WordPress Plugin Photo Gallery 1.2.5 – Unrestricted Arbitrary File Upload
# Exploit Title: Photo Gallery 1.2.5 Unrestricted File Upload
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
WordPress Plugin / Joomla! Component XCloner – Multiple Vulnerabilities
Title: XCloner Wordpress/Joomla! backup Plugin v3.1.1 (Wordpress) v3.5.1 (Joomla!) Vulnerabilities
PHP-Fusion 7.02.07 – SQL Injection
# Exploit Title: PHP-Fusion 7.02.07 SQL Injection
WordPress Plugin Another WordPress Classifieds Plugin – SQL Injection
Exploit Title: Another Wordpress Classifieds Plugin sql injection and Cross Site Scripting
phpSound Music Sharing Platform 1.0.5 – Multiple Cross-Site Scripting Vulnerabilities
# Exploit Title: phpSound Music Sharing Platform Multiple XSS Vulnerabilities
Serenity Client Management Portal 1.0.1 – Multiple Vulnerabilities
# Exploit Title: Serenity Client Management Portal Multiple Vulnerabilities
vldPersonals 2.7 – Multiple Vulnerabilities
# Exploit Title: VLD Personal – Multiple Vulnerabilities
Mouse Media Script 1.6 – Persistent Cross-Site Scripting
# Exploit Title: Mouse Media Script Stored XSS Vulnerability
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
# Exploit Title: PHP 5.x Shellshock Exploit (bypass disable_functions)
Esotalk CMS 1.0.0g4 – Cross-Site Scripting
# Exploit Title: esotalk cms topics xss vulnerability
Who’s Who Script – Cross-Site Request Forgery (Add Admin)
# Title : Who's Who Script CSRF Exploit (Add Admin Account)
MAARCH 1.4 – SQL Injection
# Exploit Title: Maarch 1.4 SQL Injection
MAARCH 1.4 – Arbitrary File Upload
# Exploit Title: Maarch 1.4 Arbitrary file upload
Tapatalk for vBulletin 4.x – Blind SQL Injection
#!/usr/bin/env python
Enalean Tuleap 7.4.99.5 – Remote Command Execution
Vulnerability title: Tuleap
Enalean Tuleap 7.2 – XML External Entity File Disclosure
Vulnerability title: Tuleap
Enalean Tuleap 7.4.99.5 – Blind SQL Injection
Vulnerability title: Tuleap
Incredible PBX 2.0.6.5.0 – Remote Command Execution
#!/usr/bin/perl
WordPress Plugin CP Multi View Event Calendar 1.01 – SQL Injection
######################
Magento Server MAGMI Plugin 0.7.17a – Remote File Inclusion
Exploit found date: 10/24/2014
Feng Office 1.7.4 – Cross-Site Scripting
source: https://www.securityfocus.com/bid/47049/info
Feng Office 1.7.4 – Arbitrary File Upload
import socket
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)
#!/usr/bin/python
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)
# Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005
SEO Control Panel 3.6.0 – (Authenticated) SQL Injection
# Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection
YourMembers Plugin – Blind SQL Injection
Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin
Change CMS 3.6.8 – Multiple Cross-Site Request Forgery Vulnerabilities
# Exploit Title: RBS Change Complet Open Source multiple CSRF vulnerabilities POST and GET
Croogo 2.0.0 – Arbitrary PHP Code Execution
#!/usr/bin/env python
CMS Made Simple 1.11.9 – Multiple Vulnerabilities
> Vulnerabilities in CMS Made Simple, version 1.11.9
GetSimple CMS 3.3.1 – Cross-Site Scripting
PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1
vBulletin 4.x – breadcrumbs via xmlrpc API (Authenticated) SQL Injection
CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API (post-auth)
vBulletin 4.x/5.x – AdminCP/ApiLog via xmlrpc API (Authenticated) Persistent Cross-Site Scripting
CVE-2014-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth)
WordPress Plugin Creative Contact Form 0.9.7 – Arbitrary File Upload
==========================================================
TestLink 1.9.11 – Multiple SQL Injections
Vulnerability title: Multiple SQL Injection Vulnerabilities in TestLink
PHPCompta/NOALYSS 6.7.1 5638 – Remote Command Execution
Vulnerability title: Remote Command Execution in PHPCompta/NOALYSS
RBS Change Complet Open Source 3.6.8 – Cross-Site Request Forgery
# Exploit Title: RBS Change Complet Open Source CSRF
Bacula-Web 5.2.10 – ‘joblogs.php?jobid’ SQL Injection
bacula-web 5.2.10 vulnerability
Typo3 Extension JobControl 2.14.0 – Cross-Site Scripting / SQL Injection
Mogwai Security Advisory MSA-2014-02