Exploits

Seagate Personal Cloud SRN21C 4.3.16.0 / 4.3.18.0 – SQL Injection

------------------------------------------------------------------------

Responsive FileManager < 9.13.4 - Directory Traversal

The following vulnerabilities were fixed in the version 9.13.4.

Electron WebPreferences – Remote Code Execution

CVE-2018-15685 - Electron WebPreferences Remote Code Execution

HP Jetdirect – Path Traversal Arbitrary Code Execution (Metasploit)

##

WordPress Plugin Plainview Activity Monitor 20161228 – (Authenticated) Command Injection

WordPress Plugin Gift Voucher 1.0.5 – (Authenticated) ‘template_id’ SQL Injection

# Exploit Title: WordPress Plugin Gift Voucher 1.0.5 - 'template_id' SQL Injection

ManageEngine ADManager Plus 6.5.7 – Cross-Site Scripting

# Exploit Title: ManageEngine ADManager Plus 6.5.7 - Cross-Site Scripting

Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)

#!/usr/bin/env python3

UltimatePOS 2.5 – Remote Code Execution

# Exploit Title: UltimatePOS 2.5 - Remote Code Execution

ManageEngine ADManager Plus 6.5.7 – HTML Injection

# Exploit Title: ManageEngine ADManager Plus 6.5.7 - HTML Injection

Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)

#!/usr/bin/python

SkypeApp 12.8.487.0 – ‘Cuenta de Skype o Microsoft’ Denial of Service (PoC)

# Exploit Title: SkypeApp 12.8.487.0 - 'Cuenta de Skype o Microsoft' Denial of Service (PoC)

Vox TG790 ADSL Router – Cross-Site Request Forgery (Add Admin)

# Title: Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)

CuteFTP 8.3.1 – Denial of Service (PoC)

# Exploit Title : CuteFTP 8.3.1 - Denial Of Service (PoC)

Twitter-Clone 1 – ‘code’ SQL Injection

# Exploit Title: Twitter-Clone 1 - 'code' SQL Injection

PCViewer vt1000 – Directory Traversal

# Exploit Title: PCViewer vt1000 - Directory Traversal

Epiphany Web Browser 3.28.1 – Denial of Service (PoC)

# Exploit Title: Epiphany Web Browser 3.28.1 - Denial of Service (PoC)

StyleWriter 4 1.0 – Denial of Service (PoC)

# Exploit Title: StyleWriter 4 1.0 - Denial of Service (PoC)

Project64 2.3.2 – Buffer Overflow (SEH)

# Exploit Title: Project64 2.3.2 - Local BufferOverflow (SEH)

ZyXEL VMG3312-B10B – Cross-Site Scripting

# Exploit Title: ZyXEL VMG3312-B10B - Cross-Site Scripting

KingMedia 4.1 – File Upload

# Exploit Title: KingMedia 4.1 - Remote Code Execution

Textpad 7.6.4 – Denial Of Service (PoC)

# Exploit Title: Textpad 7.6.4 - Denial Of Service (PoC)

UltraISO 9.7.1.3519 – Denial Of Service (PoC)

# Exploit Title : UltraISO 9.7.1.3519 - Denial Of Service (PoC)

Geutebrueck re_porter 7.8.974.20 – Credential Disclosure

# Exploit Title: Geutebrueck re_porter 7.8.974.20 - Credential Disclosure

Easyboot 6.6.0 – Denial Of Service (PoC)

# Exploit Title: Easyboot 6.6.0 - Denial Of Service (PoC)

Geutebrueck re_porter 16 – Cross-Site Scripting

# Exploit Title: Geutebrueck re_porter 16 - Cross-Site Scripting

Ghostscript – Multiple Vulnerabilities

http://seclists.org/oss-sec/2018/q3/142

Microsoft Windows 10 – Diagnostics Hub Standard Collector Service Privilege Escalation

SystemCollector

Softdisk 3.0.3 – Denial Of Service (PoC)

# Exploit Title: Softdisk 3.0.3 - Denial Of Service (PoC)

Project64 2.3.2 – Denial Of Service (PoC)

# Exploit Title: Project64 2.3.2 - Denial Of Service (PoC).

Twitter-Clone 1 – ‘userid’ SQL Injection

# Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection

Hikvision IP Camera 5.4.0 – User Enumeration (Metasploit)

# Exploit title: Hikvision IP Camera 5.4.0 - User Enumeration (Metasploit)

Twitter-Clone 1 – Cross-Site Request Forgery (Delete Post)

# Exploit Title: Twitter-Clone 1 - Cross-Site Request Forgery (Delete Post)

OpenSSH 2.3 < 7.7 - Username Enumeration

# Exploit: OpenSSH 7.7 - Username Enumeration

WordPress Plugin Ninja Forms 3.3.13 – CSV Injection

# Exploit Title: Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection

SEIG Modbus 3.4 – Denial of Service (PoC)

# Title: SEIG Modbus 3.4 - Denial of Service (PoC)

SEIG Modbus 3.4 – Remote Code Execution

# Title: SEIG Modbus 3.4 - Remote Code Execution

WordPress Plugin Chained Quiz 1.0.8 – ‘answer’ SQL Injection

# Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection

Zortam MP3 Media Studio 23.95 – Denial of Service (PoC)

# Exploit Title: Zortam MP3 Media Studio 23.95 - Denial of Service (PoC)

Restorator 1793 – Denial of Service (PoC)

# Exploit Title: Restorator 1793 - Denial of Service (PoC)

MyBB Moderator Log Notes Plugin 1.1 – Cross-Site Request Forgery

# Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery

WordPress Plugin Tagregator 0.6 – Cross-Site Scripting

# Exploit Title: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting

Prime95 29.4b7 – Denial Of Service (PoC)

# Exploit Title: Prime95 29.4b7 - Denial Of Service (PoC)

Easylogin Pro 1.3.0 – ‘Encryptor.php’ Unserialize Remote Code Execution

#!/usr/bin/php

Countly – Cross-Site Scripting

############################################################################

SEIG SCADA System 9 – Remote Code Execution

# Title: SEIG SCADA SYSTEM 9 - Remote Code Execution

Mikrotik WinBox 6.42 – Credential Disclosure (golang)

# Title: Mikrotik WinBox 6.42 - Credential Disclosure ( golang edition )

CEWE Photoshow 6.3.4 – Denial of Service (PoC)

# Exploit Title: CEWE Photoshow 6.3.4 - Denial of Service (PoC)

ADM 3.1.2RHG1 – Remote Code Execution

# Title: Asustor ADM 3.1.2RHG1 - Remote Code Execution

Microsoft Edge Chakra JIT – ImplicitCallFlags Check Bypass with Intl

If the Intl object hasn't been initialized, access to any property of it will trigger the initialization process whic...