Wavemaker Studio 6.6 – Server-Side Request Forgery
# Exploit Title: Wavemaker Studio 6.6 - Server-Side Request Forgery (SSRF).
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
CMS ISWEB 3.5.3 – Directory Traversal
# Exploit Title: CMS ISWEB 3.5.3 - Directory Traversal
onArcade 2.4.2 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: Cross-Site Request Forgery (Add Admin)
LAMS < 3.1 - Cross-Site Scripting
# Exploit Title: LAMS < 3.1 - Cross-Site Scripting
Sitecore.Net 8.1 – Directory Traversal
# Exploit Title: Sitecore.Net 8.1 - Directory Traversal
Subrion CMS 4.2.1 – Cross-Site Scripting
# Exploit Title: [Subrion CMS- 4.2.1 XSS (Using component with known
cgit < 1.2.1 - 'cgit_clone_objects()' Directory Traversal
There is a directory traversal vulnerability in cgit_clone_objects(), reachable when the configuration flag enable-ht...
Plex Media Server 1.13.2.5154 – SSDP Processing XML External Entity Injection
Issue: Out-of-Band XXE in Plex Media Server's SSDP Processing
Vuze Bittorrent Client 5.7.6.0 – SSDP Processing XML External Entity Injection
Issue: Out-of-Band XXE in Vuze Bittorrent Client's SSDP Processing
PHP Template Store Script 3.0.6 – Cross-Site Scripting
# Exploit Title: PHP Template Store Script- 3.0.6 - Stored XSS via Addres ,Bank Name,and A/c Holder Name
Seq 4.2.476 – Authentication Bypass
# Exploit Title: Seq 4.2.476 - Authentication Bypass
ASUS DSL-N12E_C1 1.1.2.3_345 – Remote Command Execution
# Exploit Title: ASUS DSL-N12E_C1 1.1.2.3_345 - Remote Command Execution
Universal Media Server 7.1.0 – SSDP Processing XML External Entity Injection
Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing
CoSoSys Endpoint Protector 4.5.0.1 – (Authenticated) Remote Root Command Injection
# Title : CoSoSys Endpoint Protector - Authenticated Remote Root Command Injection
PageResponse FB Inboxer Add-on 1.2 – ‘search_field’ SQL Injection
# Exploit Title: FB Inboxer 1.2 - 'search_field' SQL Injection
TI Online Examination System v2 – Arbitrary File Download
# Exploit Title: TI Online Examination System v2 - Arbitrary File Download
LG NAS 3718.510.a0 – Remote Command Execution
# LG NAS 3718.510.a0 - Remote Command Execution
Craft CMS SEOmatic plugin 3.1.4 – Server-Side Template Injection
# Exploit Title: Craft CMS SEOmatic plugin 3.1.4 - Server-Side Template Injection
H2 Database 1.4.197 – Information Disclosure
# Exploit Title: H2 Database 1.4.197 - Information Disclosure
Responsive Filemanager 9.13.1 – Server-Side Request Forgery
# Exploit Title: Responsive filemanager 9.13.1 - Server-Side Request Forgery
SoftNAS Cloud < 4.0.3 - OS Command Injection
Core Security - Corelabs Advisory
Online Trade 1 – Information Disclosure
# Exploit Title: Online Trade 1 - Information Disclosure
Kirby CMS 2.5.12 – Cross-Site Request Forgery (Delete Page)
# Exploit Title: Kirby CMS 2.5.12 - Cross-Site Request Forgery (Delete Page)
Trivum Multiroom Setup Tool 8.76 – Corss-Site Request Forgery (Admin Bypass)
# Exploit Title: Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery (Admin Bypass)
D-link DAP-1360 – Path Traversal / Cross-Site Scripting
# Exploit Title: D-Link DAP-1360 File path traversal and Cross site
Tenda Wireless N150 Router 5.07.50 – Cross-Site Request Forgery (Reboot Router)
# Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)
Davolink DVW 3200 Router – Password Disclosure
# Exploit Title: Davolink DVW 3200 Router - Password Disclosure
Synology DiskStation Manager 4.1 – Directory Traversal
# Exploit Title: Synology DiskStation Manager 4.1 - Directory Traversal
NUUO NVRmini – ‘upgrade_handle.php’ Remote Command Execution
# Exploit Title: NUUO NVR Unauthenticated Remote Code Execution
Kirby CMS 2.5.12 – Cross-Site Scripting
# Exploit Title: Kirby CMS 2.5.12 - Cross-Site Scripting
GeoVision GV-SNVR0811 – Directory Traversal
# Exploit Title: GeoVision GV-SNVR0811 Directory Traversal
Touchpad / Trivum WebTouch Setup 2.53 build 13163 – Authentication Bypass
# Exploit Title: Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 - Unauthorized Authentication Reset
MSVOD 10 – ‘cid’ SQL Injection
# Exploit Title: MSVOD V10 ¡V SQL Injection
MyBB New Threads Plugin 1.1 – Cross-Site Scripting
# Exploit Title: MyBB New Threads Plugin - Cross-Site Scripting
WordPress Plugin All In One Favicon 4.6 – (Authenticated) Cross-Site Scripting
# Exploit Title: WordPress Plugin All In One Favicon
Modx Revolution < 2.6.4 - Remote Code Execution
# Exploit Title: Modx Revolution < 2.6.4 - Remote Code Execution
FTP2FTP 1.0 – Arbitrary File Download
# Exploit Title: FTP2FTP 1.0 - Arbitrary File Download
Open-AudIT Community 2.1.1 – Cross-Site Scripting
#######################################
Smart SMS & Email Manager 3.3 – ‘contact_type_id’ SQL Injection
# Exploit Title: Smart SMS & Email Manager v3.3 - SQL Injection
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway – Remote Root
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Remote Root Exploit
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway – File Manipulation
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Arbitrary File Attacks
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway – Configuration Download
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Configuration Download
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway – Cross-Site Request Forgery
Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway CSRF Vulnerabilities
PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation
#!/usr/bin/env python3
PrestaShop < 1.6.1.19 - 'AES CBC' Privilege Escalation
#!/usr/bin/env python3
WordPress Plugin Job Manager 4.1.0 – Cross-Site Scripting
# Exploit Title: Wordpress Plugin Job Manager v4.1.0 Stored Cross Site
VelotiSmart WiFi B-380 Camera – Directory Traversal
Title: Vulnerability in VelotiSmart Wifi - Directory Traversal