Gibbon LMS v26.0.00 – SSTI vulnerability
# Exploit Title: Gibbon LMS v26.0.00 - SSTI vulnerability
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Casdoor < v1.331.0 - '/api/set-password' CSRF
# Exploit Title: Casdoor < v1.331.0 - '/api/set-password' CSRF
WordPress Plugin – Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)
# Exploit Title: Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthentic...
Smart School 6.4.1 – SQL Injection
# Exploit Title: Smart School 6.4.1 - SQL Injection
CE Phoenix v1.0.8.20 – Remote Code Execution
## Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution (RCE) (Authenticated)
Elementor Website Builder < 3.12.2 - Admin+ SQLi
#EXPLOIT Elementor Website Builder < 3.12.2 - Admin+ SQLi
Blood Bank v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Blood Bank v1.0 Stored Cross Site Scripting (XSS)
Daily Habit Tracker 1.0 – Broken Access Control
# Exploit Title: Daily Habit Tracker 1.0 - Broken Access Control
Daily Habit Tracker 1.0 – SQL Injection
# Exploit Title: Daily Habit Tracker 1.0 - SQL Injection
Daily Habit Tracker 1.0 – Stored Cross-Site Scripting (XSS)
# Exploit Title: Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)
Employee Management System 1.0 – `txtusername` and `txtpassword` SQL Injection (Admin Login)
# Exploit Title: Employee Management System 1.0 - `txtusername` and `txtpassword` SQL Injection (Admin Login)
Employee Management System 1.0 – `txtfullname` and `txtphone` SQL Injection
# Exploit Title: Employee Management System 1.0 - `txtfullname` and `txtphone` SQL Injection
LeptonCMS 7.0.0 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated)
FoF Pretty Mail 1.1.2 – Server Side Template Injection (SSTI)
Exploit Title: FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)
FoF Pretty Mail 1.1.2 – Local File Inclusion (LFI)
Exploit Title: FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)
Hospital Management System v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)
E-INSUARANCE v1.0 – Stored Cross Site Scripting (XSS)
# Exploit Title: E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS)
Petrol Pump Management Software v1.0 – Remote Code Execution (RCE)
# Exploit Title: Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
OpenCart Core 4.0.2.3 – ‘search’ SQLi
# Exploit Title: OpenCart Core 4.0.2.3 - 'search' SQLi
Online Hotel Booking In PHP 1.0 – Blind SQL Injection (Unauthenticated)
# Exploit Title: Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated)
Simple Backup Plugin Python Exploit 2.7.10 – Path Traversal
# Exploit Title: Simple Backup Plugin < 2.7.10 - Arbitrary File Download via Path Traversal
liveSite Version 2019.1 – Remote Code Execution
## Exploit Title: liveSite Version : 2019.1 Campaigns Remote Code Execution
Broken Access Control – on NodeBB v3.6.7
Exploit Title: Broken Access Control - on NodeBB v3.6.7
Purei CMS 1.0 – SQL Injection
# Exploit Title: Purei CMS 1.0 - SQL Injection
Workout Journal App 1.0 – Stored XSS
# Exploit Title: Workout Journal App 1.0 - Stored XSS
LimeSurvey Community 5.3.32 – Stored XSS
# Exploit Title: Stored Cross-Site Scripting (XSS) in LimeSurvey Community
Nagios XI Version 2024R1.01 – SQL Injection
# Exploit Title: NAGIOS XI SQLI
Wallos < 1.11.2 - File Upload RCE
# Exploit Title: Wallos - File Upload RCE (Authenticated)
Tourism Management System v2.0 – Arbitrary File Upload
# Exploit Title: Tourism Management System v2.0 - Arbitrary File Upload
MobileShop master v1.0 – SQL Injection Vuln.
+ Exploit Title: MobileShop master v1.0 - SQL Injection Vuln.
Insurance Management System PHP and MySQL 1.0 – Multiple Stored XSS
# Exploit Title:Insurance Management System PHP and MySQL 1.0 - Multiple
SPA-CART CMS – Stored XSS
# Exploit Title: SPA-CART CMS - Stored XSS
Craft CMS 4.4.14 – Unauthenticated Remote Code Execution
#!/usr/bin/env python3
CSZCMS v1.3.0 – SQL Injection (Authenticated)
# Title: CSZCMS v1.3.0 - SQL Injection (Authenticated)
Teacher Subject Allocation Management System 1.0 – ‘searchdata’ SQLi
# Exploit Title: Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
Simple Task List 1.0 – ‘status’ SQLi
# Exploit Title: Simple Task List 1.0 - 'status' SQLi
Blood Bank 1.0 – ‘bid’ SQLi
# Exploit Title: Blood Bank 1.0 - 'bid' SQLi
Employee Management System 1.0 – ‘admin_id’ SQLi
# Exploit Title: Employee Management System 1.0 - 'admin_id' SQLi
Quick.CMS 6.7 – SQL Injection Login Bypass
# Exploit Title: Quick.CMS 6.7 SQL Injection Login Bypass
xbtitFM 4.1.18 – Multiple Vulnerabilities
# Exploit Title: xbtitFM 4.1.18 Multiple Vulnerabilities
Backdrop CMS 1.23.0 – Stored XSS
# Exploit Title: Backdrop CMS 1.23.0 - Stored Cross-Site Scripting - Post Body Field
Atlassian Confluence < 8.5.3 - Remote Code Execution
# Exploit Title: CVE-2023-22527: Atlassian Confluence RCE Vulnerability
Gibbon LMS < v26.0.00 - Authenticated RCE
# Exploit Title: Gibbon LMS has a PHP Deserialization vulnerability on the v26.0.00 version
TYPO3 11.5.24 – Path Traversal (Authenticated)
# Exploit Title: TYPO3 11.5.24 Path Traversal Vulnerability (Authenticated)
WEBIGniter v28.7.23 – Stored XSS
## Title: WEBIGniter v28.7.23 XSS
WordPress File Upload Plugin < 4.23.3 - Stored XSS
Exploit Title: WordPress File Upload < 4.23.3 Stored XSS (CVE 2023-4811)
UPS Network Management Card 4 – Path Traversal
# Exploit Title: UPS Network Management Card 4 - Path Traversal
Nokia BMC Log Scanner – Remote Code Execution
# Exploit Title: Nokia BMC Log Scanner Remote Code Execution
Karaf v4.4.3 Console – RCE
#!/usr/bin/python