Vanilla < 2.1.5 - Cross-Site Request Forgery
# Exploit Title: CSRF vulnerabilities in Vanilla Forums below 2.1.5-CVE-2017-1000432
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
WordPress Plugin LearnDash 2.5.3 – Arbitrary File Upload
# Exploit Title: WordPress LearnDash 2.5.3 Unauthenticated Arbitrary
FiberHome LM53Q1 – Multiple Vulnerabilities
#!/usr/bin/python
Photos in Wifi 1.0.1 – Path Traversal
Document Title:
Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration
# Exploit Title: Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration
Gespage 7.4.8 – SQL Injection
# [CVE-2017-7997] Gespage SQL Injection vulnerability
gps-server.net GPS Tracking Software < 3.1 - Multiple Vulnerabilities
# Exploit Title: GPS-SERVER.NET SAAS CMS
EMC xPression 4.5SP1 Patch 13 – ‘model.jobHistoryId’ SQL Injection
Title: EMC xDashboard - SQL Injection Vulnerability
WordPress Plugin Smart Google Code Inserter < 3.5 - Authentication Bypass / SQL Injection
Exploit Title: Smart Google Code Inserter < 3.5 - Auth Bypass/SQLi
PHP Melody 2.7.1 – ‘playlist’ SQL Injection
# Exploit Title: PHP Melody v2.7.1 - SQL Injection
DotNetNuke DreamSlider 01.01.02 – Arbitrary File Download (Metasploit)
# Exploit Title: DotNetNuke DreamSlider Arbitrary File Download
SAP BusinessObjects launch pad – Server-Side Request Forgery
# Exploit Title: SAP BusinessObjects launch pad SSRF
Telesquare SKT LTE Router SDT-CS3B1 – Information Disclosure
Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak
Telesquare SKT LTE Router SDT-CS3B1 – Cross-Site Request Forgery
Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution
Easy!Appointments 1.2.1 – Cross-Site Scripting
Easy!Appointments v1.2.1 Multiple Stored XSS Vulnerabilities
Xerox DC260 EFI Fiery Controller Webtools 2.0 – Arbitrary File Disclosure
Xerox DC260 EFI Fiery Controller Webtools 2.0 Arbitrary File Disclosure
SilverStripe CMS 3.6.2 – CSV Excel Macro Injection
Exploit Title: SilverStripe CMS - 3.6.2 CSV Excel Macro Injection
Sendroid < 6.5.0 - SQL Injection
# Exploit Title: Sendroid - Bulk SMS Portal, Marketing Script( 5.0.0 - 6.5.0 ) - SQL Injection
Huawei Router HG532 – Arbitrary Command Execution
import threading, sys, time, random, socket, re, os, struct, array, requests
BEIMS ContractorWeb 5.18.0.0 – SQL Injection
# Exploit Title: SQL Injection
Ability Mail Server 3.3.2 – Cross-Site Scripting
# Exploit Title: Ability Mail Server 3.3.2 Persistent Cross Site Scripting (XSS)
Conarc iChannel – Improper Access Restrictions
# Exploit Title: Conarc iChannel - Unauthenticated Access/Default Webserver Misconfiguration allows for compromise of...
BrightSign Digital Signage – Multiple Vulnerablities
# Exploit Title: BrightSign Digital Signage (Multiple Vulnerabilities)
Monstra CMS 3.0.4 – (Authenticated) Arbitrary File Upload / Remote Code Execution
Exploit Title: Monstra CMS - 3.0.4 RCE
Ciuis CRM 1.0.7 – SQL Injection
# Exploit Title: [Ciuis CRM v 1.0.7 Sql Injection]
Movie Guide 2.0 – SQL Injection
# # # # #
ITGuard-Manager 0.0.0.1 – Remote Code Execution
# Vulnerability Title: ITGuard-Manager V0.0.0.1 PreAuth Remote Code Execution
Linksys WVBR0 – ‘User-Agent’ Remote Command Injection
#!/usr/bin/python
vBulletin 5.x – ‘cacheTemplates’ Remote Arbitrary File Deletion
# SSD Advisory – vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion
vBulletin 5.x – ‘routestring’ Remote Code Execution
# SSD Advisory – vBulletin routestring Unauthenticated Remote Code Execution
Meinberg LANTIME Web Configuration Utility 6.16.008 – Arbitrary File Read
Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read
Accesspress Anonymous Post Pro < 3.2.0 - Arbitrary File Upload
# Exploit Title: Unauthenticated Arbitrary File Upload