webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Apache CouchDB < 2.1.0 - Remote Code Execution
# Title: Apache CouchDB < 2.1.0 - Remote Code Execution
TP-Link TL-WA850RE – Remote Command Execution
#!/usr/bin/env python
NewMark CMS 2.1 – ‘sec_id’ SQL Injection
# Exploit Title: NewMark CMS 2.1 - SQL Injection (sec_id)
MaDDash 2.0.2 – Directory Listing
# Exploit Title: MaDDash 2.0.2 - Directory Listing
Mirasys DVMS Workstation 5.12.6 – Path Traversal
# Exploit Title: Path Traversal in Gateway in Mirasys DVMS Workstation
Redatam Web Server < 7 - Directory Traversal
# Exploit Title: Redatam Web Server < 7 - Directory Traversal
RabbitMQ Web Management < 3.7.6 - Cross-Site Request Forgery (Add Admin)
# Exploit Title: RabbitMQ Web Management < 3.7.6 - Cross-Site Request Forgery
Joomla! Component Jomres 9.11.2 – Cross-Site Request Forgery (Add User)
# Exploit Title: Joomla!Component jomres 9.11.2 - Cross site request forgery
Dimofinf CMS 3.0.0 – Cross-Site Scripting
# Title: Dimofinf CMS 3.0.0 - Cross-Site Scripting
OEcms 3.1 – Cross-Site Scripting
# Title: OEcms 3.1 - Cross-Site Scripting
Joomla! Component Ek Rishta 2.10 – SQL Injection
# Title: SQL Injection Joomla Component Ek rishta 2.10 - SQL Injection
Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload
# Exploit Title: Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload
MACCMS 10 – Cross-Site Request Forgery (Add User)
# Exploit Title: MACCMS_V10 CSRF vulnerability add admin account
WordPress Plugin Ultimate Form Builder Lite < 1.3.7 - SQL Injection
# Title: WordPress Ultimate Form Builder Lite Plugin < 1.3.7 - SQL Injection
WordPress Plugin Google Map < 4.0.4 - SQL Injection
# Title: WordPress Google Map Plugin < 4.0.4 - SQL Injection
Canon PrintMe EFI – Cross-Site Scripting
# Title: Canon PrintMe EFI - Cross-Site Scripting
OX App Suite 7.8.4 – Multiple Vulnerabilities
Product: OX App Suite
Joomla! Component EkRishta 2.10 – ‘username’ SQL Injection
# Exploit Title: Joomla! Component EkRishta 2.10 - 'username' SQL Injection
Siaberry 1.2.2 – Command Injection
## Siaberry's Command Injection Vulnerability
Schools Alert Management Script – Arbitrary File Read
# Exploit Title: Schools Alert Management Script - Arbitrary File Read
Schools Alert Management Script – ‘get_sec.php’ SQL Injection
# Exploit Title: Schools Alert Management Script - 'get_sec.php' SQL Injection
userSpice 4.3.24 – Username Enumeration
# Exploit Title: userSpice 4.3.24 - Username Enumeration
userSpice 4.3.24 – ‘X-Forwarded-For’ Cross-Site Scripting
# Exploit Title: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting
Schools Alert Management Script – Arbitrary File Deletion
# Exploit Title: Schools Alert Management Script - Arbitrary File Deletion
Event Manager Admin panel – ‘events_new.php’ SQL injection
# Exploit Title: Event Manager PHP Script Admin panel - 'events_new.php' SQL injection
WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection
# Title: WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection
Schools Alert Management Script – SQL Injection
# Exploit Title: Schools Alert Management Script - SQL Injection
Splunk < 7.0.1 - Information Disclosure
# Exploit Title: Splunk < 7.0.1 - Information Disclosure
XiongMai uc-httpd 1.0.0 – Buffer Overflow
# Exploit Title: XiongMai uc-httpd 1.0.0 - Buffer Overflow
Monstra CMS < 3.0.4 - Cross-Site Scripting (1)
# Title: Monstra CMS < 3.0.4 - Cross-Site Scripting
WordPress Plugin Contact Form Maker 1.12.20 – SQL Injection
# Title: WordPress Contact Form Maker Plugin 1.12.20 - SQL Injection
WordPress Plugin Form Maker 1.12.24 – SQL Injection
# Title: WordPress Form Maker Plugin 1.12.24 - SQL Injection
WampServer 3.0.6 – Cross-Site Request Forgery
# Exploit Title: WampServer 3.0.6 - Cross-Site Request Forgery
Jenkins Mailer Plugin < 1.20 - Cross-Site Request Forgery (Send Email)
# Exploit Title : Jenkins mailer plugin < 1.20 - Cross-Site Request Forgery
Pagekit < 1.0.13 - Cross-Site Scripting Code Generator
# Title: Pagekit < 1.0.13 - Cross-Site Scripting Code Generator
MyBB Recent Threads Plugin 1.0 – Cross-Site Scripting
# Exploit Title: MyBB Recent Threads Plugin v1.0 - Cross-Site Scripting
Brother HL Series Printers 1.15 – Cross-Site Scripting
# Exploit Title: [ XSS at Brother HL series printers]
EMS Master Calendar < 8.0.0.20180520 - Cross-Site Scripting
# Exploit Title: EMS Master Calendar < 8.0.0.20180520 - Reflected Cross-Site Scripting
SearchBlox 8.6.7 – XML External Entity Injection
# Exploit Title: SearchBlox 8.6.7 Out-Of-Band XML eXternal Entity (OOB-XXE)
GreenCMS 2.3.0603 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability add admin
GreenCMS 2.3.0603 – Cross-Site Request Forgery / Remote Code Execution
# Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability get webshell
Smartshop 1 – Cross-Site Request Forgery
# Exploit Title: Smartshop 1 - Cross site request forgery
Smartshop 1 – ‘id’ SQL Injection
# Exploit Title: Smartshop 1 - SQL Injection
Grid Pro Big Data 1.0 – SQL Injection
# Exploit Title: Grid Pro Big Data 1.0 - 'test.php' SQL Injection
CSV Import & Export 1.1.0 – SQL Injection / Cross-Site Scripting
# Exploit Title: CSV Import & Export v1.1.0 - SQL Injection / Cross-Site
PHP Dashboards NEW 5.5 – ’email’ SQL Injection
# Exploit Title: PHP Dashboards NEW v5.5 - 'Login' SQL Injection
New STAR 2.1 – SQL Injection / Cross-Site Scripting
# Exploit Title: New STAR 2.1 - SQL Injection / Cross-Site Scripting
TAC Xenta 511/911 – Directory Traversal
# Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure