Exploits

BSA Radar 1.6.7234.24750 – Cross-Site Request Forgery (Change Password)

# Exploit title: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)

Sickbeard 0.1 – Remote Command Injection

# Exploit Title: Sickbeard 0.1 - Remote Command Injection

Online Shopping Portal 3.1 – ’email’ SQL Injection

# Exploit Title: Online Shopping Portal 3.1 - 'email' SQL Injection

Joomla! J2 JOBS 1.3.0 – ‘sortby’ Authenticated SQL Injection

# Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection

BSA Radar 1.6.7234.24750 – Authenticated Privilege Escalation

# Exploit Title: BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation

Microsoft Windows mshta.exe 2019 – XML External Entity Injection

# Exploit Title: Microsoft Windows mshta.exe 2019 - XML External Entity Injection

Exhibitor Web UI 1.7.1 – Remote Code Execution

# Exploit Title: Exhibitor Web UI 1.7.1 - Remote Code Execution

PHP 7.4 FFI – ‘disable_functions’ Bypass

File Management System 1.1 – Persistent Cross-Site Scripting

# Exploit Title: File Management System 1.1 - Persistent Cross-Site Scripting

RiteCMS 2.2.1 – Authenticated Remote Code Execution

# Exploit Title: RiteCMS 2.2.1 - Authenticated Remote Code Execution

Fire Web Server 0.1 – Remote Denial of Service (PoC)

# Exploit Title: Fire Web Server 0.1 - Remote Denial of Service (PoC)

Grafana 7.0.1 – Denial of Service (PoC)

# Exploit Title: Grafana 7.0.1 - Denial of Service (PoC)

RSA IG&L Aveksa 7.1.1 – Remote Code Execution

# Exploit Title: RSA IG&L Aveksa 7.1.1 - Remote Code Execution

Nagios XI 5.6.12 – ‘export-rrd.php’ Remote Code Execution

# Exploit Title: Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution

BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution

#!/bin/bash

BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution (PoC)

## RCE:

ZenTao Pro 8.8.2 – Command Injection

# Exploit Title: ZenTao Pro 8.8.2 - Command Injection

OCS Inventory NG 2.7 – Remote Code Execution

# Exploit Title: OCS Inventory NG 2.7 - Remote Code Execution

RM Downloader 2.50.60 2006.06.23 – ‘Load’ Local Buffer Overflow (EggHunter) (SEH) (PoC)

# Exploit Title: RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (EggHunter) (SEH) (PoC)

e-learning Php Script 0.1.0 – ‘search’ SQL Injection

# Exploit Title: e-learning Php Script 0.1.0 - 'search' SQL Injection

PHP-Fusion 9.03.60 – PHP Object Injection

# Exploit Title: PHP-Fusion 9.03.60 - PHP Object Injection

Online Shopping Portal 3.1 – Authentication Bypass

# Exploit Title: Online Shopping Portal 3.1 - Authentication Bypass

Victor CMS 1.0 – ‘user_firstname’ Persistent Cross-Site Scripting

# Exploit Title: Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting

Reside Property Management 3.0 – ‘profile’ SQL Injection

# Exploit Title: Reside Property Management 3.0 - 'profile' SQL Injection

OpenEMR 5.0.1 – ‘controller’ Remote Code Execution

# Exploit Title: OpenEMR 5.0.1 - 'controller' Remote Code Execution

Windscribe 1.83 – ‘WindscribeService’ Unquoted Service Path

# Exploit Title: Windscribe 1.83 - 'WindscribeService' Unquoted Service Path

KiteService 1.2020.618.0 – Unquoted Service Path

# Exploit Title: KiteService 1.2020.618.0 - Unquoted Service Path

mySCADA myPRO 7 – Hardcoded Credentials

# Exploit Title: mySCADA myPRO v7 Hardcoded Credentials

FHEM 6.0 – Local File Inclusion

# Exploit Title: FHEM 6.0 - Local File Inclusion

BSA Radar 1.6.7234.24750 – Persistent Cross-Site Scripting

# Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting

Responsive Online Blog 1.0 – ‘id’ SQL Injection

# Exploit Title: Responsive Online Blog 1.0 - 'id' SQL Injection

Online Student Enrollment System 1.0 – Cross-Site Request Forgery (Add Student)

# Exploit Title: Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)

Code Blocks 20.03 – Denial Of Service (PoC)

# Exploit Title: Code Blocks 20.03 - Denial Of Service (PoC)

Lansweeper 7.2 – Incorrect Access Control

# Exploit Title: Lansweeper 7.2 - Incorrect Access Control

FileRun 2019.05.21 – Reflected Cross-Site Scripting

# Exploit Title: FileRun 2019.05.21 - Reflected Cross-Site Scripting

Student Enrollment 1.0 – Unauthenticated Remote Code Execution

# Exploit Title: Student Enrollment 1.0 - Unauthenticated Remote Code Execution

Odoo 12.0 – Local File Inclusion

# Exploit Title: Odoo 12.0 - Local File Inclusion

Online Student Enrollment System 1.0 – Unauthenticated Arbitrary File Upload

# Exploit Title: Online Student Enrollment System 1.0 - Unauthenticated Arbitrary File Upload

WebPort 1.19.1 – Reflected Cross-Site Scripting

# Exploit Title: WebPort 1.19.1 - Reflected Cross-Site Scripting

WebPort 1.19.1 – ‘setup’ Reflected Cross-Site Scripting

# Exploit Title: WebPort 1.19.1 - 'setup' Reflected Cross-Site Scripting

Frigate 2.02 – Denial Of Service (PoC)

# Exploit Title: Frigate 2.02 - Denial Of Service (PoC)

Eaton Intelligent Power Manager 1.6 – Directory Traversal

# Exploit Title: Eaton Intelligent Power Manager 1.6 - Directory Traversal

Beauty Parlour Management System 1.0 – Authentication Bypass

# Exploit Title: Beauty Parlour Management System 1.0 - Authentication Bypass

College-Management-System-Php 1.0 – Authentication Bypass

# Exploit Title: College-Management-System-Php 1.0 - Authentication Bypass / SQL Injection

Code Blocks 17.12 – ‘File Name’ Local Buffer Overflow (Unicode) (SEH) (PoC)

# Exploit Title: Code Blocks 17.12 - 'File Name' Local Buffer Overflow (Unicode) (SEH) (PoC)

OpenCTI 3.3.1 – Directory Traversal

# Exploit Title: OpenCTI 3.3.1 - Directory Traversal

Gila CMS 1.11.8 – ‘query’ SQL Injection

# Exploit Title: Gila CMS 1.11.8 - 'query' SQL Injection

Bandwidth Monitor 3.9 – ‘Svc10StrikeBandMontitor’ Unquoted Service Path

# Exploit Title: Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path

SOS JobScheduler 1.13.3 – Stored Password Decryption

# Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption

Netgear R7000 Router – Remote Code Execution

# EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48588.zip