Zuz Music 2.1 – ‘zuzconsole/___contact ‘ Persistent Cross-Site Scripting
# Exploit Title: Zuz Music 2.1 - 'zuzconsole/___contact ' Persistent Cross-site Scripting
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Listing Hub CMS 1.0 – ‘pages.php id’ SQL Injection
# Exploit Title: Listing Hub CMS 1.0 - 'pages.php id' SQL Injection
Find a Place CMS Directory 1.5 – ‘assets/external/data_2.php cate’ SQL Injection
# Exploit Title: Find a Place CMS Directory 1.5 - 'assets/external/data_2.php cate' SQL Injection
Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload
# Exploit Title: Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 - arbitrary file upload
Comodo Dome Firewall 2.7.0 – Cross-Site Scripting
#####################################################################################################################...
ArangoDB Community Edition 3.4.2-1 – Cross-Site Scripting
#####################################################################################################################...
Apache CouchDB 2.3.0 – Cross-Site Scripting
#####################################################################################################################...
Webiness Inventory 2.3 – ‘ProductModel’ Arbitrary File Upload
===========================================================================================
M/Monit 3.7.2 – Privilege Escalation
#!/usr/env/python3
CMSsite 1.0 – ‘post’ SQL Injection
# Exploit Title: CMSsite 1.0 - 'post' SQL Injection
MISP 2.4.97 – SQL Command Execution via Command Injection in STIX Module
#-*-coding:utf-8-*-
Master IP CAM 01 3.3.4.2103 – Remote Command Execution
# Exploit Title: Master IP CAM 01 Remote Command Execution
qdPM 9.1 – ‘search[keywords]’ Cross-Site Scripting
===========================================================================================
qdPM 9.1 – ‘type’ Cross-Site Scripting
===========================================================================================
UniSharp Laravel File Manager 2.0.0-alpha7 – Arbitrary File Upload
### Exploit Title: UniSharp Laravel File Manager - Arbitrary File Upload
qdPM 9.1 – ‘search_by_extrafields[]’ SQL Injection
===========================================================================================
MyBB Trash Bin Plugin 1.1.3 – Cross-Site Scripting / Cross-Site Request Forgery
# Exploit Title: MyBB Trash Bin Plugin 1.1.3 - Cross-Site Scripting / CSRF
LayerBB 1.1.2 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery
WordPress Plugin Booking Calendar 8.4.3 – (Authenticated) SQL Injection
# Exploit Title: Wordpress Booking Calendar v8.4.3 - Authenticated SQL Injection Vulnerability
DomainMOD 4.11.01 – ‘assets/edit/host.php?whid=5’ Cross-Site Scripting
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
DomainMOD 4.11.01 – ‘assets/add/dns.php’ Cross-Site Scripting
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
DomainMOD 4.11.01 – ‘category.php CatagoryName, StakeHolder’ Cross-Site Scripting
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
DomainMOD 4.11.01 – ‘ssl-accounts.php username’ Cross-Site Scripting
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
DomainMOD 4.11.01 – ‘ssl-provider-name’ Cross-Site Scripting
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
PilusCart 1.4.1 – ‘send’ SQL Injection
####################################################################
Rukovoditel Project Management CRM 2.4.1 – Cross-Site Scripting
####################################################################
LayerBB 1.1.2 – Cross-Site Scripting
# Exploit Title: LayerBB 1.1.2 - Cross-Site Scripting
BlogEngine.NET 3.3.6 – Directory Traversal / Remote Code Execution
# Exploit Title: BlogEngine.NET
OPNsense < 19.1.1 - Cross-Site Scripting
#####################################################################################################################...
Webiness Inventory 2.3 – ’email’ SQL Injection
===========================================================================================
CentOS Web Panel 0.9.8.763 – Persistent Cross-Site Scripting
# Exploit Title: CentOS Web Panel 0.9.8.763 - Stored Cross-Site Scripting Vulnerability
VA MAX 8.3.4 – (Authenticated) Remote Code Execution
root@nippur:/home/c/src/nippur# cat vamax3.py
MyBB Bans List 1.0 – Cross-Site Scripting
# Exploit Title: MyBB Bans List - Cross Site Scripting
IPFire 2.21 – Cross-Site Scripting
#####################################################################################################################...
Coship Wireless Router 4.0.0.x/5.0.0.x – WiFi Password Reset
# Exploit Title: Coship Wireless Router – Wireless SSID Unauthenticated Password Reset
Smoothwall Express 3.1-SP4 – Cross-Site Scripting
#####################################################################################################################...
osCommerce 2.3.4.1 – ‘reviews_id’ SQL Injection
####################################################################
osCommerce 2.3.4.1 – ‘products_id’ SQL Injection
####################################################################
osCommerce 2.3.4.1 – ‘currency’ SQL Injection
####################################################################
OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
Insecure Object Deserialization on the OpenMRS Platform
Zyxel VMG3312-B10B DSL-491HNU-B1B v2 Modem – Cross-Site Request Forgery
# Exploit Title: Zyxel VMG3312-B10B DSL-491HNU-B1B v2 modem CSRF Exploit
devolo dLAN 550 duo+ Starter Kit – Remote Code Execution
devolo dLAN 550 duo+ Starter Kit Remote Code Execution
devolo dLAN 550 duo+ Starter Kit – Cross-Site Request Forgery
devolo dLAN 550 duo+ Starter Kit Cross-Site Request Forgery
BEWARD N100 H.264 VGA IP Camera M2.1.6 – Arbitrary File Disclosure
BEWARD N100 H.264 VGA IP Camera M2.1.6 Arbitrary File Disclosure
BEWARD N100 H.264 VGA IP Camera M2.1.6 – Remote Code Execution
BEWARD N100 H.264 VGA IP Camera M2.1.6 Root Remote Code Execution
BEWARD N100 H.264 VGA IP Camera M2.1.6 – Cross-Site Request Forgery (Add Admin)
BEWARD N100 H.264 VGA IP Camera M2.1.6 CSRF Add Admin Exploit
BEWARD N100 H.264 VGA IP Camera M2.1.6 – RTSP Stream Disclosure
BEWARD N100 H.264 VGA IP Camera M2.1.6 Unauthenticated RTSP Stream Disclosure