pfSense 2.4.4-p1 – Cross-Site Scripting
#####################################################################################################################...
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Nessus 8.2.1 – Cross-Site Scripting
#####################################################################################################################...
SuiteCRM 7.10.7 – ‘record’ SQL Injection
####################################################################
SuiteCRM 7.10.7 – ‘parentTab’ SQL Injection
####################################################################
ResourceSpace 8.6 – ‘watched_searches.php’ SQL Injection
# Exploit Title: ResourceSpace = 5.0.0
SureMDM < 2018-11 Patch - Local / Remote File Inclusion
# Exploit Title: SureMDM LFI/RFI (Prior to 2018-11 Patch)
Rukovoditel Project Management CRM 2.4.1 – ‘lists_id’ SQL Injection
#################################################################
PDF Signer 3.0 – Server-Side Template Injection leading to Remote Command Execution (via Cross-Site Request Forgery Cookie)
# Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie
ResourceSpace 8.6 – ‘collection_edit.php’ SQL Injection
# Exploit Title: ResourceSpace = 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
MyBB IP History Logs Plugin 1.0.2 – Cross-Site Scripting
# Exploit Title: MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting
Mess Management System 1.0 – SQL Injection
# Exploit Title: Mess Management System 1.0 - SQL Injection
Teameyo Project Management System 1.0 – SQL Injection
# Exploit Title: Teameyo - Project Management System 1.0 - SQL Injection
Care2x 2.7 (HIS) Hospital Information System – Multiple SQL Injection
# Exploit Title: Care2x 2.7 (HIS) Hospital Information system - Multiples SQL Injection
Newsbull Haber Script 1.0.0 – ‘search’ SQL Injection
####################################################################
Cisco Firepower Management Center 6.2.2.2 / 6.2.3 – Cross-Site Scripting
# Exploit Title: Cisco Firepower Management Center Cross-Site Scripting (XSS) Vulnerability
Cisco RV300 / RV320 – Information Disclosure
# Exploit Title: 6coRV Exploit
CMSsite 1.0 – ‘search’ SQL Injection
# Exploit Title: CMSsite 1.0 - 'search' SQL injection
CMSsite 1.0 – ‘cat_id’ SQL Injection
# Exploit Title: CMSsite 1.0 - SQL injection
LogonBox Limited / Hypersocket Nervepoint Access Manager – (Unauthenticated) Insecure Direct Object Reference
# Exploit Title: Access Manager Unauthenticated Insecure Direct Object Reference (IDOR)
AirTies Air5341 Modem 1.0.0.12 – Cross-Site Request Forgery
# Exploit Title: AirTies Air5341 1.0.0.12 Modem CSRF Exploit & PoC
WordPress Plugin Ad Manager WD 1.0.11 – Arbitrary File Download
Exploit Title: WordPress Plugin ad manager wd v1.0.11 - Arbitrary File
Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting
# Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored
WordPress Plugin Wisechat 2.6.3 – Reverse Tabnabbing
# Exploit Title: Wordpress Plugin Wisechat
GreenCMS 2.x – Arbitrary File Download
# Exploit Title: Green CMS 2.x - Arbitrary File & Directory Download
GreenCMS 2.x – SQL Injection
# Exploit Title: Green CMS 2.x - SQL Injection
Cisco RV320 Dual Gigabit WAN VPN Router 1.4.2.15 – Command Injection
RedTeam Pentesting discovered a command injection vulnerability in the
Zyxel NBG-418N v2 Modem 1.00(AAXM.6)C0 – Cross-Site Request Forgery
NBG-418N v2 Modem CSRF Exploit & PoC
ImpressCMS 1.3.11 – ‘bid’ SQL Injection
# Title: ImpressCMS 1.3.11 - 'bid' SQL Injection
SirsiDynix e-Library 3.5.x – Cross-Site Scripting
# Exploit Title: SirsiDynix e-Library
SimplePress CMS 1.0.7 – SQL Injection
# Exploit Title: SimplePress CMS 1.0.7 - SQL Injection
Joomla! Component JHotelReservation 6.0.7 – SQL Injection
# Exploit Title: Joomla! Component JHotelReservation 6.0.7 - SQL Injection
Joomla! Component J-CruisePortal 6.0.4 – SQL Injection
# Exploit Title: Joomla! Component J-CruisePortal 6.0.4 - SQL Injection
Joomla! Component JMultipleHotelReservation 6.0.7 – SQL Injection
# Exploit Title: Joomla! Component J-MultipleHotelReservation 6.0.7 - SQL Injection
Joomla! Component J-ClassifiedsManager 3.0.5 – SQL Injection
# Exploit Title: Joomla! Component J-ClassifiedsManager 3.0.5 - SQL Injection
Joomla! Component J-BusinessDirectory 4.9.7 – ‘type’ SQL Injection
# Exploit Title: Joomla! Component J-BusinessDirectory 4.9.7 - SQL Injection
Joomla! Component VMap 1.9.6 – SQL Injection
# Exploit Title: Joomla! Component VMap 1.9.6 - SQL Injection
Joomla! Component vRestaurant 1.9.4 – SQL Injection
# Exploit Title: Joomla! Component vRestaurant 1.9.4 - SQL Injection
Joomla! Component vReview 1.9.11 – SQL Injection
# Exploit Title: Joomla! Component vReview 1.9.11 - SQL Injection
Joomla! Component vAccount 2.0.2 – ‘vid’ SQL Injection
# Exploit Title: Joomla! Component vAccount 2.0.2 - SQL Injection
Joomla! Component vWishlist 1.0.1 – SQL Injection
# Exploit Title: Joomla! Component vWishlist 1.0.1 - SQL Injection
Joomla! Component vBizz 1.0.7 – Remote Code Execution
# Exploit Title: Joomla! Component vBizz 1.0.7 - Remote Code Execution
Joomla! Component vBizz 1.0.7 – SQL Injection
# Exploit Title: Joomla! Component vBizz 1.0.7 - SQL Injection
Nagios XI 5.5.6 – Remote Code Execution / Privilege Escalation
# Exploit Title: Nagios XI 5.5.6 Remote Code Execution and Privilege Escalation
Joomla! Component Easy Shop 1.2.3 – Local File Inclusion
# Exploit Title: Joomla! Component Easy Shop 1.2.3 - Local File Inclusion
Adianti Framework 5.5.0 – SQL Injection
# Exploit Title: [SQL Injection in Adianti Framework]
PHP Uber-style GeoTracking 1.1 – SQL Injection
# Exploit Title: PHP Uber-style GeoTracking 1.1 - SQL Injection
PHP Dashboards NEW 5.8 – Local File Inclusion
# Exploit Title: PHP Dashboards NEW 5.8 - Local File Inclusion
PHP Dashboards NEW 5.8 – ‘dashID’ SQL Injection
# Exploit Title: PHP Dashboards NEW 5.8 - SQL Injection
MoneyFlux 1.0 – ‘id’ SQL Injection
# Exploit Title: MoneyFlux - Cashflow Management System 1.0 - SQL Injection