Title: Ivanti vADC 9.9 - Authentication Bypass
Xhibiter NFT Marketplace 1.10.2 – SQL Injection
# Exploit Title: xhibiter nft marketplace SQLI
Azon Dominator Affiliate Marketing Script – SQL Injection
# Exploit Title: Azon Dominator - Affiliate Marketing Script - SQL Injection
Microweber 2.0.15 – Stored XSS
# Exploit Title: Stored XSS in Microweber
Customer Support System 1.0 – Stored XSS
# Exploit Title: Customer Support System 1.0 - (XSS) Cross-Site
Automad 2.0.0-alpha.4 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)
SolarWinds Platform 2024.1 SR1 – Race Condition
# Exploit Title: SolarWinds Platform 2024.1 SR1 - Race Condition
Flatboard 3.2 – Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Title: Flatboard 3.2 - Stored Cross-Site Scripting (XSS) (Authenticated)
Poultry Farm Management System v1.0 – Remote Code Execution (RCE)
# Exploit Title: Poultry Farm Management System v1.0 - Remote Code Execution (RCE)
Boelter Blue System Management 1.3 – SQL Injection
# Exploit Title: SQL Injection Vulnerability in Boelter Blue System Management (version 1.3)
WP-UserOnline 2.88.0 – Stored Cross Site Scripting (XSS) (Authenticated)
# Exploit Title: WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated)
PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows)
# Exploit Title: PHP Windows Remote Code Execution (Unauthenticated)
AEGON LIFE v1.0 Life Insurance Management System – SQL injection vulnerability.
# Exploit Title: Life Insurance Management System- SQL injection vulnerability.
XMB 1.9.12.06 – Stored XSS
# Exploit Title: Persistent XSS in XMB 1.9.12.06
Carbon Forum 5.9.0 – Stored XSS
# Exploit Title: Persistent XSS in Carbon Forum 5.9.0 (Stored)
AEGON LIFE v1.0 Life Insurance Management System – Stored cross-site scripting (XSS)
# Exploit Title: Life Insurance Management Stored System- cross-site scripting (XSS)
appRain CMF 4.0.5 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: appRain CMF 4.0.5 - Remote Code Execution (RCE) (Authenticated)
CMSimple 5.15 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: CMSimple 5.15 - Remote Command Execution
WBCE CMS v1.6.2 – Remote Code Execution (RCE)
# Exploit Title: WBCE CMS v1.6.2 - Remote Code Execution (RCE)
Monstra CMS 3.0.4 – Remote Code Execution (RCE)
# Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (RCE)
Dotclear 2.29 – Remote Code Execution (RCE)
# Exploit Title: Dotclear 2.29 - Remote Code Execution (RCE)
Serendipity 2.5.0 – Remote Code Execution (RCE)
# Exploit Title: Serendipity 2.5.0 - Remote Code Execution (RCE)
Sitefinity 15.0 – Cross-Site Scripting (XSS)
# Exploit Title: Sitefinity 15.0 - Cross-Site Scripting (XSS)
FreePBX 16 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: FreePBX 16 - Remote Code Execution (RCE) (Authenticated)
Akaunting 3.1.8 – Server-Side Template Injection (SSTI)
# Exploit Title: Akaunting 3.1.8 - Server-Side Template Injection (SSTI)
Check Point Security Gateway – Information Disclosure (Unauthenticated)
# Exploit Title: Check Point Security Gateway - Information Disclosure (Unauthenticated)
Aquatronica Control System 5.1.6 – Information Disclosure
#!/usr/bin/env python
changedetection < 0.45.20 - Remote Code Execution (RCE)
# Exploit Title: changedetection
ElkArte Forum 1.1.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title : ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated)
iMLog < 1.307 - Persistent Cross Site Scripting (XSS)
# Exploit Title: iMLog < 1.307 - Persistent Cross Site Scripting (XSS)
BWL Advanced FAQ Manager 2.0.3 – Authenticated SQL Injection
Exploit Title: BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection