Bolt CMS 3.7.0 - Authenticated Remote Code Execution


BoltWire 6.03 - Local File Inclusion


Book Store Management System 1.0.0 - Stored Cross-Site Scripting (XSS)


Booked Scheduler 2.7.5 - Remote Command Execution (RCE) (Authenticated)


Booked Scheduler 2.7.7 - Authenticated Directory Traversal


Boom CMS v8.0.7 - Cross Site Scripting


Boonex Dolphin 7.4.2 - 'width' Stored XSS


Boss Mini 1.4.0 - local file inclusion


BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)


BrainyCP V1.0 - Remote Code Execution


Budget and Expense Tracker System 1.0 -  Remote Code Execution (RCE) (Unauthenticated)


Budget and Expense Tracker System 1.0 - Arbitrary File Upload


Budget and Expense Tracker System 1.0 - Authenticated Bypass


Budget Management System 1.0 - 'Budget title' Stored XSS


BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)


Bus Pass Management System 1.0  - Stored Cross-Site Scripting (XSS)


Bus Pass Management System 1.0 - 'adminname' Stored Cross-Site Scripting (XSS)


Bus Pass Management System 1.0 - 'Search' SQL injection


Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)


Bus Pass Management System 1.0 - 'viewid' SQL Injection


Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)


Bus Reservation System 1.1 - Multiple-SQLi


Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)


BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection


Cab Management System 1.0 - 'id' SQLi (Authenticated)


Cab Management System 1.0 - Remote Code Execution (RCE) (Authenticated)


Cacti 1.2.12 - 'filter' SQL Injection


Cacti 1.2.24 - Authenticated command injection when using SNMP options


Cacti 1.2.26 -  Remote Code Execution (RCE) (Authenticated)


Cacti 1.2.8 - Remote Code Execution


Cacti v1.2.22 - Remote Command Execution (RCE)


Cacti v1.2.8 - Unauthenticated Remote Code Execution (Metasploit)


Calendar Event Multi View  1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)


Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload


CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin)


Canteen-Management v1.0 - SQL Injection


Canteen-Management v1.0 - XSS-Reflected


Car Park Management System 1.0 - Authentication Bypass


Car Rental Management System 1.0 - 'car_id' Sql Injection


Car Rental Management System 1.0 - Arbitrary File Upload


Car Rental Management System 1.0 - Remote Code Execution (Authenticated)


Car Rental Management System 1.0 - SQL injection + Arbitrary File Upload


Car Rental Management System 1.0 - SQL Injection / Local File include


Car Rental Project 1.0 - Remote Code Execution


Car Rental Project 2.0 - Arbitrary File Upload to Remote Code Execution


Car Rental Script 1.8 - Stored Cross-site scripting (XSS)


Carbon Forum 5.9.0 - Stored XSS


Care2x Integrated Hospital Info System 2.7 - 'Multiple' SQL Injection


Care2x Open Source Hospital Information Management 2.7 Alpha - 'Multiple' Stored XSS


CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS


CASAP Automated Enrollment System 1.0 - 'route' Stored XSS


CASAP Automated Enrollment System 1.0 - Authentication Bypass


CE Phoenix v1.0.8.20 - Remote Code Execution


CE Phoenix Version 1.0.8.20 - Stored XSS


Cemetry Mapping and Information System 1.0 - 'user_email' Sql Injection (Authentication Bypass)


Cemetry Mapping and Information System 1.0 - Multiple SQL Injections


Cemetry Mapping and Information System 1.0 - Multiple Stored Cross-Site Scripting


Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution


Centreon 19.04 - Authenticated Remote Code Execution (Metasploit)


Centreon 19.10.5 - 'centreontrapd' Remote Command Execution


Centreon 19.10.5 - 'id' SQL Injection


Centreon 19.10.5 - 'Pollers' Remote Command Execution


Centreon 19.10.5 - 'Pollers' Remote Command Execution (Metasploit)


Centreon 19.10.5 - Database Credentials Disclosure


Centreon 19.10.5 - Remote Command Execution


Centron 19.04 - Remote Code Execution (RCE)


Chamilo LMS 1.11.14 - Account Takeover


Chamilo LMS 1.11.14 - Remote Code Execution (Authenticated)


Chamilo LMS 1.11.24 - Remote Code Execution (RCE)


Charity Management System CMS 1.0 - Multiple Vulnerabilities


ChemInv 1.0 - Authenticated Persistent Cross-Site Scripting


Chevereto 3.13.4 Core - Remote Code Execution


Chikitsa Patient Management System 2.0.2 - 'backup' Remote Code Execution (RCE) (Authenticated)


Chikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution (RCE) (Authenticated)


ChiKoi v1.0 - SQL Injection


Chitor-CMS v1.1.2 - Pre-Auth SQL Injection


Church Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)


Church Management System 1.0 - 'password' SQL Injection (Authentication Bypass)


Church Management System 1.0 - 'search' SQL Injection (Unauthenticated)


Church Management System 1.0 - Arbitrary File Upload (Authenticated)


Church Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Church Management System 1.0 - SQL Injection (Authentication Bypass) + Arbitrary File Upload + RCE


ChurchCRM 4.4.5 - SQLi


ChurchCRM 4.5.1 - Authenticated SQL Injection


ChurchCRM 5.9.1 - SQL Injection


ChurchCRM v4.5.3-121fcc1 - SQL Injection


ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)


Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS)


CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)


CKEditor 3 - Server-Side Request Forgery (SSRF)


CKEditor 5 35.4.0 - Cross-Site Scripting (XSS)


Clansphere CMS 2011.4 - Stored Cross-Site Scripting (XSS)


Class Scheduling System 1.0 - Multiple Stored XSS


Clcknshop 1.0.0 - SQL Injection


ClicShopping v3.402 - Cross-Site Scripting (XSS)


Client Details System 1.0 - SQL Injection


Client Management System 1.0 - 'searchdata' SQL injection


Client Management System 1.1 - 'cname' Stored Cross-site scripting (XSS)


Client Management System 1.1 - 'username' Stored Cross-Site Scripting (XSS)


Clinic Management System 1.0 - Authenticated Arbitrary File Upload


Clinic Management System 1.0 - Authentication Bypass


Clinic Management System 1.0 - SQL injection to Remote Code Execution


Clinic Management System 1.0 - Unauthenticated Remote Code Execution


Clinic Queuing System 1.0 - RCE


Clinic's Patient Management System 1.0 - Unauthenticated RCE


CloudClassroom PHP Project 1.0 - SQL Injection


Cmaps v8.0 - SQL injection


CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection


CMS Made Simple 2.2.14 - Arbitrary File Upload (Authenticated)


CMS Made Simple 2.2.14 - Authenticated Arbitrary File Upload


CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated)


CMS Made Simple 2.2.15 - 'title' Cross-Site Scripting (XSS)


CMS Made Simple 2.2.15 - RCE (Authenticated)


CMS Made Simple 2.2.15 - Stored Cross-Site Scripting via SVG File Upload (Authenticated)


CMSimple 5.15 - Remote Code Execution (RCE) (Authenticated)


CMSimple 5.2 - 'External' Stored XSS


CMSimple 5.4 - Cross Site Scripting (XSS)


CMSimple 5.4 - Local file inclusion (LFI) to Remote code execution (RCE) (Authenticated)


Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)


CMSimple_XH 1.7.4 - Remote Code Execution (RCE) (Authenticated)


CmsMadeSimple v2.2.17 - Remote Code Execution (RCE)


CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI)


CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS)


CMSUno 1.6 - Cross-Site Request Forgery (Change Admin Password)


CMSUno 1.6.2 - 'lang' Remote Code Execution (Authenticated)


CMSUno 1.6.2 - 'user' Remote Code Execution (Authenticated)


CMSuno 1.7 - 'tgo' Stored Cross-Site Scripting (XSS) (Authenticated)


Coastercms 5.8.18 - Stored XSS


Cockpit CMS 0.6.1 - Remote Code Execution


CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting (XSS)


CodeCanyon RISE CRM 3.7.0 - SQL Injection


Codoforum 4.8.3 - 'input_txt' Persistent Cross-Site Scripting


Codoforum 4.8.3 - Persistent Cross-Site Scripting


CodoForum v5.1 - Remote Code Execution (RCE)


Collabtive 3.1 - 'address' Persistent Cross-Site Scripting


College Management System 1.0 - 'course_code' SQL Injection (Authenticated)


College-Management-System-Php 1.0 - Authentication Bypass


Color Prediction Game v1.0 - SQL Injection


Comment System 1.0 - 'multiple' Stored Cross-Site Scripting


comments-like-dislike < 1.2.0 - Authenticated (Subscriber+) Plugin Setting Reset


Company Visitor Management System (CVMS) 1.0 - Authentication Bypass


Company's Recruitment Management System 1.0 -  'description' Stored Cross-Site Scripting (XSS)


Company's Recruitment Management System 1.0 - 'Add New user' Cross-Site Request Forgery (CSRF)


Company's Recruitment Management System 1.0 - 'Multiple' SQL Injection (Unauthenticated)


Company's Recruitment Management System 1.0. - 'title' Stored Cross-Site Scripting (XSS)


Companymaps v8.0 - Stored Cross Site Scripting (XSS)


Complaint Management System 1.0 - 'cid' SQL Injection


Complaint Management System 1.0 - 'username' SQL Injection


Complaint Management System 1.0 - Authentication Bypass


Complaint Management System 4.0 - 'cid' SQL injection


Complaint Management System 4.0 - Remote Code Execution


Complaint Management System 4.2 - Authentication Bypass


Complaint Management System 4.2 - Cross-Site Request Forgery (Delete User)


Complaint Management System 4.2 - Persistent Cross-Site Scripting


Complaints Report Management System 1.0 - 'username' SQL Injection / Remote Code Execution


Composr 10.0.36 - Remote Code Execution


Composr CMS 10.0.30 - Persistent Cross-Site Scripting


Composr CMS 10.0.34 - 'banners' Persistent Cross Site Scripting


Composr CMS 10.0.36 - Cross Site Scripting


Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution


Computer Laboratory Management System v1.0 - Multiple-SQLi


Concrete5 8.5.4 - 'name' Stored XSS


Concrete5 CME v9.1.3 - Xpath injection


Contao 4.13.2 - Cross-Site Scripting (XSS)


Content Management System 1.0 - 'email' SQL Injection


Content Management System 1.0 - 'First Name' Stored XSS


Content Management System 1.0 - 'id' SQL Injection


Control Web Panel 7 (CWP7) v0.9.8.1147 -  Remote Code Execution (RCE)


Coppermine Gallery 1.6.25 - RCE


Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting


CouchCMS 2.2.1 - Persistent Cross-Site Scripting


CouchCMS 2.2.1 - Server-Side Request Forgery


Courier Management System 1.0 - 'First Name' Stored XSS


Courier Management System 1.0 - 'MULTIPART street ((custom) ' SQL Injection


Courier Management System 1.0 - 'ref_no' SQL Injection


Covid-19 Contact Tracing System 1.0 - Remote Code Execution (Unauthenticated)


COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)


COVID19 Testing Management System 1.0 - 'Multiple' SQL Injections


COVID19 Testing Management System 1.0 - 'searchdata' SQL Injection


COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)


COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)


Craft CMS 4.4.14 - Unauthenticated Remote Code Execution


CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution


Credit Lite 1.5.4 - SQL Injection


Crime records Management System 1.0 - 'Multiple' SQL Injection (Authenticated)


Croogo 3.0.2 - 'Multiple' Stored Cross-Site Scripting (XSS)


Croogo 3.0.2 - Remote Code Execution (Authenticated)


Croogo 3.0.2 - Unrestricted File Upload


CRUD Operation 1.0 - Multiple Stored XSS


Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)


CS-Cart 1.3.3 - 'classes_dir' LFI


CS-Cart 1.3.3 - authenticated RCE


CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting


CSE Bookstore 1.0 - Authentication Bypass


CSE Bookstore 1.0 - Multiple SQL Injection


CSZ CMS 1.2.7 - 'title' HTML Injection


CSZ CMS 1.2.7 - Persistent Cross-Site Scripting


CSZ CMS 1.2.9 - 'Multiple' Arbitrary File Deletion


CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)


CSZ CMS 1.2.9 - Multiple Cross-Site Scripting


CSZ CMS 1.3.0 - 'Multiple' Blind SQLi


CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )


CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')


CSZ CMS Version 1.3.0 - Authenticated Remote Command Execution


CSZCMS v1.3.0 - SQL Injection (Authenticated)


Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)


Curfew e-Pass Management System 1.0 - FromDate SQL Injection


Curfew e-Pass Management System 1.0 - Stored XSS


Customer Relationship Management (CRM) System 1.0 - 'Category' Persistent Cross site Scripting


Customer Relationship Management System (CRM) 1.0 - Remote Code Execution


Customer Relationship Management System (CRM) 1.0 - Sql Injection Authentication Bypass


Customer Support System 1.0  - 'description' Stored XSS in The Admin Panel


Customer Support System 1.0 - _First Name_ & _Last Name_ Stored XSS


Customer Support System 1.0 - 'id' SQL Injection


Customer Support System 1.0 - 'username' Authentication Bypass


Customer Support System 1.0 - Cross-Site Request Forgery


Customer Support System 1.0 - Stored XSS


CuteEditor for PHP 6.6 - Directory Traversal


CuteNews 2.1.2 - Arbitrary File Deletion


CuteNews 2.1.2 - Authenticated Arbitrary File Upload


CuteNews 2.1.2 - Remote Code Execution


CVE-2023-50071 - Multiple SQL Injection


Cyber Cafe Management System  Project (CCMS) 1.0 - Persistent Cross-Site Scripting


Cyber Cafe Management System Project (CCMS) 1.0 - SQL Injection Authentication Bypass


Daily Expense Manager 1.0 - 'term' SQLi


Daily Expenses Management System 1.0 - 'item' SQL Injection


Daily Expenses Management System 1.0 - 'username' SQL Injection


Daily Habit Tracker 1.0 - Broken Access Control


Daily Habit Tracker 1.0 - SQL Injection


Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)


Daily Tracker System 1.0 - Authentication Bypass


Dairy Farm Shop Management System 1.0 - 'username' SQL Injection


Dairy Farm Shop Management System 1.0 - SQL Injection Authentication Bypass


DataCube3 v1.0 - Unrestricted file upload 'RCE'


dawa-pharma 1.0-2022 - Multiple-SQLi


DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting


DedeCMS v.5.8 - _keyword_ Cross-Site Scripting


Dental Clinic Appointment Reservation System 1.0 - 'date' UNION based SQL Injection (Authenticated)


Dental Clinic Appointment Reservation System 1.0 - 'Firstname' Persistent Cross Site Scripting (Authenticated)


Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass (SQLi)


Dental Clinic Appointment Reservation System 1.0 - Cross Site Request Forgery (Add Admin)


Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)


Diafan CMS 6.0 - Reflected Cross-Site Scripting (XSS)


Digi AnywhereUSB 14 - Reflective Cross-Site Scripting


Digital Crime Report Management System 1.0 - SQL Injection (Authentication Bypass)


Directory Management System 1.0 - SQL Injection Authentication Bypass


Django 3.0 - Cross-Site Request Forgery Token Bypass


Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)


Dolibarr 11.0.3 - Persistent Cross-Site Scripting


Dolibarr 12.0.3 - SQLi to RCE


Dolibarr ERP 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE)


Dolibarr ERP 14.0.1 - Privilege Escalation


Dolibarr ERP-CRM 12.0.3 - Remote Code Execution (Authenticated)


Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation


Dolibarr Version 17.0.1 - Stored XSS


Dompdf 1.2.1 - Remote Code Execution (RCE)


Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities


dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)


Dotclear 2.29 - Remote Code Execution (RCE)


Drupal 10.1.2 - web-cache-poisoning-External-service-interaction


Drupal 11.x-dev - Full Path Disclosure


Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS)


Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation


DynPG 4.9.1 - Persistent Cross-Site Scripting (Authenticated)


E-Commerce System 1.0 - Unauthenticated Remote Code Execution


E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS)


e-learning Php Script 0.1.0 - 'search' SQL Injection


E-Learning System 1.0 - Authentication Bypass


e107 CMS 2.3.0 - CSRF


e107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated)


e107 CMS v3.2.1 - Multiple Vulnerabilities


e107 v2.3.2 - Reflected XSS


Easy Appointments 1.4.2 - Information Disclosure


Easy2Pilot 7 - Cross-Site Request Forgery (Add User)


EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal)


ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)


Ecommerce Systempay 1.0 - Production KEY Brute Force


Ecommerse v1.0 - Cross-Site Scripting (XSS)


ECSIMAGING PACS 6.21.5 - Remote code execution


ECSIMAGING PACS 6.21.5 - SQL injection


EgavilanMedia PHPCRUD 1.0 - 'First Name' SQL Injection


EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting


EgavilanMedia User Registration & Login System with Admin Panel Exploit - SQLi Auth Bypass


eGroupWare 1.14 - 'spellchecker.php' Remote Command Execution


Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS


elaniin CMS - Authentication Bypass


elaniin CMS 1.0 - Authentication Bypass


Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Device Config Disclosure


eLection 2.0 - 'id' SQL Injection


Elementor Website Builder < 3.12.2 - Admin+ SQLi


elFinder Web file manager Version - 2.1.53 Remote Command Execution


ElkarBackup 1.3.3 - 'Policy[name]' and 'Policy[Description]' Stored Cross-site Scripting


ElkarBackup 1.3.3 - Persistent Cross-Site Scripting


ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated)


Emagic Data Center Management Suite v6.0 - OS Command Injection


Employee and Visitor Gate Pass Logging System 1.0 - 'name' Stored Cross-Site Scripting (XSS)


Employee Daily Task Management System 1.0 - 'Name' Stored Cross-Site Scripting (XSS)


Employee Management System 1.0 - 'admin_id' SQLi


Employee Management System 1.0 - Authentication Bypass


Employee Management System 1.0 - Cross Site Scripting (Stored)


Employee Management System 1.0 - _txtfullname_ and _txtphone_ SQL Injection


Employee Management System 1.0 - _txtusername_ and _txtpassword_ SQL Injection (Admin Login)


Employee Management System v1 - 'email' SQL Injection


Employee Performance Evaluation System 1.0 - 'Task and Description' Persistent Cross Site Scripting


Employee Performance Evaluation System v1.0 - File Inclusion and RCE


Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated)


Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS)


Employee Record System 1.0 - Multiple Stored XSS


Employee Record System 1.0 - Unrestricted File Upload to Remote Code Execution


Employee Task Management System v1.0 - Broken Authentication


Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?)


Employee Task Management System v1.0 - SQL Injection on edit-task.php


Employees Daily Task Management System 1.0 - 'multiple' Cross Site Scripting (XSS)


Employees Daily Task Management System 1.0 - 'username' SQLi Authentication Bypass


Engineers Online Portal 1.0 - 'id' SQL Injection


Engineers Online Portal 1.0 - 'multiple' Authentication Bypass


Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)


Engineers Online Portal 1.0 - File Upload Remote Code Execution (RCE)


Enrollment System Project v1.0 - SQL Injection Authentication Bypass (SQLI)


Equipment Inventory System 1.0 - 'multiple' Stored XSS


ERPGo SaaS 3.9 - CSV Injection


Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS)


Event Registration System with QR Code 1.0 - Authentication Bypass


Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)


Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)


Exam Form Submission System 1.0 - SQL Injection Authentication Bypass


Exam Hall Management System 1.0 - Unrestricted File Upload (Unauthenticated)


Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)


Exam Reviewer Management System 1.0 - Remote Code Execution (RCE) (Authenticated)


Exam Reviewer Management System 1.0 - ‘id’ SQL Injection


Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting


Explore CMS 1.0 - SQL Injection


Exponent CMS 2.6 - Multiple Vulnerabilities


Extensive VC Addons for WPBakery page builder 1.9.0 - Remote Code Execution (RCE)


eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)


EyesOfNetwork 5.3 - Remote Code Execution


EyouCMS 1.4.6 - Persistent Cross-Site Scripting


Faculty Evaluation System 1.0 - Stored XSS


Faculty Evaluation System 1.0 - Unauthenticated File Upload


Faculty Evaluation System v1.0 - SQL Injection


Fast PHP Chat 1.3 - 'my_item_search' SQL Injection


Faulty Evaluation System 1.0 - 'multiple' Stored Cross-Site Scripting


Feehi CMS 2.1.1 - Remote Code Execution (Authenticated)


Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)


Feng Office 3.11.1.2 - SQL Injection


FHEM 6.0 - Local File Inclusion


File Management System 1.1 - Persistent Cross-Site Scripting


File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)


File Thingie 2.5.7 - Remote Code Execution (RCE)


FileCloud 21.2 - Cross-Site Request Forgery (CSRF)


Filerun 2021.03.26 - Remote Code Execution (RCE) (Authenticated)


Fishing Reservation System 7.5 - 'uid' SQL Injection


Flatboard 3.2 - Stored Cross-Site Scripting (XSS) (Authenticated)


flatCore 1.5 - Cross Site Request Forgery (CSRF)


flatCore 1.5.5 - Arbitrary File Upload


FlatCore CMS 2.0.7 - Remote Code Execution (RCE) (Authenticated)


FlatCore CMS 2.1.1 - Stored Cross-Site Scripting (XSS)


flatnux 2021-03.25 - Remote Code Execution (Authenticated)


Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting


FlatPress v1.3 - Remote Command Execution


FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin)


FluxBB 1.5.11 - Stored Cross-Site Scripting (XSS)


FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)


FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)


FOGProject 1.5.9 - File Upload RCE (Authenticated)


Fork CMS 5.8.0 - Persistent Cross-Site Scripting


Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting


forma.lms 5.6.40 - Cross-Site Request Forgery (Change Admin Email)


forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting


Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)


Free School Management Software 1.0 - Remote Code Execution (RCE)


FreePBX 16 -  Remote Code Execution (RCE) (Authenticated)


Froxlor 0.10.29.1 - SQL Injection (Authenticated)


Froxlor 2.0.3 Stable - Remote Code Execution (RCE)


Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting


FUDForum 3.1.0 - 'author' Reflected XSS


FUDForum 3.1.0 - 'srch' Reflected XSS


Fuel CMS 1.4.1 - Remote Code Execution (2)


Fuel CMS 1.4.1 - Remote Code Execution (3)


Fuel CMS 1.4.13 - 'col' Blind SQL Injection (Authenticated)


Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)


Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Injection (Authenticated)


Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)


Fundraising Script 1.0 - SQLi


FusionPBX 4.5.29 - Remote Code Execution (RCE) (Authenticated)


Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS)


Garbage Collection Management System 1.0 - SQL Injection (Unauthenticated)


Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload


GDidees CMS 3.9.1 - Local File Disclosure


GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting


GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)


GetSimple CMS 3.3.4 - Information Disclosure


GetSimple CMS Custom JS 0.1 - Cross-Site Request Forgery


GetSimple CMS My SMTP Contact Plugin 1.1.1 - Cross-Site Request Forgery


GetSimple CMS My SMTP Contact Plugin 1.1.2 - Persistent Cross-Site Scripting


GetSimple CMS Plugin Multi User 1.8.2 - Cross-Site Request Forgery (Add Admin)


GetSimple CMS v3.3.16 - Remote Code Execution (RCE)


GetSimpleCMS 3.3.16 - Remote Code Execution (RCE)


Gibbon LMS < v26.0.00 - Authenticated RCE


Gibbon LMS v26.0.00 - SSTI vulnerability


Gila CMS 1.10.9 - Remote Code Execution (RCE) (Authenticated)


Gila CMS 1.11.8 - 'query' SQL Injection


Gila CMS 2.0.0 - Remote Code Execution (Unauthenticated)


Global - Multi School Management System Express v1.0- SQL Injection


GLPI  Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)


GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin


GLPI 9.4.5 - Remote Code Execution (RCE)


GLPI 9.5.3 - 'fromtype' Unsafe Reflection


GLPI 9.5.7 - Username Enumeration


GLPI Activity  v3.1.0 - Authenticated Local File Inclusion on Activity plugin


GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion


GLPI GZIP(Py3) 9.4.5 - RCE


GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration)


Gnuboard5 5.3.2.8 - SQL Injection


GOautodial 4.0 - Authenticated Shell Upload


GOautodial 4.0 - Persistent Cross-Site Scripting (Authenticated)


Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting


Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)


Grav CMS 1.7.48 - Remote Code Execution (RCE)


GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)


GravCMS 1.10.7 - Unauthenticated Arbitrary File Write (Metasploit)


grocy 2.7.1 - Persistent Cross-Site Scripting


Grocy <=4.0.2 - CSRF


Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)


Groomify v1.0 - SQL Injection


GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection


GUnet OpenEclass E-learning platform 1.7.3 - 'uname' SQL Injection


GUnet OpenEclass E-learning platform 3.15 - 'certbadge.php' Unrestricted File Upload


GuppY CMS v6.00.10 - Remote Code Execution


Gym Management System 1.0 - 'id' SQL Injection


Gym Management System 1.0 - Authentication Bypass


Gym Management System 1.0 - Stored Cross Site Scripting


Gym Management System 1.0 - Unauthenticated Remote Code Execution


GYM MS - GYM Management System - Cross Site Scripting (Stored)


GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)


Helmet Store Showroom v1.0 - SQL Injection


Helpdeskz v2.0.2 - Stored XSS


Hestia Control Panel 1.3.2 - Arbitrary File Write


Hide My WP < 6.2.9 - Unauthenticated SQLi


hits script 1.0 - 'item_name' SQL Injection


Home Owners Collection Management System 1.0 - 'id' Blind SQL Injection


Home Owners Collection Management System 1.0 - Account Takeover (Unauthenticated)


Home Owners Collection Management System 1.0 - Remote Code Execution (RCE) (Authenticated)


Horde Groupware Webmail Edition 5.2.22 - PHAR Loading


Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion


Horde Groupware Webmail Edition 5.2.22 - Remote Code Execution


Hospital Management Startup 1.0 - 'Multiple' SQLi


Hospital Management System 4.0 - 'multiple' SQL Injection


Hospital Management System 4.0 - 'searchdata' SQL Injection


Hospital Management System 4.0 - Authentication Bypass


Hospital Management System 4.0 - Persistent Cross-Site Scripting


Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)


Hospitals Patient Records Management System 1.0 - 'doctors' Stored Cross Site Scripting (XSS)


Hospitals Patient Records Management System 1.0 - 'id' SQL Injection (Authenticated)


Hospitals Patient Records Management System 1.0 - 'room_list' Stored Cross Site Scripting (XSS)


Hospitals Patient Records Management System 1.0 - 'room_types' Stored Cross Site Scripting (XSS)


Hospitals Patient Records Management System 1.0 - Account TakeOver


Hostel Management System 2.0 - 'id' SQL Injection


Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated)


Hostel Management System 2.1 - Cross Site Scripting (Multiple Fields)


Hostel Management System 2.1 - Cross Site Scripting (XSS)


Hotel And Lodge Management System 1.0 - 'Customer Details' Stored XSS


Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated)


Hotel Druid 3.0.3 - Remote Code Execution (RCE)


Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)


Hotel Management System 1.0 - Remote Code Execution (Authenticated)


Hotel Reservation System 1.0 - SQLi (Unauthenticated)


House Rental 1.0 - 'keywords' SQL Injection


HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)


Hrsale 2.0.0 - Local File Inclusion


htmlLawed 1.2.5 - Remote Code Execution (RCE)


HTMLy Version v2.9.6 - Stored XSS


Human Resource Information System  0.1  - 'First Name' Persistent Cross-Site Scripting (Authenticated)


Human Resource Information System 0.1 - Remote Code Execution (Unauthenticated)


Human Resource Management System 1.0 - 'employeeid' SQL Injection


Human Resource Management System 1.0 - SQL Injection (unauthenticated)


Human Resource Management System v1.0 - Multiple SQLi


Human Resources Management System v1.0 - Multiple SQLi


Hyip Rio 2.1 - Arbitrary File Upload


i-doit Open Source CMDB 1.14.1 - Arbitrary File Deletion


i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS)


iBooking v1.0.8 - Arbitrary File Upload


Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)


ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)


ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)


ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion


ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover


IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting


Icinga Web 2.10 - Arbitrary File Disclosure


Icinga Web 2.10 - Authenticated Remote Code Execution


IFSC Code Finder Project 1.0 - SQL injection (Unauthenticated)


iMLog < 1.307 - Persistent Cross Site Scripting (XSS)


ImpressCMS 1.4.2 - Remote Code Execution (RCE)


ImpressCMS 1.4.2 - Remote Code Execution (RCE) (Authenticated)


ImpressCMS v1.4.3 - Authenticated SQL Injection


ImpressCMS v1.4.4 - Unrestricted File Upload


Infor Storefront B2B 1.0 - 'usr_name' SQL Injection


InoERP 0.7.2 - Remote Code Execution (Unauthenticated)


Insurance Management System PHP and MySQL 1.0 - Multiple Stored XSS


Intern Record System v1.0 - SQL Injection (Unauthenticated)


Internship Portal Management System 1.0 - Remote Code Execution(Unauthenticated)


Interview Management System 1.0 - 'id' SQL Injection


Interview Management System 1.0 - Stored XSS in Add New Question


Inventio Lite 4 - SQL Injection


Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)


itech TrainSmart r1044 - SQL injection


Jasmin Ransomware - SQL Injection Login Bypass


Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls


Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path


Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts


Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module


Jedox 2022.4.2 - Code Execution via RPC Interfaces


Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks


Jedox 2022.4.2 - Remote Code Execution via Directory Traversal


Jetpack 11.4 - Cross Site Scripting (XSS)


JFrog Artifactory < 7.25.4 - Blind SQL Injection


jizhi CMS 1.6.7 - Arbitrary File Download


JLex GuestBook 1.6.4 - Reflected XSS


Job Portal 1.0 - File Upload Restriction Bypass


Job Portal 1.0 - Remote Code Execution


Jobpilot v2.61 - SQL Injection


Joomla HikaShop 4.7.4 - Reflected XSS


Joomla iProperty Real Estate 4.1.1 - Reflected XSS


Joomla JCK Editor 6.4.4 - 'parent' SQL Injection (2)


Joomla JLex Review 6.0.1 - Reflected XSS


Joomla JS Jobs plugin 1.4.2 - SQL injection


Joomla Plugin SexyPolling 2.1.7 - SQLi


Joomla Plugin Simple Image Gallery Extended (SIGE) 3.5.3 - Multiple Vulnerabilities


Joomla Solidres 2.13.3 - Reflected XSS


Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS


Joomla! 3.9.0 < 3.9.7 - CSV Injection


Joomla! Component ACYMAILING 3.9.0 - Unauthenticated Arbitrary File Upload


Joomla! Component com_newsfeeds 1.0 - 'feedid' SQL Injection


Joomla! Component GMapFP 3.30 - Arbitrary File Upload


Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload


Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration)


Joomla! com_fabrik 3.9.11 - Directory Traversal


Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection


Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection


Joomla! J2 Store 3.3.11 - 'filter_order_Dir' Authenticated SQL Injection


Joomla! paGO Commerce 2.5.9.0 - SQL Injection (Authenticated)


Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion (Authenticated)


Joomla! v4.2.8 - Unauthenticated information disclosure


Jorani v1.0.3-(c)2014-2023 - XSS Reflected & Information Disclosure


Judging Management System v1.0 - Authentication Bypass


Judging Management System v1.0 - Remote Code Execution (RCE)


Juniper-SRX-Firewalls&EX-switches - (PreAuth-RCE) (PoC)


JUX Real Estate 3.4.0 - SQL Injection


Karakuzu ERP Management Web 5.7.0 - 'k_adi_duz' SQL Injection


Kentico CMS 9.0-12.0.49 - Persistent Cross Site Scripting


Kimai 1.14 - CSV Injection


Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking


Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)


KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection


kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition


KLiK Social Media Website 1.0 - 'Multiple' SQLi


Klog Server 2.4.1 - Command Injection (Authenticated)


Klog Server 2.4.1 - Command Injection (Unauthenticated)


Klog Server 2.4.1 - Unauthenticated Command Injection (Metasploit)


Kmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)


KodExplorer 4.49 - CSRF to Arbitrary File Upload


KodExplorer 4.52 - Open Redirect


KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE)


Koken CMS 0.22.24 - Arbitrary File Upload (Authenticated)


Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting


Landa Driving School Management System 2.0.1 - Arbitrary File Upload


Laravel 8.4.2 debug mode - Remote code execution


Laravel Administrator 4 - Unrestricted File Upload (Authenticated)


Laravel Framework 11 - Credential Leakage


Laravel Nova 3.7.0 - 'range' DoS


Laravel Pulse 1.3.1 - Arbitrary Code Injection


Laundry Booking Management System 1.0 - 'Multiple' SQL Injection


Laundry Booking Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)


Laundry Booking Management System 1.0 - Remote Code Execution (RCE)


Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal


LayerBB 1.1.4 - 'search_query' SQL Injection


LDAP Tool Box Self Service Password v1.5.2 -  Account takeover


LeadPro CRM v1.0 - SQL Injection


Leafpub 1.1.9 - Stored Cross-Site Scripting (XSS)


LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection


LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting


LeptonCMS 4.5.0 - Persistent Cross-Site Scripting


LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated)


Library CMS Powerful Book Management System 2.2.0 - Session Fixation


Library Management System 1.0 - Blind Time-Based SQL Injection (Unauthenticated)


Library Management System 2.0 - Auth Bypass SQL Injection


Library Management System 3.0 - _Add Category_ Stored XSS


Library System 1.0 - 'category' SQL Injection


Library System 1.0 - 'student_id' SQL injection (Authenticated)


Library System 1.0 - Authentication Bypass


Library System in PHP 1.0 - 'publisher name' Stored Cross-Site Scripting (XSS)


LibreHealth 2.0.0 - Authenticated Remote Code Execution


Life Insurance Management System 1.0 - 'client_id' SQL Injection


Life Insurance Management System 1.0 - File Upload RCE (Authenticated)


Life Insurance Management System 1.0 - Multiple Stored XSS


Lightweight facebook-styled blog 1.3 - Remote Code Execution (RCE) (Authenticated) (Metasploit)


Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)


LimeSurvey 4.1.11 - 'File Manager' Path Traversal


LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting


LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting


LimeSurvey 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting


LimeSurvey 5.2.4 - Remote Code Execution (RCE) (Authenticated)


LimeSurvey Community 5.3.32 - Stored XSS


Limo Booking Software v1.0 - CORS


Litespeed Cache 6.5.0.1 - Authentication Bypass


Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation


LiteSpeed Web Server Enterprise 5.4.11 - Command Injection (Authenticated)


LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Department Assignment Alias Nick Field


LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Facebook Integration Page Name Field


LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Operator Surname


LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Personal Canned Messages


LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Telegram Bot Username


LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via the Chat Transfer Function


liveSite Version 2019.1 - Remote Code Execution


LiveZilla Server 8.0.1.0 - 'Accept-Language' Reflected XSS


Loaded Commerce 6.6 - Client-Side Template Injection(CSTI)


Loan Management System 1.0 - Multiple Cross Site Scripting (Stored)


Loan Management System 1.0 - SQLi Authentication Bypass


Local Services Search Engine Management System (LSSMES) 1.0 - 'name' Persistent Cross-Site Scripting (XSS)


Local Services Search Engine Management System (LSSMES) 1.0 - Blind & Error based SQL injection (Authenticated)


Lodging Reservation Management System 1.0 - Authentication Bypass


Lost and Found Information System v1.0 - ( IDOR ) leads to Account Take over


Lost and Found Information System v1.0 - SQL Injection


Lot Reservation Management System - Unauthenticated File Disclosure


Lot Reservation Management System - Unauthenticated File Upload and Remote Code Execution


Lot Reservation Management System 1.0 - Authentication Bypass


Lot Reservation Management System 1.0 - Cross-Site Scripting (Stored)


Lotus Core CMS 1.0.1 - Local File Inclusion


m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)


Macs Framework 1.14f CMS - Persistent Cross-Site Scripting


Magento eCommerce CE v2.3.5-p2 - Blind SQLi


Magento WooCommerce CardGate Payment Gateway 2.0.30 - Payment Process Bypass


Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)


MagpieRSS 0.72 - 'url' Command Injection


Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)


Maian-Cart 3.8 - Remote Code Execution (RCE) (Unauthenticated)


Mantis Bug Tracker 2.24.3 - 'access' SQL Injection


Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)


Mara CMS  7.5 - Reflective Cross-Site Scripting


Mara CMS 7.5 - Remote Code Execution (Authenticated)


Mars Stealer 8.3 - Admin Account Takeover


MedDream PACS Server 6.8.3.751 - Remote Code Execution (Authenticated)


MedDream PACS Server 6.8.3.751 - Remote Code Execution (Unauthenticated)


Media Library Assistant Wordpress Plugin - RCE and LFI


Medical Center Portal Management System 1.0 - 'id' SQL Injection


Medical Center Portal Management System 1.0 - 'login' SQL Injection


Medical Center Portal Management System 1.0 - Multiple Stored XSS


Medicine Tracker System v1.0 - Sql Injection


Member Login Script 3.3 - Client-side desync


Men Salon Management System 1.0 - Multiple Vulnerabilities


Men Salon Management System 1.0 - SQL Injection Authentication Bypass


meterN v1.2.3 - Remote Code Execution (RCE) (Authenticated)


Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)


Microfinance Management System 1.0 - 'customer_number' SQLi


Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)


Microweber 2.0.15 - Stored XSS


Microweber CMS 1.1.20 - Remote Code Execution (Authenticated)


Microweber CMS 1.2.10 - Local File Inclusion (Authenticated) (Metasploit)


Microweber CMS 1.2.15 - Account Takeover


MiladWorkShop VIP System 1.0 - 'lang' SQL Injection


minewebcms 1.15.2 - Cross-site Scripting (XSS)


MiniCMS 1.1 - Cross Site Scripting (XSS)


MiniCMS 1.10 - 'content box' Stored XSS


MISP 2.4.171 - Stored XSS


Mobile Shop System v1.0 - SQL Injection Authentication Bypass


MobileDetect 2.8.31 - Cross-Site Scripting (XSS)


MobileShop master v1.0 - SQL Injection Vuln.


MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution


Money Transfer Management System 1.0 - Authentication Bypass


Monitoring System (Dashboard) 1.0 - 'uname' SQL Injection


Monitoring System (Dashboard) 1.0 - File Upload RCE (Authenticated)


Monitorr 1.7.6m - Authorization Bypass


Monitorr 1.7.6m - Remote Code Execution (Unauthenticated)


MonoCMS Blog 1.0 - Arbitrary File Deletion (Authenticated)


Monstra 3.0.4 - Stored Cross-Site Scripting (XSS)


Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload


Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)


Monstra CMS 3.0.4 - Remote Code Execution (RCE)


Montiorr 1.7.6m - Persistent Cross-Site Scripting


mooDating 1.2 - Reflected Cross-site scripting (XSS)


Moodle 3.10.1 - Authenticated Blind Time-Based SQL Injection - _sort_ parameter


Moodle 3.10.3 - 'label' Persistent Cross Site Scripting


Moodle 3.10.3 - 'url' Persistent Cross Site Scripting


Moodle 3.11.4  - SQL Injection


Moodle 3.11.5 - SQLi (Authenticated)


Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)


Moodle 3.8 - Unrestricted File Upload


Moodle 3.9 - Remote Code Execution (RCE) (Authenticated)


Moodle 4.3 - Insecure Direct Object Reference


Moodle LMS 4.0 - Cross-Site Scripting (XSS)


mooSocial 3.1.8 - Reflected XSS


MotoCMS Version 3.4.3 - SQL Injection


MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection


Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated)


Movie Rating System 1.0 - SQLi to RCE (Unauthenticated)


moziloCMS 2.0 - Persistent Cross-Site Scripting (Authenticated)


MoziloCMS 3.0 - Remote Code Execution (RCE)


MPC Sharj 3.11.1 - Arbitrary File Download


mPDF 7.0 - Local File Inclusion


Mult-e-Cart Ultimate 2.4 - 'id' SQL Injection


Multi Branch School Management System 3.5 - _Create Branch_ Stored XSS


Multi Restaurant Table Reservation System 1.0 - 'table_id' Unauthenticated SQL Injection


Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS


Multi-Vendor Online Groceries Management System 1.0 - 'id' Blind SQL Injection


Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution


Music Gallery Site v1.0 - Broken Access Control


Music Gallery Site v1.0 - SQL Injection on  music_list.php


Music Gallery Site v1.0 - SQL Injection on page Master.php


Music Gallery Site v1.0 - SQL Injection on page view_music_details.php


MyBB 1.8.25 - Chained Remote Command Execution


MyBB 1.8.25 - Poll Vote Count SQL Injection


MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)


MyBB 1.8.32 - Remote Code Execution (RCE) (Authenticated)


MyBB Delete Account Plugin 1.4 - Cross-Site Scripting


myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)


MyBB Hide Thread Content Plugin 1.0 - Information Disclosure


MyBB OUGC Feedback Plugin 1.8.22 - Cross-Site Scripting


MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting


MyBB Timeline Plugin 1.0 - Persistent Cross-Site Scripting


MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting


Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution


Nagios XI 5.7.3 - 'Contact Templates' Persistent Cross-Site Scripting


Nagios XI 5.7.3 - 'Manage Users' Authenticated SQL Injection


Nagios XI 5.7.3 - 'mibs.php' Remote Command Injection (Authenticated)


Nagios XI 5.7.3 - 'SNMP Trap Interface' Authenticated SQL Injection


Nagios XI 5.7.5 - Multiple Persistent Cross-Site Scripting


Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)


NagVis 1.9.33 - Arbitrary File Read


NanoCMS v0.4 - Remote Code Execution (RCE) (Authenticated)


Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated)


Navigate CMS 2.8.7 - Authenticated Directory Traversal


Navigate CMS 2.8.7 - Cross-Site Request Forgery (Add Admin)


Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)


Neontext Wordpress Plugin - Stored XSS


Nettmp NNT 5.1 - SQLi Authentication Bypass


News Portal v4.0 - SQL Injection (Unauthorized)


NEWS-BUZZ News Management System 1.0 - SQL Injection


NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi


NotrinosERP 0.7 - Authenticated Blind SQL Injection


NukeViet VMS 4.4.00 - Cross-Site Request Forgery (Change Admin Password)


Octeth Oempro 4.8 - 'CampaignID' SQL Injection


October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)


October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)


Old Age Home Management System 1.0 - SQLi Authentication Bypass


Online Admission System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Online AgroCulture Farm Management System 1.0 - 'pid' SQL Injection


Online AgroCulture Farm Management System 1.0 - 'uname' SQL Injection


Online Appointment System V1.0 - Cross-Site Scripting (XSS)


Online Art gallery project 1.0 - Arbitrary File Upload (Unauthenticated)


Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting (XSS)


Online Book Store 1.0 - 'bookisbn' SQL Injection


Online Book Store 1.0 - 'id' SQL Injection


Online Book Store 1.0 - Arbitrary File Upload


Online Book Store 1.0 - Unauthenticated Remote Code Execution


Online Bus Ticket Reservation 1.0 - SQL Injection


Online Car Rental System 1.0 - Stored Cross Site Scripting


Online Catering Reservation System 1.0 - Remote Code Execution (Unauthenticated)


online Chatting System 1.0 - 'id' SQL Injection


Online Clinic Management System 2.2 - Multiple Stored Cross-Site Scripting (XSS)


Online Clothing Store 1.0 - 'username' SQL Injection


Online Clothing Store 1.0 - Arbitrary File Upload


Online Clothing Store 1.0 - Persistent Cross-Site Scripting


Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)


Online Course Registration 1.0 - Authentication Bypass


Online Course Registration 1.0 - Blind Boolean-Based SQL Injection (Authenticated)


Online Course Registration 1.0 - Unauthenticated Remote Code Execution


Online Course Registration 2.0 - Authentication Bypass


Online Course Registration 2.0 - Remote Code Execution


Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection


Online Covid Vaccination Scheduler System 1.0 - Arbitrary File Upload to Remote Code Execution (Unauthenticated)


Online Diagnostic Lab Management System 1.0 - Account Takeover (Unauthenticated)


Online Diagnostic Lab Management System 1.0 - SQL Injection (Unauthenticated)


Online Diagnostic Lab Management System 1.0 - Stored Cross Site Scripting (XSS)


Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated)


Online Discussion Forum Site 1.0 - Remote Code Execution


Online Discussion Forum Site 1.0 - XSS in Messaging System


Online DJ Booking Management System 1.0 - 'Multiple' Blind Cross-Site Scripting


Online Doctor Appointment Booking System PHP and Mysql 1.0 - 'q' SQL Injection


Online Doctor Appointment System 1.0 - 'Multiple' Stored XSS


Online Documents Sharing Platform 1.0 - 'user' SQL Injection


Online Employees Work From Home Attendance System 1.0 - SQLi Authentication Bypass


Online Enrollment Management System 1.0 - Authentication Bypass


Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting


Online Event Booking and Reservation System 1.0 - 'reason' Stored Cross-Site Scripting (XSS)


Online Exam System With Timer 1.0  - 'email' SQL injection Auth Bypass


Online Examination System 1.0 - 'eid' SQL Injection


Online Examination System 1.0 - 'name' Stored Cross Site Scripting


Online Examination System Project 1.0 - Cross-site request forgery (CSRF)


Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated)


Online Farm Management System 0.1.0 - Persistent Cross-Site Scripting


Online Fire Reporting System OFRS  - SQL Injection Authentication Bypass


Online Food Ordering System 1.0 - Remote Code Execution


Online Food Ordering System 2.0 -  Remote Code Execution (RCE) (Unauthenticated)


Online Grading System 1.0 - 'uname' SQL Injection


Online Health Care System 1.0 - Multiple Cross Site Scripting (Stored)


Online Healthcare management system 1.0 - Authentication Bypass


Online Healthcare Patient Record Management System 1.0 - Authentication Bypass


Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated)


Online Hotel Reservation System 1.0 - 'description' Stored Cross-site Scripting


Online Hotel Reservation System 1.0 - 'id' Time-based SQL Injection


Online Hotel Reservation System 1.0 - 'Multiple' Cross-site scripting (XSS)


Online Hotel Reservation System 1.0 - 'person' time-based SQL Injection


Online Hotel Reservation System 1.0 - Admin Authentication Bypass


Online Hotel Reservation System 1.0 - Cross-site request forgery (CSRF)


Online ID Generator 1.0 - Remote Code Execution (RCE)


Online Internship Management System 1.0 - 'email' SQL injection Auth Bypass


Online Job Portal 1.0 - 'userid' SQL Injection


Online Job Portal 1.0 - 'user_email' SQL Injection


Online Job Portal 1.0 - Cross Site Request Forgery (Add User)


Online Job Portal 1.0 - Cross Site Scripting (Stored)


Online Job Portal 1.0 - Remote Code Execution


Online Learning Management System 1.0 - 'id' SQL Injection


Online Learning Management System 1.0 - Authentication Bypass


Online Learning Management System 1.0 - Multiple Stored XSS


Online Learning Management System 1.0 - RCE (Authenticated)


Online Learning System 2.0 - 'Multiple' SQLi Authentication Bypass


Online Learning System 2.0 - Remote Code Execution (RCE)


Online Leave Management System 1.0 - Arbitrary File Upload to Shell (Unauthenticated)


Online Library Management System 1.0 - 'Search' SQL Injection


Online Library Management System 1.0 - Arbitrary File Upload


Online Library Management System 1.0 - Arbitrary File Upload Remote Code Execution (Unauthenticated)


Online Magazine Management System 1.0 - SQLi Authentication Bypass


Online Marriage Registration System (OMRS) 1.0 - Remote Code Execution (2)


Online Marriage Registration System (OMRS) 1.0 - Remote code execution (3)


Online Marriage Registration System 1.0 - 'searchdata' SQL Injection


Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting


Online Marriage Registration System 1.0 - Remote Code Execution (1)


Online Matrimonial Project 1.0 - Authenticated Remote Code Execution


Online Motorcycle (Bike) Rental System 1.0 - Blind Time-Based SQL Injection (Unauthenticated)


Online Movie Streaming  1.0 - Authentication Bypass


Online Movie Streaming 1.0 - Admin Authentication Bypass


Online News Portal 1.0 - 'Multiple' Stored Cross-Site Scripting


Online News Portal 1.0 - 'name' SQL Injection


Online Nurse Hiring System 1.0 - Time-Based SQL Injection


Online Ordering System 1.0 - Arbitrary File Upload


Online Ordering System 1.0 - Blind SQL Injection (Unauthenticated)


Online Piggery Management System v1.0 - unauthenticated file upload vulnerability


Online Pizza Ordering System v1.0 - Unauthenticated File Upload


Online Polling System 1.0 - Authentication Bypass


Online Pre-owned/Used Car Showroom Management System 1.0 -  SQLi Authentication Bypass


Online Project Time Management System 1.0 - Multiple Stored Cross Site Scripting (XSS) (Authenticated)


Online Project Time Management System 1.0 - SQLi (Authenticated)


Online Railway Reservation System 1.0 - 'id' SQL Injection (Unauthenticated)


Online Railway Reservation System 1.0 - 'Multiple' Stored Cross Site Scripting (XSS) (Unauthenticated)


Online Railway Reservation System 1.0 - Admin Account Creation (Unauthenticated)


Online Railway Reservation System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Online Resort Management System 1.0 - SQLi (Authenticated)


Online Reviewer System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Online Scheduling System 1.0 - 'username' SQL Injection


Online Scheduling System 1.0 - Authentication Bypass


Online Scheduling System 1.0 - Persistent Cross-Site Scripting


Online Security Guards Hiring System 1.0 - Reflected XSS


Online Shop Project 1.0 - 'p' SQL Injection


Online Shopping Alphaware 1.0 - 'id' SQL Injection


Online Shopping Alphaware 1.0 - Authentication Bypass


Online Shopping Alphaware 1.0 - Error Based SQL injection


Online Shopping Cart System 1.0 - 'id' SQL Injection


Online Shopping Portal 3.1 - 'email' SQL Injection


Online Shopping Portal 3.1 - Authentication Bypass


Online Shopping Portal 3.1 - Remote Code Execution (Unauthenticated)


Online Shopping System Advanced - Sql Injection


Online shopping system advanced 1.0 - 'p' SQL Injection


Online shopping system advanced 1.0 - Multiple Vulnerabilities


Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)


Online Student Enrollment System 1.0 - Unauthenticated Arbitrary File Upload


Online Student's Management System 1.0 - Remote Code Execution (Authenticated)


Online Students Management System 1.0 - 'username' SQL Injections


Online Thesis Archiving System 1.0 - SQLi Authentication Bypass


Online Thesis Archiving System v1.0 - Multiple-SQLi


Online Tours & Travels Management System 1.0 - _id_ SQL Injection


Online Traffic Offense Management System 1.0 - 'id' SQL Injection (Authenticated)


Online Traffic Offense Management System 1.0 - Multiple RCE (Unauthenticated)


Online Traffic Offense Management System 1.0 - Multiple SQL Injection (Unauthenticated)


Online Traffic Offense Management System 1.0 - Multiple XSS (Unauthenticated)


Online Traffic Offense Management System 1.0 - Privilage escalation (Unauthenticated)


Online Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Online Veterinary Appointment System 1.0 - 'Multiple' SQL Injection


Online Voting System 1.0 - Authentication Bypass (SQLi)


Online Voting System 1.0 - Remote Code Execution (Authenticated)


Online Voting System 1.0 - SQLi (Authentication Bypass) + Remote Code Execution (RCE)


Online-Exam-System 2015 - 'feedback' SQL Injection


Online-Exam-System 2015 - 'fid' SQL Injection


Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)


Open Source Medicine Ordering System v1.0 - SQLi


Open Web Analytics 1.7.3 - Remote Code Execution


Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)


Open-AudIT Community 4.2.0 - Cross-Site Scripting (XSS) (Authenticated)


Open-AudIT Professional 3.3.1 - Remote Code Execution


OpenBMCS 2.4 - Create Admin / Remote Privilege Escalation


OpenBMCS 2.4 - Cross Site Request Forgery (CSRF)


OpenBMCS 2.4 - Information Disclosure


OpenBMCS 2.4 - Server Side Request Forgery (SSRF) (Unauthenticated)


OpenBMCS 2.4 - SQLi (Authenticated)


Opencart 3 Extension TMD Vendor System - Blind SQL Injection


OpenCart 3.0.3.2 - Stored Cross Site Scripting (Authenticated)


OpenCart 3.0.3.6 - 'Profile Image' Stored Cross-Site Scripting (Authenticated)


OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting


OpenCart 3.0.3.6 - Cross Site Request Forgery


OpenCart 3.0.3.7 - 'Change Password' Cross-Site Request Forgery (CSRF)


opencart 3.0.3.8 - Sessjion Injection


OpenCart 3.0.36 - ATO via Cross Site Request Forgery


OpenCart Core 4.0.2.3 - 'search' SQLi


OpenCart Theme Journal 3.1.0 - Sensitive Data Exposure


OpenCart v3.x Newsletter Module - Blind SQLi


OpenCATS 0.9.4 - Remote Code Execution (RCE)


OpenCats 0.9.4-2 - 'docx ' XML External Entity Injection (XXE)


OpenClinic GA 5.247.01 - Information Disclosure


OpenClinic GA 5.247.01 - Path Traversal (Authenticated)


OpenCMS 17.0 - Stored Cross Site Scripting (XSS)


OpenEMR 4.1.0 - 'u' SQL Injection


OpenEMR 5.0.0 - Remote Code Execution (Authenticated)


OpenEMR 5.0.1 - 'controller' Remote Code Execution


OpenEMR 5.0.1 - Remote Code Execution (1)


OpenEMR 5.0.1 - Remote Code Execution (Authenticated) (2)


OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated)


OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2)


OpenEMR 5.0.1.3 - Authentication Bypass


OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated)


OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) (2)


OpenEMR 5.0.2.1 - Remote Code Execution


OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR)


OpenEMR v7.0.1 - Authentication credentials brute force


OpenRepeater 2.1 - OS Command Injection


OpenSIS 8.0 'modname' - Directory Traversal


OpenSIS 8.0 - 'cp_id_miss_attn' Reflected Cross-Site Scripting (XSS)


openSIS 9.1 - SQLi (Authenticated)


OpenSIS Community 8.0 - 'cp_id_miss_attn' SQL Injection


openSIS Community Edition 8.0 - SQL Injection


openSIS Student Information System 8.0 - 'multiple' SQL Injection


OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting


Oriol Espinal CMS 1.0 - 'id' SQL Injection


osCommerce 2.3.4.1 - 'title' Persistent Cross-Site Scripting


osCommerce 2.3.4.1 - Remote Code Execution (2)


osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting


osTicket 1.14.1 - 'Ticket Queue' Persistent Cross-Site Scripting


osTicket 1.14.1 - Persistent Authenticated Cross-Site Scripting


osTicket 1.14.2 - SSRF


Ovidentia 6 - 'id' SQL injection (Authenticated)


OVOO Movie Portal CMS v3.3.3 - SQL Injection


OXID eShop 6.3.4 - 'sorting' SQL Injection


PackWeb Formap E-learning 1.0 - 'NumCours' SQL Injection


Paid Memberships Pro  v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection


Pandora 7.0NG - Remote Code Execution


Pandora FMS 7.0 NG 749 - 'CG Items' SQL Injection (Authenticated)


Pandora FMS 7.0 NG 749 - Multiple Persistent Cross-Site Scripting Vulnerabilities


Pandora FMS 7.0 NG 750 - 'Network Scan' SQL Injection (Authenticated)


Pandora FMS 7.0NG - 'net_tools.php' Remote Code Execution


Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)


PANDORAFMS 7.0 - Authenticated Remote Code Execution


PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting


PandoraFMS 7.0NG.772 - SQL Injection


PandoraFMS NG747 7.0 - 'filename' Persistent Cross-Site Scripting


Park Ticketing Management System 1.0  - 'viewid' SQL Injection


Park Ticketing Management System 1.0  - Authentication Bypass


Park Ticketing Management System 1.0 - 'viewid' SQL Injection


part-db 0.5.11 - Remote Code Execution (RCE)


Patient Appointment Scheduler System 1.0 - Persistent Cross-Site Scripting


Patient Appointment Scheduler System 1.0 - Unauthenticated File Upload


PaulPrinting CMS - (Search Delivery) Cross Site Scripting


PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities


Payment Terminal 3.1 - 'Multiple' Cross-Site Scripting (XSS)


PDW File Browser 1.3 - 'new_filename' Cross-Site Scripting (XSS)


PDW File Browser 1.3 - Remote Code Execution


PEEL Shopping 9.3.0 - 'address' Stored Cross-Site Scripting


PEEL Shopping 9.3.0 - 'Comments' Persistent Cross-Site Scripting


PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection


Perch v3.2 - Persistent Cross Site Scripting (XSS)


Perch v3.2 - Remote Code Execution (RCE)


Perch v3.2 - Stored XSS


Persian VIP Download Script 1.0 - 'active' SQL Injection


Pet Shop Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)


pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)


pfSense 2.4.4-p3 - Cross-Site Request Forgery


pfSense v2.7.0 - OS Command Injection


Pharmacy Medical Store and Sale Point 1.0  - 'catid' SQL Injection


Pharmacy Point of Sale System 1.0 - 'Add New User' Cross-Site Request Forgery (CSRF)


Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi)


Pharmacy Point of Sale System 1.0 - SQLi Authentication BYpass


Pharmacy Store Management System 1.0 - 'id' SQL Injection


Pharmacy/Medical Store & Sale Point 1.0  - 'email' SQL Injection


Phone Shop Sales Managements System 1.0 - Arbitrary File Upload


Phone Shop Sales Managements System 1.0 - Authentication Bypass (SQLi)


Phone Shop Sales Managements System 1.0 - Insecure Direct Object Reference (IDOR)


Photo Share Website 1.0 - Persistent Cross-Site Scripting


PhotoShow 3.0 - Remote Code Execution


PHP 7.3.15-3 - 'PHP_SESSION_UPLOAD_PROGRESS' Session Data Injection


PHP 7.4 FFI - 'disable_functions' Bypass


PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution


PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows)


PHP CGI Module 8.3.4 - Remote Code Execution (RCE)


PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)


PHP Melody 3.0 - 'Multiple' Cross-Site Scripting (XSS)


PHP Melody 3.0 - 'vid' SQL Injection


PHP Melody 3.0 - Persistent Cross-Site Scripting (XSS)


PHP Restaurants 1.0 - SQLi (Unauthenticated)


PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting


PHP Shopping Cart 4.2 - Multiple-SQLi


PHP Timeclock 1.04 - 'Multiple' Cross Site Scripting (XSS)


PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection


PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)


php-fusion 9.03.50 - 'ctype' SQL Injection


PHP-Fusion 9.03.50 - 'Edit Profile' Arbitrary File Upload


PHP-Fusion 9.03.50 - 'panels.php' Remote Code Execution


php-fusion 9.03.50 - Persistent Cross-Site Scripting


PHP-Fusion 9.03.60 - PHP Object Injection


PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)


phpAbook 0.9i - SQL Injection


phpfm v1.7.9 - Authentication type juggling


phpFox < 4.8.13 - (redirect) PHP Object Injection Exploit


PHPFusion 9.03.50 - Persistent Cross-Site Scripting


PHPFusion 9.03.50 - Remote Code Execution


PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS)


PHPGurukul Hostel Management System 2.1 - Cross-site request forgery (CSRF) to Cross-site Scripting (XSS)


PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS


phpIPAM 1.4 - SQL-Injection


PHPIPAM 1.4.4 - SQLi (Authenticated)


phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated)


phpIPAM 1.5.1 - SQL Injection


phpIPAM 1.6 - Reflected Cross Site Scripting (XSS)


phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)


phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS)


PhpIX 2012 Professional - 'id' SQL Injection


PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting)


PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities


PHPJabbers Cleaning Business 1.0 - Reflected XSS


PHPJabbers Night Club Booking 1.0 - Reflected XSS


PHPJabbers Rental Property Booking 2.0 - Reflected XSS


PHPJabbers Service Booking Script 1.0 - Reflected XSS


PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS


PHPJabbers Simple CMS 5 - 'name' Persistent Cross-Site Scripting (XSS)


PHPJabbers Simple CMS 5.0 - SQL Injection


PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)


PHPJabbers Taxi Booking 2.0 - Reflected XSS


PHPJabbers Vacation Rental Script 4.0 - CSRF


PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution


PHPKB Multi-Language 9 - Authenticated Directory Traversal


PHPKB Multi-Language 9 - Authenticated Remote Code Execution


phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)


phpList 3.5.0 - Authentication Bypass


phpMyAdmin 4.8.1 - Remote Code Execution (RCE)


phpMyAdmin 5.0.0 - SQL Injection


phpMyChat Plus 1.98 - 'pmc_username' SQL Injection


phpMyFAQ  2.9.8 - Cross-Site Request Forgery (CSRF)


phpMyFaq 2.9.8 - Cross Site Request Forgery (CSRF)


phpMyFAQ 2.9.8 - Cross-Site Request Forgery(CSRF)


phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)


phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames


phpMyFAQ v3.1.12 - CSV Injection


PHProjekt PhpSimplyGest v1.3. - Stored Cross-Site Scripting (XSS)


Phpwcms 1.9.30 - Arbitrary File Upload


PhreeBooks 5.2.3 ERP - Remote Code Execution (2)


PhreeBooks ERP 5.2.5 - Remote Command Execution


pimCore v5.4.18-skeleton  - Sensitive Cookie with Improper SameSite Attribute


PimpMyLog v1.7.14 - Improper access control


Pinger 1.0 - Remote Code Execution


Pisay Online E-Learning System 1.0 - Remote Code Execution


Piwigo 11.3.0 - 'language' SQL


Piwigo 13.6.0 - SQL Injection


Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)


Piwigo 2.10.1 - Cross Site Scripting


Piwigo v13.7.0 - Stored Cross-Site Scripting (XSS) (Authenticated)


PixelStor 5000 K:4.0.1580-20150629 - Remote Code Execution


PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)


PlaySMS 1.4.3 - Template Injection / Remote Code Execution


Pluck 4.7.7-dev2 -  PHP Code Execution


Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)


Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)


Pluck v4.7.18 - Remote Code Execution (RCE)


pluck v4.7.18 - Stored Cross-Site Scripting (XSS)


PluckCMS 4.7.10 - Unrestricted File Upload


PMB 5.6 - 'chemin' Local File Disclosure


PMB 5.6 - 'logid' SQL Injection


PMB 7.4.6 - SQL Injection


Podcast Generator 3.1 - 'Long Description' Persistent Cross-Site Scripting (XSS)


PodcastGenerator 3.2.9 - Blind SSRF via XML Injection


PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS)


Point of Sale System 1.0 - Authentication Bypass


Point of Sale System 1.0 - Multiple Stored XSS


Point of Sales 1.0 - 'id' SQL Injection


Point of Sales 1.0 - 'username' SQL Injection


Police Crime Record Management Project 1.0 - Time Based SQLi


Police Crime Record Management System 1.0 - 'casedetails' SQL Injection


Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)


POLR URL 2.3.0 - Shortener Admin Takeover


PopojiCMS 2.0.1 - Remote Command Execution (RCE)


PopojiCMS Version 2.0.1 - Remote Command Execution


POS Codekop v2.0 - Authenticated Remote Code Execution (RCE)


Poultry Farm Management System v1.0 - Remote Code Execution (RCE)


Prestashop 1.7.6.4 - Cross-Site Request Forgery


PrestaShop 1.7.6.7 - 'location' Blind Sql Injection


Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection


Prestashop 8.0.4 - Cross-Site Scripting (XSS)


Prestashop 8.0.4 - CSV injection


Prestashop blockwishlist module 2.1.0 - SQLi


PrestaShop ProductComments 4.2.0 - 'id_products' Time Based Blind SQL Injection


PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory


Printable Staff ID Card Creator System 1.0 - 'email' SQL Injection


Prison Management System - SQL Injection Authentication Bypass


Prizm Content Connect v10.5.1030.8315 - XXE


Processwire CMS 2.4.0 - 'download' Local File Inclusion


Profiling System for Human Resource Management 1.0 - Remote Code Execution (Unauthenticated)


Projectsend r1295 - 'name' Stored XSS


projectSend r1605 - CSV injection


projectSend r1605 - Private file download


projectSend r1605 - Remote Code Exectution RCE


projectSend r1605 - Stored XSS


ProjeQtOr Project Management 9.1.4 - Remote Code Execution


ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE)


ProjeQtOr Project Management System v10.4.1 - Multiple XSS


Projeqtor v9.3.1 - Stored Cross Site Scripting (XSS)


Purchase Order Management System 1.0 - Remote File Upload


Purchase Order Management-1.0 - Local File Inclusion


Purei CMS 1.0 - SQL Injection


PyroCMS v3.0.1 - Stored XSS


PZ Frontend Manager WordPress Plugin 1.0.5 - Cross Site Request Forgery (CSRF)


qdPM 9.1 - 'cfg[app_app_name]' Persistent Cross-Site Scripting


qdPM 9.1 - Arbitrary File Upload


qdPM 9.1 - Remote Code Execution


qdPM 9.1 - Remote Code Execution (Authenticated)


qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2)


qdPM 9.2 - Cross-site Request Forgery (CSRF)


qdPM 9.2 - Password Exposure (Unauthenticated)


QNAP QTS and Photo Station 6.0.3 - Remote Command Execution


Queue Management System 4.0.0 - _Add User_ Stored XSS


Quick.CMS 6.7 - Cross Site Request Forgery (CSRF) to Cross Site Scripting (XSS) (Authenticated)


Quick.CMS 6.7 - Remote Code Execution (Authenticated)


Quick.CMS 6.7 - SQL Injection Login Bypass


QuickBox Pro 2.1.8 - Authenticated Remote Code Execution


QuickDate 1.3.2 - SQL Injection


Quicklancer v1.0 - SQL Injection


Rail Pass Management System 1.0 - Time-Based SQL Injection


RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)


RATES SYSTEM 1.0 - 'Multiple' SQL Injections


RATES SYSTEM 1.0 - Authentication Bypass


rConfig 3.9 - 'searchColumn' SQL Injection


rConfig 3.9.3 - Authenticated Remote Code Execution


rConfig 3.9.4 - 'search.crud.php' Remote Command Injection


rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution


rConfig 3.9.5 - Remote Code Execution (Unauthenticated)


rConfig 3.9.6 - 'path' Local File Inclusion (Authenticated)


rconfig 3.9.6 - Arbitrary File Upload


rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1)


rconfig 3.9.7 - Sql Injection (Authenticated)


rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution


Really Simple Security 9.1.1.1 - Authentication Bypass


REDCap 11.3.9 - Stored Cross Site Scripting


Regis Inventory And Monitoring System 1.0 - 'Item List' Persistent Cross-Site Scripting


RemoteClinic 2 - 'Multiple' Cross-Site Scripting (XSS)


RemoteClinic 2.0 - 'Multiple' Stored Cross-Site Scripting (XSS)


Reservit Hotel 2.1 - Stored Cross-Site Scripting (XSS)


Reside Property Management 3.0 - 'profile' SQL Injection


ResidenceCMS 2.10.1 - Stored Cross-Site Scripting (XSS)


Responsive E-Learning System 1.0 - 'id' Sql Injection


Responsive E-Learning System 1.0 - Stored Cross Site Scripting


Responsive E-Learning System 1.0 - Unrestricted File Upload to RCE


Responsive FileManager 9.13.4 - 'path' Path Traversal


Responsive FileManager 9.9.5 - Remote Code Execution (RCE)


Responsive Online Blog 1.0 - 'id' SQL Injection


Responsive Tourism Website 3.1 - Remote Code Execution (RCE) (Unauthenticated)


Restaurant Management System 1.0  - SQL Injection


Restaurant Reservation System 1.0 - 'date' SQL Injection (Authenticated)


Resumes Management and Job Application Website 1.0 - Authentication Bypass


Resumes Management and Job Application Website 1.0 - RCE (Unauthenticated)


Revenue Collection System v1.0 - Remote Code Execution (RCE)


revive-adserver v5.4.1 - Cross-Site Scripting (XSS)


RiteCMS 2.2.1 - Authenticated Remote Code Execution


RiteCMS 2.2.1 - Remote Code Execution (Authenticated)


RiteCMS 3.1.0 - Arbitrary File Deletion (Authenticated)


RiteCMS 3.1.0 - Arbitrary File Overwrite (Authenticated)


RiteCMS 3.1.0 - Remote Code Execution (RCE) (Authenticated)


Rocket LMS 1.1 - Persistent Cross Site Scripting (XSS)


Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS)


RockMongo 1.1.7 - Stored Cross-Site Scripting (XSS)


RosarioSIS 10.8.4 - CSV Injection


RosarioSIS 6.7.2 - Cross Site Scripting (XSS)


RosarioSIS 6.7.2 - Cross-Site Scripting (XSS)


RosarioSIS 7.6 - SQL Injection


Roundcube Webmail 1.2 - File Disclosure


Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)


Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)


Rukovoditel 2.6.1 - Cross-Site Request Forgery (Change password)


Rukovoditel 2.6.1 - RCE (1)


Rukovoditel 2.7.1 - Remote Code Execution (2) (Authenticated)


rukovoditel 3.2.1 - Cross-Site Scripting (XSS)


Rukovoditel 3.3.1 - CSV injection


Rukovoditel 3.3.1 - Remote Code Execution (RCE)


Rukovoditel 3.4.1 - Multiple Stored XSS


Rukovoditel Project Management CRM 2.5.2 - 'entities_id' SQL Injection


Rukovoditel Project Management CRM 2.5.2 - 'filters' SQL Injection


Rukovoditel Project Management CRM 2.5.2 - 'reports_id' SQL Injection


SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)


Sales and Inventory System for Grocery Store 1.0 - Multiple Stored XSS


Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS)


Sales Tracker Management System v1.0 - Multiple Vulnerabilities


SalonERP 3.0.1 - 'sql' SQL Injection (Authenticated)


sar2html 3.2.1 - 'plot' Remote Code Execution


Savsoft Quiz 5 - 'field_title' Stored Cross-Site Scripting


Savsoft Quiz 5 - 'Skype ID' Stored XSS


Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting


Savsoft Quiz 5 - Persistent Cross-Site Scripting


Savsoft Quiz 5 - Stored Cross-Site Scripting


Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting


Savsoft Quiz v6.0 Enterprise - Stored XSS


School ERP Pro 1.0 - 'es_messagesid' SQL Injection


School ERP Pro 1.0 - Arbitrary File Read


School ERP Pro 1.0 - Remote Code Execution


School ERP System 1.0 - Cross Site Request Forgery (Add Admin)


School Event Attendance Monitoring System 1.0 - 'Item Name' Stored Cross-Site Scripting


School Faculty Scheduling System 1.0 - 'id' SQL Injection


School Faculty Scheduling System 1.0 - 'username' SQL Injection


School Faculty Scheduling System 1.0 - Authentication Bypass POC


School Faculty Scheduling System 1.0 - Stored Cross Site Scripting POC


School File Management System 1.0 - 'multiple' Stored Cross-Site Scripting


School File Management System 1.0 - 'username' SQL Injection


School Log Management System 1.0 - 'username' SQL Injection / Remote Code Execution


Scriptcase 9.7 - Remote Code Execution (RCE)


SCRMS 2023-05-27 1.0 - Multiple SQL Injection


Seat Reservation System 1.0 - 'id' SQL Injection


Seat Reservation System 1.0 - Remote Code Execution (Unauthenticated)


Seat Reservation System 1.0 - Unauthenticated SQL Injection


Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated)


SeedDMS 5.1.18 - Persistent Cross-Site Scripting


Sellacious eCommerce 4.6 - Persistent Cross-Site Scripting


Senayan Library Management System v9.0.0 - SQL Injection


Senayan Library Management System v9.5.0 - SQL Injection


Sentrifugo 3.2 - 'assets' Remote Code Execution (Authenticated)


Sentrifugo 3.2 - File Upload Restriction Bypass (Authenticated)


Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting


Sentrifugo HRMS 3.2 - 'id' SQL Injection


Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)


SEO Panel 4.6.0 - Remote Code Execution (1)


SEO Panel 4.6.0 - Remote Code Execution (2)


Seo Panel 4.8.0 - 'category' Reflected XSS


Seo Panel 4.8.0 - 'from_time' Reflected XSS


SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (1)


SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (2)


Seo Panel 4.8.0 - 'search_name' Reflected XSS


Seotoaster 3.2.0 - Stored XSS on Edit page properties


Serendipity 2.4.0 - Cross-Site Scripting (XSS)


Serendipity 2.4.0 - File Inclusion RCE


Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated)


Serendipity 2.5.0 - Remote Code Execution (RCE)


Service Provider Management System v1.0 - SQL Injection


Shopping Portal ProVersion 3.0 - Authentication Bypass


ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting


Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)


Shuttle-Booking-Software v1.0 - Multiple-SQLi


Simple Attendance System 1.0 - Authenticated bypass


Simple Attendance System 1.0 - Unauthenticated Blind SQLi


Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal


Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting


Simple Chatbot Application 1.0 - 'message' Blind SQLi


Simple Chatbot Application 1.0 - Remote Code Execution (RCE)


Simple Client Management System 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)


Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)


Simple Client Management System 1.0 - Remote Code Execution (RCE)


Simple Client Management System 1.0 - SQLi (Authentication Bypass)


Simple College Website 1.0 - 'full' Stored Cross Site Scripting


Simple College Website 1.0 - 'name' Sql Injection (Authentication Bypass)


Simple College Website 1.0 - 'page' Local File Inclusion


Simple College Website 1.0 - 'username' SQL Injection / Remote Code Execution


Simple CRM 3.0 - 'Change user information' Cross-Site Request Forgery (CSRF)


Simple CRM 3.0 - 'email' SQL injection (Authentication Bypass)


Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS)


Simple Employee Records System 1.0 - File Upload RCE (Unauthenticated)


Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS)


Simple Food Website 1.0 - Authentication Bypass


Simple Grocery Store Sales And Inventory System 1.0 - Authentication Bypass


Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Simple Image Gallery System 1.0 - 'id' SQL Injection


Simple Issue Tracker System 1.0 - SQLi Authentication Bypass


Simple Library Management System 1.0 - 'rollno' SQL Injection


Simple Online College Entrance Exam System 1.0 - 'Multiple' SQL injection


Simple Online College Entrance Exam System 1.0 - Account Takeover


Simple Online College Entrance Exam System 1.0 - SQLi Authentication Bypass


Simple Online College Entrance Exam System 1.0 - Unauthenticated Admin Creation


Simple Online Food Ordering System 1.0 - 'id' SQL Injection (Unauthenticated)


Simple Payroll System 1.0 - SQLi Authentication Bypass


Simple Phone Book  1.0 - 'Username' SQL Injection (Unauthenticated)


Simple Public Chat Room 1.0 - 'msg' Stored Cross-Site Scripting


Simple Public Chat Room 1.0 - Authentication Bypass SQLi


Simple Real Estate Portal System 1.0 - 'id'  SQLi


Simple Student Information System 1.0 - SQL Injection (Authentication Bypass)


Simple Student Quarterly Result/Grade System 1.0 - SQLi Authentication Bypass


Simple Subscription Website 1.0 - SQLi Authentication Bypass


Simple Task List 1.0 - 'status' SQLi


Simple Task Managing System v1.0 - SQL Injection (Unauthenticated)


Simple Water Refilling Station Management System 1.0 - Authentication Bypass


Simple Water Refilling Station Management System 1.0 - Remote Code Execution (RCE) through File Upload


SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution


SimplePHPGal 0.7 - Remote File Inclusion


Simplephpscripts Simple CMS 2.1 - 'Multiple' SQL Injection


Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS)


Sistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery (Add Admin)


SiteMagic CMS 4.4.2 - Arbitrary File Upload (Authenticated)


SitemagicCMS 4.4.3 - Remote Code Execution (RCE)


SLIMSV 9.5.2 - Cross-Site Scripting (XSS)


Small CRM 2.0 - 'email' SQL Injection


Small CRM 2.0 - Authentication Bypass


Small CRM 3.0 - 'Authentication Bypass' SQL Injection


Small CRM 3.0 - 'description' Stored Cross-Site Scripting (XSS)


Smart Hospital 3.1 - _Add Patient_ Stored XSS


Smart Manager 8.27.0 - Post-Authenticated SQL Injection


Smart School 6.4.1 - SQL Injection


Smart School v1.0 - SQL Injection


SmartBlog 2.0.1 - 'id_post' Blind SQL injection


Social Networking Site - Authentication Bypass (SQli)


Social-Commerce 3.1.6 - Reflected XSS


Social-Share-Buttons v2.2.3 - SQL Injection


SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated)


SoftExpert (SE) Suite v2.1.3 - Local File Inclusion


soosyze 2.0.0 - File Upload


Sophos Web Appliance 4.3.10.4 - Pre-auth command injection


SOPlanning 1.45 - 'by' SQL Injection


SOPlanning 1.45 - 'users' SQL Injection


SOPlanning 1.45 - Cross-Site Request Forgery (Add User)


SOPlanning 1.52.01 (Simple Online Planning Tool) - Remote Code Execution (RCE) (Authenticated)


SPA-CART CMS - Stored XSS


SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS


SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection


SpamTitan 7.07 - Unauthenticated Remote Code Execution


Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)


spip v4.1.10 - Spoofing Admin account


SPIP v4.2.0 - Remote Code Execution (Unauthenticated)


Spitfire CMS 1.0.475 - PHP Object Injection


Stackposts Social Marketing Tool v1.0 - SQL Injection


Statamic 4.7.0 - File-Inclusion


Stock Management System 1.0 - 'Brand Name' Persistent Cross-Site Scripting


Stock Management System 1.0 - 'brandId and categoriesId' SQL Injection


Stock Management System 1.0 - 'Categories Name' Persistent Cross-Site Scripting


Stock Management System 1.0 - 'Product Name' Persistent Cross-Site Scripting


Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)


Stock Management System 1.0 - Authentication Bypass


Stock Management System 1.0 - Cross-Site Request Forgery (Change Username)


Stock Management System v1.0 - Unauthenticated SQL Injection


Storage Unit Rental Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Student Attendance Management System 1.0 - 'username' SQL Injection / Remote Code Execution


Student Enrollment 1.0 - Unauthenticated Remote Code Execution


Student Management System 1.0 - 'message' Persistent Cross-Site Scripting (Authenticated)


Student Management System 1.0 - SQLi Authentication Bypass


Student Quarterly Grading System 1.0 - 'grade' Stored Cross-Site Scripting (XSS)


Student Quarterly Grading System 1.0 - SQLi Authentication Bypass


Student Record System 1.0 - 'cid' SQLi (Authenticated)


Student Record System 4.0 - 'cid' SQL Injection


Student Result Management System 1.0 - 'class' SQL Injection


Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)


Submitty 20.04.01 - Persistent Cross-Site Scripting


Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin)


Subrion CMS 4.2.1 - 'avatar[path]' XSS


Subrion CMS 4.2.1 - Arbitrary File Upload


Subrion CMS 4.2.1 - Cross Site Request Forgery (CSRF) (Add Amin)


Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS)


SugarCRM 12.2.0 - Remote Code Execution (RCE)


SugarCRM 6.5.18 - Persistent Cross-Site Scripting


SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated)


SuiteCRM 7.11.18 - Remote Code Execution (RCE) (Authenticated) (Metasploit)


Super Socializer 7.13.52 - Reflected XSS


SuperStoreFinder - Multiple Vulnerabilities


Supply Chain Management System - Auth Bypass SQL Injection


Support Board 3.3.3 - 'Multiple' SQL Injection (Unauthenticated)


Support Board 3.3.4 - 'Message' Stored Cross-Site Scripting (XSS)


SymphonyCMS 3.0.0 - Persistent Cross-Site Scripting


Tailor Management System - 'id' SQL Injection


Tailor Management System 1.0 - Unrestricted File Upload to Remote Code Execution


Tailor MS 1.0 - Reflected Cross-Site Scripting


TAO Open Source Assessment Platform 3.3.0 RC02 - HTML Injection


Task Management System 1.0 - 'First Name and Last Name' Stored XSS


Task Management System 1.0 - 'id' SQL Injection


Task Management System 1.0 - 'page' Local File Inclusion


Task Management System 1.0 - Unrestricted File Upload to Remote Code Execution


taskhub 2.8.7 - SQL Injection


Taskhub CRM Tool 2.8.6 - SQL Injection


Tatsu 3.3.11 - Unauthenticated RCE


Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi


Teachers Record Management System 1.0 - 'email' Stored Cross-site Scripting (XSS)


Teachers Record Management System 1.0 - 'Multiple' SQL Injection (Authenticated)


Teachers Record Management System 1.0 - 'searchteacher' SQL Injection


Teachers Record Management System 1.0 - File Upload Type Validation


TeamCity Agent XML-RPC 10.0 - Remote Code Execution


TeamPass 3.0.0.21 - SQL Injection


Terramaster TOS 4.2.15 - Remote Code Execution (RCE) (Unauthenticated)


Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)


TestLink 1.19 - Arbitrary File Download (Unauthenticated)


TestLink 1.9.20 - Unrestricted File Upload (Authenticated)


Textpattern 4.8.3 - Remote code execution (Authenticated) (2)


Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated)


Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting


Textpattern CMS 4.6.2 - Cross-site Request Forgery


TextPattern CMS 4.8.3 - Remote Code Execution (Authenticated)


Textpattern CMS 4.8.4 - 'Comments' Persistent Cross-Site Scripting (XSS)


TextPattern CMS 4.8.7 - Remote Command Execution (Authenticated)


TextPattern CMS 4.8.7 - Remote Command Execution (RCE) (Authenticated)


TextPattern CMS 4.8.7 - Stored Cross-Site Scripting (XSS)


Textpattern CMS 4.9.0-dev - 'Excerpt' Persistent Cross-Site Scripting (XSS)


TextPattern CMS 4.9.0-dev - Remote Command Execution (RCE) (Authenticated)


Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)


The Shop v2.5 - SQL Injection


ThinkAdmin 6 -  Arbitrarily File Read


thrsrossi Millhouse-Project 1.414 - Remote Code Execution


Tiki Wiki CMS Groupware 21.1 - Authentication Bypass


Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS)


TimeClock Software 1.01 0 - (Authenticated) Time-Based SQL Injection


Tiny File Manager 2.4.6 - Remote Code Execution (RCE)


Tiny Tiny RSS - Remote Code Execution


TinyWebGallery v2.5 - Remote Code Execution (RCE)


TinyWebGallery v2.5 - Stored Cross-Site Scripting (XSS)


Total CMS 1.7.4 - Remote Code Execution (RCE)


Tourism Management System 1.0 - Arbitrary File Upload


Tourism Management System v2.0 - Arbitrary File Upload


Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection


TranzAxis 3.2.41.10.26 - Stored Cross-Site Scripting (XSS) (Authenticated)


Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)


Triconsole 3.75 - Reflected XSS


Trixbox 2.8.0.4 - 'lang' Path Traversal


Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)


Tryton 5.4 - Persistent Cross-Site Scripting


Typecho 1.3.0 - Race Condition


Typecho 1.3.0 - Stored Cross-Site Scripting (XSS)


TypeSetter 5.1 - CSRF (Change admin e-mail)


Typesetter CMS 5.1 - 'Site Title' Persistent Cross-Site Scripting


Typesetter CMS 5.1 - Arbitrary Code Execution (Authenticated)


TYPO3 11.5.24 - Path Traversal (Authenticated)


UADMIN Botnet 1.0 - 'link' SQL Injection


uBidAuction v2.0.1 - 'Multiple' Cross Site Scripting (XSS)


uDoctorAppointment v2.1.1 - 'Multiple' Cross Site Scripting (XSS)


UliCMS 2020.1 - Persistent Cross-Site Scripting


Ulicms 2023.1 - create admin user via mass assignment


Ulicms-2023.1 sniffing-vicuna - Remote Code Execution (RCE)


Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)


Ulicms-2023.1-sniffing-vicuna - Privilege escalation


Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)


Ultimate Project Manager CRM PRO Version 2.0.5 - SQLi (Authenticated)


Unified Office Total Connect Now 1.0 - 'data' SQL Injection


unilogies/bumsys v1.0.3 beta - Unrestricted File Upload


UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read


UPS Network Management Card 4 - Path Traversal


User Management System 1.0 - 'uid' SQL Injection


User Management System 2.0 - Authentication Bypass


User Management System 2.0 - Persistent Cross-Site Scripting


User Registration & Login and User Management System 2.1 - Cross Site Request Forgery


User Registration & Login and User Management System 2.1 - Login Bypass SQL Injection


User Registration & Login and User Management System 2.1 - SQL Injection


User Registration & Login and User Management System v3.0 - SQL Injection (Unauthenticated)


User Registration & Login and User Management System v3.0 - Stored Cross-Site Scripting (XSS)


User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS


Uvdesk 1.1.4 - Stored XSS (Authenticated)


Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)


Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS)


Vaidya-Mitra 1.0 - Multiple SQLi


Vanguard 2.1 - 'Search' Cross-Site Scripting (XSS)


Vanilla Forums 2.6.3 - Persistent Cross-Site Scripting


vBulletin 5.6.1 - 'nodeId' SQL Injection


vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution


vBulletin 5.6.3 - 'group' Cross Site Scripting


Vehicle Parking Management System 1.0 - 'catename' Persistent Cross-Site Scripting (XSS)


Vehicle Parking Management System 1.0 - Authentication Bypass


Vehicle Parking Tracker System 1.0 - 'Owner Name'  Stored Cross-Site Scripting


Vehicle Service Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)


VehicleWorkshop 1.0 - 'bookingid' SQL Injection


VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities


Victor CMS 1.0 - 'add_user' Persistent Cross-Site Scripting


Victor CMS 1.0 - 'cat_id' SQL Injection


Victor CMS 1.0 - 'comment_author' Persistent Cross-Site Scripting


Victor CMS 1.0 - 'post' SQL Injection


Victor CMS 1.0 - 'Search' SQL Injection


Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting


Victor CMS 1.0 - Authenticated Arbitrary File Upload


Victor CMS 1.0 - File Upload To RCE


Victor CMS 1.0 - Multiple SQL Injection (Authenticated)


Virtual Airlines Manager 2.6.2 - 'airport' SQL Injection


Virtual Airlines Manager 2.6.2 - 'id' SQL Injection


Virtual Airlines Manager 2.6.2 - 'multiple' SQL Injection


Virtual Airlines Manager 2.6.2 - 'notam' SQL Injection


Virtual Airlines Manager 2.6.2 - Persistent Cross-Site Scripting


Virtual Freer 1.58 - Remote Command Execution


Visitor Management System in PHP 1.0 - Persistent Cross-Site Scripting


Visitor Management System in PHP 1.0 - SQL Injection (Authenticated)


Voting System 1.0 - Authentication Bypass (SQLI)


Voting System 1.0 - File Upload RCE (Authenticated Remote Code Execution)


Voting System 1.0 - Remote Code Execution (Unauthenticated)


Voting System 1.0 - Time based SQLI  (Unauthenticated SQL injection)


Voyager 1.3.0 - Directory Traversal


VTiger v7.0 CRM - 'To' Persistent XSS


Wallos < 1.11.2 - File Upload RCE


Warehouse Inventory System 1.0 - Cross-Site Request Forgery (Change Admin Password)


Water Billing System 1.0 - 'id' SQL Injection (Authenticated)


Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection


WBCE 1.6.0 - Unauthenticated SQL injection


WBCE CMS 1.5.1 - Admin Password Reset


WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)


WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS)


WBCE CMS 1.6.1 - Open Redirect & CSRF


WBCE CMS v1.6.2 - Remote Code Execution (RCE)


WBCE CMS Version 1.6.1 - Remote Command Execution (Authenticated)


WBiz Desk 1.2 - SQL Injection


Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass


Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated)


Web Based Quiz System 1.0 - 'MCQ options' Persistent Cross-Site Scripting


Web Based Quiz System 1.0 - 'name' Persistent Cross-Site Scripting


Webedition CMS v2.9.8.8 - Blind SSRF


Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)


Webedition CMS v2.9.8.8 - Stored XSS


webERP 4.15.1 - Unauthenticated Backup File Access


Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) & Remote Command Execution (RCE)


WebHMI 4.0 - Remote Code Execution (RCE) (Authenticated)


WebHMI 4.1 - Stored Cross Site Scripting (XSS) (Authenticated)


WebHMI 4.1.1 - Remote Code Execution (RCE) (Authenticated)


WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS)


WEBIGniter v28.7.23 - Stored XSS


WEBIGniter v28.7.23 File Upload - Remote Code Execution


Webile v1.0.1 - Multiple Cross Site Scripting


Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)


WebPort 1.19.1 - 'setup' Reflected Cross-Site Scripting


WebsiteBaker 2.12.2 - 'display_name' SQL Injection (authenticated)


WebsiteBaker 2.12.2 - Remote Code Execution


WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)


WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)


WebsiteBaker v2.13.3 - Directory Traversal


WebsiteBaker v2.13.3 - Stored XSS


Websvn 2.6.0 - Remote Code Execution (Unauthenticated)


Webtareas 2.0 - 'id' SQL Injection


webTareas 2.0.p8 - Arbitrary File Deletion


Webtareas 2.1p - Arbitrary File Upload (Authenticated)


WebTareas 2.4 - Blind SQLi (Authenticated)


WebTareas 2.4 - RCE (Authorized)


WebTareas 2.4 - Reflected XSS (Unauthorised)


WebTareas 2.4 - SQL Injection (Unauthorised)


Webtateas 2.0 - Arbitrary File Read


Webutler v3.2 - Remote Code Execution (RCE)


WeGIA 3.5.0 - SQL Injection


Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection


Wing FTP Server - Authenticated CSRF (Delete Admin)


Winter CMS 1.2.3 - Server-Side Template Injection (SSTI) (Authenticated)


WinterCMS < 1.2.3 - Persistent Cross-Site Scripting


Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)


WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting


WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting


WonderCMS 3.1.3 - 'page' Persistent Cross-Site Scripting


WonderCMS 3.1.3 - 'uploadFile' Stored Cross-Site Scripting


WonderCMS 3.1.3 - Authenticated Remote Code Execution


WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution


WooCommerce v7.1.0 - Remote Code Execution(RCE)


Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2)


WordPress 5.0.0 - Image Remote Code Execution


WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)


WordPress adivaha Travel Plugin 2.3 - Reflected XSS


WordPress adivaha Travel Plugin 2.3 - SQL Injection


Wordpress Augmented-Reality - Remote Code Execution Unauthenticated


Wordpress Core 5.2.2 - 'post previews' XSS


WordPress Core 5.8.2 - 'WP_Query' SQL Injection


WordPress Core 6.2 - Directory Traversal


Wordpress Epsilon Framework Multiple Themes - Unauthenticated Function Injection


WordPress File Upload Plugin < 4.23.3 - Stored XSS


Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)


Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)


Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload


Wordpress Plugin 404 to 301 2.0.2 - SQL-Injection (Authenticated)


WordPress Plugin AAWP 3.16 - 'tab' Reflected Cross Site Scripting (XSS) (Authenticated)


WordPress Plugin AccessPress Social Icons 1.8.2 - 'icon title' Stored Cross-Site Scripting (XSS)


WordPress Plugin Admin Bar & Dashboard Access Control Version: 1.2.8 - _Dashboard Redirect_ field Stored Cross-Site Scripting (XSS)


WordPress Plugin admin-word-count-column 2.2 - Local File Read


WordPress Plugin Adning Advertising 1.5.5 - Arbitrary File Upload


WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting (XSS)


WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)


WordPress Plugin Ajax Load More 5.3.1 - '#1' Authenticated SQL Injection


Wordpress Plugin Alemha Watermarker 1.3.1 - Stored Cross-Site Scripting (XSS)


WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)


WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated


WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal


WordPress Plugin AN_Gradebook 5.0.1 - SQLi


WordPress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection


Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)


WordPress Plugin Autoptimize 2.7.6 - Authenticated Arbitrary File Upload (Metasploit)


Wordpress Plugin Background Image Cropper v1.2 - Remote Code Execution


WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion


Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution (Authenticated)


WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup


WordPress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation


WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)


WordPress Plugin Buddypress 6.2.0 - Persistent Cross-Site Scripting


Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure


WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion


Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)


Wordpress Plugin Catch Themes Demo Import 1.6.1 - Remote Code Execution (RCE) (Authenticated)


WordPress Plugin ChopSlider 3.4 - 'id' SQL Injection


WordPress Plugin Contact Form 1.7.14 - Reflected Cross-Site Scripting (XSS)


WordPress Plugin Contact Form Builder 1.6.1 - Cross-Site Scripting (XSS)


WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control


WordPress Plugin Contact Form Entries 1.1.6 - Cross Site Scripting (XSS) (Unauthenticated)


WordPress Plugin Contact Form to Email 1.3.24 - Stored Cross Site Scripting (XSS) (Authenticated)


WordPress Plugin contact-form-7 5.1.6 - Remote File Upload


WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)


WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS)


WordPress Plugin Current Book 1.0.1 - 'Book Title' Persistent Cross-Site Scripting


WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF)


WordPress Plugin Custom Global Variables 1.0.5 - 'name' Stored Cross-Site Scripting (XSS)


WordPress Plugin Custom Searchable Data System - Unauthenticated Data M]odification


WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF


WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal


WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated)


Wordpress Plugin Download From Files 1.48 - Arbitrary File Upload


Wordpress Plugin Download Monitor WordPress V 4.4.4 - SQL Injection (Authenticated)


WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution


WordPress Plugin Duplicate Page 4.4.1 - Stored Cross-Site Scripting (XSS)


Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read


Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read (Metasploit)


WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download


WordPress Plugin Duplicator 1.4.7 - Information Disclosure


WordPress Plugin Duplicator < 1.5.7.1 - Unauthenticated Sensitive Data Exposure to Account Takeover


WordPress Plugin DZS Zoomsounds 6.45 - Arbitrary File Read (Unauthenticated)


WordPress Plugin dzs-zoomsounds 6.60 - Remote Code Execution (RCE) (Unauthenticated)


WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting (XSS)


WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS


Wordpress Plugin Elementor 3.5.5 - Iframe Injection


WordPress Plugin Elementor 3.6.2 - Remote Code Execution (RCE) (Authenticated)


WordPress Plugin Email Subscribers & Newsletters 4.2.2 - 'hash' SQL Injection (Unauthenticated)


WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download


WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)


Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting


Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access


Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR