htmlLawed 1.2.5 – Remote Code Execution (RCE)
# Exploit Title: htmlLawed 1.2.5 - Remote Code Execution (RCE)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
PopojiCMS 2.0.1 – Remote Command Execution (RCE)
# Exploit Title: PopojiCMS 2.0.1 - Remote Command Execution
Backdrop CMS 1.27.1 – Authenticated Remote Command Execution (RCE)
# Exploit Title: Backdrop CMS 1.27.1 - Authenticated Remote Command Execution (RCE)
Apache OFBiz 18.12.12 – Directory Traversal
# Exploit Title: Apache OFBiz 18.12.12 - Directory Traversal
WordPress Theme XStore 9.3.8 – SQLi
# Exploit Title: Wordpress Theme XStore 9.3.8 - SQLi
Rocket LMS 1.9 – Persistent Cross Site Scripting (XSS)
# Title: Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS)
Prison Management System – SQL Injection Authentication Bypass
# Exploit : Prison Management System Using PHP -SQL Injection Authentication Bypass
PyroCMS v3.0.1 – Stored XSS
# Exploit Title: PyroCMS v3.0.1 - Stored XSS
CE Phoenix Version 1.0.8.20 – Stored XSS
# Exploit Title: CE Phoenix Version 1.0.8.20 - Stored XSS
Leafpub 1.1.9 – Stored Cross-Site Scripting (XSS)
# Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)
Chyrp 2.5.2 – Stored Cross-Site Scripting (XSS)
# Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS)
Apache mod_proxy_cluster – Stored XSS
import requests
iboss Secure Web Gateway – Stored Cross-Site Scripting (XSS)
# Exploit Title: iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS)
Clinic Queuing System 1.0 – RCE
# Exploit Title: Clinic Queuing System 1.0 RCE
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link – Device Config Disclosure
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Device Config
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link – Authentication Bypass
Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 – Device Config Disclosure
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Device Config
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 – Authentication Bypass
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Authentication Bypass
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 – Device Config Disclosure
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 Device Config
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 – Authentication Bypass
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 Authentication Bypass
Flowise 1.6.5 – Authentication Bypass
# Exploit Title: Flowise 1.6.5 - Authentication Bypass
Laravel Framework 11 – Credential Leakage
# Exploit Title: Laravel Framework 11 - Credential Leakage
SofaWiki 3.9.2 – Remote Command Execution (RCE) (Authenticated)
# Exploit Title: SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated)
WordPress Plugin Background Image Cropper v1.2 – Remote Code Execution
# Exploit Title: Wordpress Plugin Background Image Cropper v1.2 - Remote Code Execution
FlatPress v1.3 – Remote Command Execution
# Exploit Title: FlatPress v1.3 - Remote Command Execution
OpenClinic GA 5.247.01 – Path Traversal (Authenticated)
# Exploit Title: OpenClinic GA 5.247.01 - Path Traversal (Authenticated)
OpenClinic GA 5.247.01 – Information Disclosure
# Exploit Title: OpenClinic GA 5.247.01 - Information Disclosure
Jenkins 2.441 – Local File Inclusion
# Exploit Title: Jenkins 2.441 - Local File Inclusion
djangorestframework-simplejwt 5.3.1 – Information Disclosure
# Exploit Title: djangorestframework-simplejwt 5.3.1 - Information Disclosure
BMC Compuware iStrobe Web – 20.13 – Pre-auth RCE
#!/usr/bin/env python3
Stock Management System v1.0 – Unauthenticated SQL Injection
# Exploit Title: Stock Management System v1.0 - Unauthenticated SQL Injection
Online Fire Reporting System OFRS – SQL Injection Authentication Bypass
# Exploit Title: Online Fire Reporting System SQL Injection Authentication Bypass
Savsoft Quiz v6.0 Enterprise – Stored XSS
# Exploit Title: Savsoft Quiz v6.0 Enterprise - Persistent Cross-Site
WordPress Plugin WP Video Playlist 1.1.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Wordpress Plugin WP Video Playlist 1.1.1 - Stored Cross-Site Scripting (XSS)
WBCE CMS Version 1.6.1 – Remote Command Execution (Authenticated)
# Exploit Title: WBCE CMS Version : 1.6.1 Remote Command Execution
WBCE 1.6.0 – Unauthenticated SQL injection
# Exploit Title: |Unauthenticated SQL injection in WBCE 1.6.0
Moodle 3.10.1 – Authenticated Blind Time-Based SQL Injection – “sort” parameter
# Exploit Title: Moodle Authenticated Time-Based Blind SQL Injection - "sort" Parameter
PopojiCMS Version 2.0.1 – Remote Command Execution
# Exploit Title: PopojiCMS Version : 2.0.1 Remote Command Execution
WordPress Plugin Playlist for Youtube 1.32 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Wordpress Plugin Playlist for Youtube - Stored Cross-Site Scripting (XSS)
HTMLy Version v2.9.6 – Stored XSS
# Exploit Title: HTMLy Version v2.9.6 - Stored XSS
Ray OS v2.6.3 – Command Injection RCE(Unauthorized)
# Exploit Title: Ray OS v2.6.3 - Command Injection RCE(Unauthorized)
GUnet OpenEclass E-learning platform 3.15 – ‘certbadge.php’ Unrestricted File Upload
# Exploit Title: GUnet OpenEclass E-learning platform 3.15 - 'certbadge.php' Unrestricted File Upload
Open Source Medicine Ordering System v1.0 – SQLi
# Exploit Title : Open Source Medicine Ordering System v1.0 - SQLi
Daily Expense Manager 1.0 – ‘term’ SQLi
# Exploit Title: Daily Expense Manager 1.0 - 'term' SQLi
Best Student Result Management System v1.0 – Multiple SQLi
## Title: Best Student Result Management System v1.0 - Multiple SQLi
Human Resource Management System v1.0 – Multiple SQLi
## Title: Human Resource Management System v1.0 - Multiple SQLi
WordPress Theme Travelscape v1.0.3 – Arbitrary File Upload
# Exploit Title: Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload
WordPress Plugin Alemha Watermarker 1.3.1 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Wordpress Plugin Alemha Watermarker 1.3.1 - Stored Cross-Site Scripting (XSS)
Computer Laboratory Management System v1.0 – Multiple-SQLi
# Title: Computer Laboratory Management System v1.0 - Multiple-SQLi
Axigen < 10.5.7 - Persistent Cross-Site Scripting
# Exploit Title: Axigen < 10.5.7 - Persistent Cross-Site Scripting