FaceSentry Access Control System 6.4.8 – Cross-Site Request Forgery
FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
FaceSentry Access Control System 6.4.8 – Remote Command Injection
FaceSentry Access Control System 6.4.8 Remote Command Injection
CyberPanel 1.8.4 – Cross-Site Request Forgery
# Title: CyberPanel Administrator Account Takeover
Sahi pro 8.x – Directory Traversal
# Exploit Title: Sahi pro (8.x) Directory traversal
SAP Crystal Reports – Information Disclosure
# Exploit Title: [Sensitive Information Disclosure in SAP Crystal Reports]
ZoneMinder 1.32.3 – Cross-Site Scripting
# Exploit Title: ZoneMinder 1.32.3 - Stored Cross Site Scripting (filters)
PowerPanel Business Edition – Cross-Site Scripting
# Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting (SNMP trap receivers)
Varient 1.6.1 – SQL Injection
===========================================================================================
CiuisCRM 1.6 – ‘eventType’ SQL Injection
===========================================================================================
WorkSuite PRM 2.4 – ‘password’ SQL Injection
===========================================================================================
LibreNMS 1.46 – ‘addhost’ Remote Code Execution
#!/usr/bin/python
WordPress Plugin Live Chat Unlimited 2.8.3 – Cross-Site Scripting
# Exploit Title: Live Chat Unlimited v2.8.3 Stored XSS Injection
WordPress Plugin iLive 1.0.4 – Cross-Site Scripting
# Exploit Title: iLive - Intelligent WordPress Live Chat Support
BlogEngine.NET 3.3.6/3.3.7 – ‘path’ Directory Traversal
# Exploit Title: Directory Traversal on BlogEngine.NET
AZADMIN CMS 1.0 – SQL Injection
[+] Sql Injection on AZADMIN CMS of HIDEA v1.0
Fortinet FCM-MB40 – Cross-Site Request Forgery / Remote Command Execution
# Exploit Title: FCM-MB40 Remote Command Execution as Root via CSRF
GrandNode 4.40 – Path Traversal / Arbitrary File Download
# Exploit Title: GrandNode Path Traversal & Arbitrary File Download (Unauthenticated)
SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting
# Exploit Title: [Persistent Cross-Site Scripting or Stored XSS in out/out.GroupMgr.php in SeedDMS before 5.1.11]
SeedDMS < 5.1.11 - 'out.UsrMgr.php' Cross-Site Scripting
# Exploit Title: [Persistent Cross-Site Scripting or Stored XSS in out/out.UsrMgr.php in SeedDMS before 5.1.11]
SeedDMS versions < 5.1.11 - Remote Command Execution
# Exploit Title: [Remote Command Execution through Unvalidated File Upload in SeedDMS versions
dotProject 2.1.9 – SQL Injection
# Exploit Title: dotProject 2.1.9 - Multiple Sql Injection (Poc)
BlogEngine.NET 3.3.6/3.3.7 – XML External Entity Injection
# Exploit Title: Out-of-band XML External Entity Injection on BlogEngine.NET
WebERP 4.15 – SQL injection
# Exploit Title: Blind SQL injection in WebERP.
BlogEngine.NET 3.3.6/3.3.7 – ‘theme Cookie’ Directory Traversal / Remote Code Execution
# Exploit Title: Directory Traversal + RCE on BlogEngine.NET
BlogEngine.NET 3.3.6/3.3.7 – ‘dirPath’ Directory Traversal / Remote Code Execution
# Exploit Title: Directory Traversal + RCE on BlogEngine.NET
Sahi pro 8.x – Cross-Site Scripting
# Exploit Title: Sahi pro (
Sahi pro 8.x – SQL Injection
# Exploit Title: Sahi pro (
Sahi pro 7.x/8.x – Directory Traversal
# Exploit Title: Sahi pro (
Spring Security OAuth – Open Redirector
# Exploit Title: Open Redirector in spring-security-oauth2
CleverDog Smart Camera DOG-2W / DOG-2W-V4 – Multiple Vulnerabilities
1. Advisory Information
RedwoodHQ 2.5.5 – Authentication Bypass
# -*- encoding: utf-8 -*-
Sitecore 8.x – Deserialization Remote Code Execution
# Exploit Title: Sitecore v 8.x Deserialization RCE
FusionPBX 4.4.3 – Remote Command Execution
# Exploit Title: FusionPBX
Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API – Cross-Site Scripting
# Exploit Title: Liferay Portal < 7.1 CE GA4 / SimpleCaptcha API XSS
phpMyAdmin 4.8 – Cross-Site Request Forgery
# Exploit Title: Cross Site Request Forgery (CSRF)
WordPress Plugin Insert or Embed Articulate Content into WordPress – Remote Code Execution
# Exploit Title: Authenticated code execution in `insert-or-embed-articulate-content-into-wordpress` Wordpress plugin
UliCMS 2019.1 ‘Spitting Lama’ – Persistent Cross-Site Scripting
# Exploit Title: UliCMS 2019.1 "Spitting Lama" - Stored Cross-Site Scripting
Supra Smart Cloud TV – ‘openLiveURL()’ Remote File Inclusion
Exploit Title: Remote file inclusion
Zoho ManageEngine ServiceDesk Plus 9.3 – ‘PurchaseRequest.do’ Cross-Site Scripting
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via PurchaseRequest.do
Zoho ManageEngine ServiceDesk Plus 9.3 – ‘SearchN.do’ Cross-Site Scripting
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SearchN.do
Zoho ManageEngine ServiceDesk Plus 9.3 – ‘SolutionSearch.do’ Cross-Site Scripting
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SolutionSearch.do
Zoho ManageEngine ServiceDesk Plus 9.3 – ‘SiteLookup.do’ Cross-Site Scripting
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SiteLookup.do
IceWarp 10.4.4 – Local File Inclusion
# Exploit Title: IceWarp
WordPress Plugin Form Maker 1.13.3 – SQL Injection
# -*- coding: utf-8 -*-
AUO Solar Data Recorder < 1.3.0 - Incorrect Access Control
# Exploit Title: AUO Solar Data Recorder - Incorrect Access Control
KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities
# Exploit Title: [Dell Kace Appliance Multiple Vulnerabilities]
pfSense 2.4.4-p3 (ACME Package 0.59_14) – Persistent Cross-Site Scripting
# Exploit Title: pfSense 2.4.4-p3 (ACMEPackage 0.5.7_1) - Stored Cross-Site Scripting
Phraseanet < 4.0.7 - Cross-Site Scripting
# Exploit title: Stored XSS vulnerability in Phraseanet DAM Open Source software
Deltek Maconomy 2.2.5 – Local File Inclusion
# Exploit Title: Maconomy Erp local file include