ZCBS/ZBBS/ZPBS v4.14k – Reflected Cross-Site Scripting (XSS)
# Exploit Title: ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)
cgi
cgi 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Mitel MiCollab AWV 8.1.2.4 and 9.1.3 – Directory Traversal and LFI
# Exploit Title: Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI
LISTSERV 17 – Insecure Direct Object Reference (IDOR)
# Exploit Title: LISTSERV 17 - Insecure Direct Object Reference (IDOR)
LISTSERV 17 – Reflected Cross Site Scripting (XSS)
# Exploit Title: LISTSERV 17 - Reflected Cross Site Scripting (XSS)
Movable Type 7 r.5002 – XMLRPC API OS Command Injection (Metasploit)
class MetasploitModule < Msf::Exploit::Remote
IPCop 2.1.9 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: IPCop 2.1.9 - Remote Code Execution (RCE) (Authenticated)
Aruba Instant (IAP) – Remote Code Execution
import socket
CHIYU TCP/IP Converter devices – CRLF injection
# Exploit Title: CHIYU TCP/IP Converter devices - CRLF injection
CHIYU IoT devices – ‘Multiple’ Cross-Site Scripting (XSS)
# Exploit Title: CHIYU IoT devices - 'Multiple' Cross-Site Scripting (XSS)
IPFire 2.25 – Remote Code Execution (Authenticated)
# Exploit Title: IPFire 2.25 - Remote Code Execution (Authenticated)
Gemtek WVRTM-127ACN 01.01.02.141 – Authenticated Arbitrary Command Injection
# Exploit Title: Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection
Mailman 1.x > 2.1.23 – Cross Site Scripting (XSS)
# Title: Mailman 1.x > 2.1.23 - Cross Site Scripting (XSS)
Zen Load Balancer 3.10.1 – ‘index.cgi’ Directory Traversal
# Exploit Title: Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal
Zen Load Balancer 3.10.1 – Remote Code Execution
# Exploit Title: Zen Load Balancer 3.10.1 - Remote Code Execution
CHIYU BF430 TCP IP Converter – Stored Cross-Site Scripting
# Exploit Title: CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting
Citrix SD-WAN Appliance 10.2.2 – Authentication Bypass / Remote Command Execution
# Exploit Title: Citrix SD-WAN Appliance 10.2.2 Auth Bypass and Remote Command Execution
Master IP CAM 01 3.3.4.2103 – Remote Command Execution
# Exploit Title: Master IP CAM 01 Remote Command Execution
IPFire 2.21 – Cross-Site Scripting
#####################################################################################################################...
Smoothwall Express 3.1-SP4 – Cross-Site Scripting
#####################################################################################################################...
SirsiDynix e-Library 3.5.x – Cross-Site Scripting
# Exploit Title: SirsiDynix e-Library
AudioCode 400HD – Command Injection
# [CVE-2018-10093] Remote command injection vulnerability in AudioCode IP phones
PLC Wireless Router GPN2.4P21-C-CN – Cross-Site Scripting
# Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Reflected XSS
Synaccess netBooter NP-02x/NP-08x 6.8 – Authentication Bypass
Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass
ASUSTOR ADM 3.1.0.RFQ3 – Remote Command Execution / SQL Injection
Product - ASUSTOR ADM - 3.1.0.RFQ3 and all previous builds
cgit < 1.2.1 - 'cgit_clone_objects()' Directory Traversal
There is a directory traversal vulnerability in cgit_clone_objects(), reachable when the configuration flag enable-ht...
Homematic CCU2 2.29.23 – Remote Command Execution
#!/usr/bin/ruby
Homematic CCU2 2.29.23 – Arbitrary File Write
#!/usr/bin/ruby
Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration
# Exploit Title: Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration
ITGuard-Manager 0.0.0.1 – Remote Code Execution
# Vulnerability Title: ITGuard-Manager V0.0.0.1 PreAuth Remote Code Execution
Meinberg LANTIME Web Configuration Utility 6.16.008 – Arbitrary File Read
Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read
LaCie 5big Network 2.2.8 – Command Injection
#!/usr/bin/python
Linksys E Series – Multiple Vulnerabilities
SEC Consult Vulnerability Lab Security Advisory < 20171018-1 >
Webmin 1.850 – Multiple Vulnerabilities
[+] SSD Beyond Security: https://blogs.securiteam.com/index.php/archives/3430
Citrix CloudBridge – ‘CAKEPHP’ Cookie Command Injection
POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1
Netscaler SD-WAN 9.1.2.26.561201 – Command Injection (Metasploit)
# Exploit Title: Citix SD-WAN logout cookie preauth Remote Command Injection Vulnerablity
Sonicwall < 8.1.0.2-14sv - 'sitecustomization.cgi' Command Injection (Metasploit)
# Exploit Title: Sonicwall importlogo/sitecustomization CGI Remote Command Injection Vulnerablity
Sonicwall < 8.1.0.6-21sv - 'gencsr.cgi' Command Injection (Metasploit)
# Exploit Title: Sonicwall gencsr CGI Remote Command Injection Vulnerablity
Sonicwall Secure Remote Access 8.1.0.2-14sv – Command Injection
Sonicwall Secure Remote Access (SRA) - Command Injection Vulnerabilities
Peplink Balance Routers 7.0.0-build1904 – SQL Injection / Cross-Site Scripting / Information Disclosure
X41 D-Sec GmbH Security Advisory: X41-2017-005
QNAP TVS-663 QTS < 4.2.4 build 20170313 - Command Injection
QNAP QTS multiple RCE vulnerabilities
dnaLIMS DNA Sequencing – Directory Traversal / Session Hijacking / Cross-Site Scripting
Title: Multiple vulnerabilities discovered in dnaLIMS DNA sequencing
Radisys MRF – Command Injection
Title: MRF Web Panel OS Command Injection