WordPress Plugin Slideshow Gallery 1.4.6 – Arbitrary File Upload
Summary: WordPress Slideshow Gallery plugin version 1.4.6 suffers from a remote shell upload vulnerability.
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Mulitple WordPress Themes – ‘admin-ajax.php?img’ Arbitrary File Download
# WordPress CuckooTap Theme & eShop Arbitrary File Download
XRms – Blind SQL Injection / Command Execution
#######################
PhpWiki – Remote Command Execution
###############################################################
ActualAnalyzer Lite 2.81 – Command Execution
###############################
Plogger 1.0-RC1 – (Authenticated) Arbitrary File Upload
#!/usr/bin/env python
WordPress Plugin ShortCode 0.2.3 – Local File Inclusion
#################################################################################################
WordPress Plugin WooCommerce Store Exporter 1.7.5 – Multiple Cross-Site Scripting Vulnerabilities
# Exploit Title: WooCommerce Store Exporter v1.7.5 Stored XSS
Joomla! Component spidervideoplayer – ‘theme’ SQL Injection
source: https://www.securityfocus.com/bid/69422/info
PHP Stock Management System 1.02 – Multiple Persistent Cross-Site Scripting Vulnerabilities
# Exploit Title: Multiple Persistent Cross Site Scripting Vulnerabilities
WordPress Plugin KenBurner Slider – ‘admin-ajax.php’ Arbitrary File Download
source: https://www.securityfocus.com/bid/69387/info
MyAwards MyBB Module – Cross-Site Request Forgery
source: https://www.securityfocus.com/bid/69386/info
MyBB 1.8 Beta 3 – Multiple Vulnerabilities
# Title: MyBB 1.8 Beta 3 - Cross Site Scripting & SQL Injection
ArticleFR – ‘id’ SQL Injection
source: https://www.securityfocus.com/bid/69307/info
WordPress Plugin WP Content Source Control – ‘download.php’ Directory Traversal
source: https://www.securityfocus.com/bid/69278/info
WordPress Plugin GB Gallery Slideshow – ‘/wp-admin/admin-ajax.php’ SQL Injection
source: https://www.securityfocus.com/bid/69181/info
VoipSwitch – ‘user.php’ Local File Inclusion
source: https://www.securityfocus.com/bid/69109/info
WordPress Plugin wpSS – ‘ss_handler.php’ SQL Injection
source: https://www.securityfocus.com/bid/69089/info
Feng Office – Persistent Cross-Site Scripting
# Affected software: Feng Office - URL: http://www.fengoffice.com/web/demo.php
Pro Chat Rooms 8.2.0 – Multiple Vulnerabilities
# Exploit Title: Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities
HybridAuth 2.2.2 – Remote Code Execution
######################################################################
RaidenTunes – ‘music_out.php’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/42167/info
ArticleFR 11.06.2014 – ‘data.php’ Privilege Escalation
Advisory ID: HTB23219
Status2k Server Monitoring Software – Multiple Vulnerabilities
# Exploit Title: Status2k Multiple Vulnerabilities/0days
Sphider Search Engine – Multiple Vulnerabilities
# Exploit Title: Sphider Search Engine - Multiple Vulnerabilities
SkaDate Lite 2.0 – Remote Code Execution
#!/usr/bin/env python
SkaDate Lite 2.0 – Multiple Cross-Site Request Forgery / Persistent Cross-Site Scripting Vulnerabilities
SkaDate Lite 2.0 Multiple XSRF And Persistent XSS Vulnerabilities
WordPress Plugin FB Gorilla – ‘game_play.php’ SQL Injection
source: https://www.securityfocus.com/bid/69222/info
CMSimple 4.4.4 – ‘color’ Remote Code Execution
source: https://www.securityfocus.com/bid/68961/info
CMSimple 4.4.4 – Remote File Inclusion
source: https://www.securityfocus.com/bid/68961/info
CMSimple – Default Administrator Credentials
source: https://www.securityfocus.com/bid/68961/info
WordPress Plugin WhyDoWork AdSense – ‘options-general.php’ Cross-Site Request Forgery (Option Manipulation)
source: https://www.securityfocus.com/bid/68954/info
WordPress Plugin Lead Octopus Power – ‘id’ SQL Injection
source: https://www.securityfocus.com/bid/68934/info
Oxwall 1.7.0 – Remote Code Execution
#!/usr/bin/env python
Oxwall 1.7.0 – Multiple Cross-Site Request Forgery / HTML Injection Vulnerabilities
Oxwall 1.7.0 Multiple CSRF And Stored XSS Vulnerabilities
Sphider Search Engine 1.3.6 – Multiple Vulnerabilities
# Exploit Title: Sphider 1.3.6 or later SQL Injection
DirPHP 1.0 – Local File Inclusion
# Exploit Title: DirPHP - version 1.0 Local File Inclusion
ZeroCMS 1.0 – Persistent Cross-Site Scripting
######################
Moodle 2.7 – Persistent Cross-Site Scripting
Title: Moodle 2.7 Persistent XSS
Pligg CMS 2.0.1 – Multiple Vulnerabilities
#!/usr/bin/python
WordPress Plugin Video Gallery 2.5 – Multiple Vulnerabilities
Wordpress Video Gallery
Omeka 2.2.1 – Remote Code Execution
#!/usr/bin/env python
Ubiquiti Networks UniFi Video Default – ‘crossdomain.xml’ Security Bypass
source: https://www.securityfocus.com/bid/68866/info
Ilya Birman E2 – ‘/@actions/comment-process’ SQL Injection
source: https://www.securityfocus.com/bid/68843/info
IBM GCM16/32 1.20.0.22575 – Multiple Vulnerabilities
The IBM 1754 GCM family provides KVM over IP and serial console management
WordPress Plugin WP BackupPlus – Database and Files Backup Download
# Exploit Title: Wordpress wpbackupplus Database and files Backup download (0-day)
WordPress Plugin Gallery Objects 0.4 – SQL Injection
######################