Exploits

Webmatic 3.1.1 – Blind SQL Injection

Advisory ID: HTB23096

WordPress Plugin SocialFit – ‘msg’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54320/info

WordPress Plugin church_admin – ‘id’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54329/info

WordPress Plugin Knews Multilingual Newsletters – Cross-Site Scripting

source: https://www.securityfocus.com/bid/54330/info

sflog! – ‘section’ Local File Inclusion

source: https://www.securityfocus.com/bid/54334/info

Apache Sling – Denial of Service

source: https://www.securityfocus.com/bid/54341/info

IBM Rational ClearQuest CQOle – Remote Code Execution (Metasploit)

##

Guestbook Scripts PHP 1.5 – Multiple Vulnerabilities

Title:

Freeside SelfService CGI/API 2.3.3 – Multiple Vulnerabilities

Title:

CLscript CMS 3.0 – Multiple Vulnerabilities

Title:

Linux Kernel 3.2.24 – ‘fs/eventpoll.c’ Local Denial of Service

The Linux Kernel is prone to a local denial-of-service vulnerability.

Solar FTP Server – Denial of Service

source: https://www.securityfocus.com/bid/54306/info

WordPress Plugin PHPFreeChat – ‘url’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54332/info

WordPress Plugin MoodThingy Widget 0.8.7 – Blind SQL Injection

# Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection

Tiki Wiki CMS Groupware 8.3 – ‘Unserialize()’ PHP Code Execution

Webify Link Directory – SQL Injection

# Exploit Title: Webify Link Directory / SQL Injection

.NET Framework – Tilde Character Denial of Service

Paper: http://www.exploit-db.com/docs/19527.pdf

Classified Ads Script PHP – ‘admin.php’ Multiple SQL Injections

source: https://www.securityfocus.com/bid/54299/info

gpEasy CMS Minishop 1.5 Plugin – Persistent Cross-Site Scripting

# Exploit Title: gp easy CMS Minishop 1.5 plugin persistent XSS

CLscript Classified Script 3.0 – SQL Injection

# Exploit Title: CLscript - Classified Script 3.0 / SQL Injection

phpMyBackupPro 2.2 – Local File Inclusion

:::::::-. ... ::::::. :::.

Photodex ProShow Producer 5.0.3256 – Buffer Overflow

Inshell Security Advisory

PHP MBB – Cross-Site Scripting / SQL Injection

source: https://www.securityfocus.com/bid/54271/info

gnome-terminal (vte) VteTerminal – Escape Sequence Parsing Remote Denial of Service

source: https://www.securityfocus.com/bid/54281/info

plow – ‘.plowrc’ File Buffer Overflow

source: https://www.securityfocus.com/bid/54290/info

WordPress Plugin custom tables – ‘key’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54326/info

python-wrapper – Untrusted Search Path/Code Execution

# python-wrapper untrusted search path/code execution vulnerability

WordPress Plugin Backup 2.0.1 – Information Disclosure

# Exploit Title: WordPress Backup plugin exposes site data

Microsoft IIS – Short File/Folder Name Disclosure

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19525.zip

WANGKONGBAO CNS-1000 UTM IPS-FW – Directory Traversal (Metasploit)

# Exploit Title: WANGKONGBAO CNS-1000 and 1100 Network Security Platform UTM Directory Traversal

Zoom Player – ‘.avi’ Divide-by-Zero Denial of Service

source: https://www.securityfocus.com/bid/54249/info

Getsimple CMS Items Manager Plugin – ‘PHP.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/54255/info

HP Data Protector – Create New Folder Buffer Overflow (Metasploit)

##

IrfanView JPEG2000 4.3.2.0 – jp2 Stack Buffer Overflow (Metasploit)

##

Emesene 2.12.5 – Password Disclosure

# Exploit Title: Emesene Password Disclosure

BSD – ‘TelnetD’ Remote Command Execution (2)

This exploit was leaked on the Full Disclosure mailing list:

WordPress Plugin Paid Business Listings 1.0.2 – Blind SQL Injection

# Exploit Title: WordPress Paid Business Listings v1.0.2 Blind SQL Injection

GIMP 2.8.0 – ‘.FIT’ File Format Denial of Service

Summary

IrfanView JLS Formats PlugIn – Heap Overflow

Summary

phpmoneybooks 1.03 – Persistent Cross-Site Scripting

# Exploit Title: phpmoneybooks 1.03 Stored XSS

PC Tools Firewall Plus 7.0.0.123 – Local Denial of Service

Exploit Title: PC Tools Firewall Plus Local DoS

specview 2.5 build 853 – Directory Traversal

#######################################################################

PowerNet Twin Client 8.9 – ‘RFSync 1.0.0.1’ Crash (PoC)

#######################################################################

JAKCMS PRO 2.2.6 – ‘uploader.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/54238/info

LIOOSYS CMS – SQL Injection / Information Disclosure

source: https://www.securityfocus.com/bid/54239/info

SWFupload – ‘movieName’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54245/info

webERP 4.08.1 – Local/Remote File Inclusion

:::::::-. ... ::::::. :::.

Apple QuickTime – TeXML Stack Buffer Overflow (Metasploit)

##

Openfire Server 3.6.0a – Admin Console Authentication Bypass (Metasploit)

##

VideoLAN VLC Media Player 2.0.1 – ‘.avi’ File Denial of Service

source: https://www.securityfocus.com/bid/54208/info