php

Jigowatt PHP Event Calendar – ‘day_view.php’ SQL Injection

source: https://www.securityfocus.com/bid/66923/info

WordPress Plugin Twitget 3.3.1 – Multiple Vulnerabilities

Details

WordPress Plugin Quick Page/Post Redirect 5.0.3 – Multiple Vulnerabilities

Details

WordPress Theme LineNity 1.20 – Local File Inclusion

[+] Local File Inclusion in WordPress Theme LineNity

Microweber CMS 0.93 – Cross-Site Request Forgery

###########################################################

CubeCart 5.2.8 – Session Fixation

# Exploit Title: CubeCart 5.2.8 Session Fixation

Sendy 1.1.9.1 – SQL Injection

# Exploit Title: Sendy 1.1.9.1 - SQL Injection Vulnerability

Vtiger – ‘Install’ Remote Command Execution (Metasploit)

##

Orbit Open Ad Server 1.1.0 – SQL Injection

Advisory ID: HTB23208

XCloner Standalone 3.5 – Cross-Site Request Forgery

Advisory ID: HTB23207

eazyCMS – ‘index.php’ SQL Injection

source: https://www.securityfocus.com/bid/66769/info

Quick.CMS 5.4 – Multiple Vulnerabilities

# Exploit Title: QuickCms 5.4 Multiple Vulnerabilites

Joomla! Component Inneradmission – ‘index.php’ SQL Injection

source: https://www.securityfocus.com/bid/66708/info

XAMPP 3.2.1 & phpMyAdmin 4.1.6 – Multiple Vulnerabilities

# Title: XAMPP 3.2.1 & phpMyAdmin 4.1.6 "'> } in the url resulting in a reflected cross site scripting attack.

Puntopy – ‘novedad.php’ SQL Injection

source: https://www.securityfocus.com/bid/67241/info

PHPFox – Access Control Security Bypass

source: https://www.securityfocus.com/bid/66677/info

WordPress Plugin XCloner 3.1.0 – Cross-Site Request Forgery

Advisory ID: HTB23206

Oracle Identity Manager 11g R2 SP1 (11.1.2.1.0) – Unvalidated Redirects

Unvalidated Redirects on Oracle Identity Manager

CMS Made Simple 1.11.10 – Multiple Cross-Site Scripting Vulnerabilities

Exploit Title : CMS Made Simple 1.11.10 Multiple XSS Vulnerability

Kloxo-MR 6.5.0 – Cross-Site Request Forgery

# Exploit Title :Kloxo-MR 6.5.0 CSRF Vulnerability

Kloxo 6.1.18 Stable – Cross-Site Request Forgery

# Exploit Title :Kloxo 6.1.18 Stable CSRF Vulnerability

Alienvault 4.5.0 – (Authenticated) SQL Injection (Metasploit)

The following request is vulnerable to a SQL injection attack from authenticated users.

Horde Webmail 5.1 – Open Redirect

[+] Horde webmail - Open Redirect Vulnerability

WordPress Plugin Ajax Pagination 1.1 – Local File Inclusion

Details

SePortal 2.5 – SQL Injection / Remote Code Execution (Metasploit)

##

plexusCMS 0.5 – Cross-Site Scripting / Remote Shell / Credentials Leak

# Exploit Title: plexusCMS 0.5 XSS Remote Shell Exploit

Joomla! Component Kunena 3.0.4 – Persistent Cross-Site Scripting

Persistent XSS in Joomla::Kunena 3.0.4

LinEx – Password Reset

# Exploit Title: LinEx All Versions Password Reset Vulnerability

IBM Tealeaf CX 8.8 – Remote OS Command Injection

# IBM Tealeaf CX (v8 release 8) Remote OS Command Injection

OpenCart 1.5.6.1 – ‘openbay’ Multiple SQL Injections

# Exploit Title : OpenCart log('getEbayItemId() - Product ID: '.$product_id);

InterWorx Control Panel 5.0.13 build 574 – ‘xhr.php?i’ SQL Injection

=================================================

qEngine 4.1.6/6.0.0 – ‘task.php’ Local File Inclusion

source: https://www.securityfocus.com/bid/66401/info

qEngine CMS 6.0.0 – Multiple Vulnerabilities

Kemana Directory 1.5.6 – ‘qvc_init()’ Cookie Poisoning CAPTCHA Bypass

#!C:\Perl64\bin\perl.exe

Kemana Directory 1.5.6 – Database Backup Disclosure

Kemana Directory 1.5.6 – ‘task.php’ Local File Inclusion

Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability

Kemana Directory 1.5.6 – Remote Code Execution

Kemana Directory 1.5.6 Remote Code Execution

Kemana Directory 1.5.6 – kemana_admin_passwd Cookie User Password Hash Disclosure

Kemana Directory 1.5.6 kemana_admin_passwd Cookie User Password Hash Disclosure

Cart Engine 3.0.0 – Database Backup Disclosure

Cart Engine 3.0.0 – ‘task.php’ Local File Inclusion

Cart Engine 3.0.0 (task.php) Local File Inclusion Vulnerability

Cart Engine 3.0.0 – Remote Code Execution

Cart Engine 3.0.0 Remote Code Execution

Getsimple CMS 3.3.1 – Persistent Cross-Site Scripting

# Exploit Title: etSimple CMS v3.3.1 Persistent Cross Site Scripting

Symphony 2.2.4 – Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/66536/info

BigDump 0.35b – Arbitrary File Upload

[+] Arbitrary Upload on BigDump v0.35b

WordPress Theme Felici – ‘Uploadify.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/66490/info

Horde Framework – Unserialize PHP Code Execution (Metasploit)

##

LifeSize UVC 1.2.6 – (Authenticated) Remote Code Execution

LifeSize UVC 1.2.6 authenticated vulnerabilities

OXID eShop < 4.7.11/5.0.11 / < 4.8.4/5.1.4 - Multiple Vulnerabilities

# Exploit Title: OXID eShop v

BigACE 2.7.5 – ‘LANGUAGE’ Directory Traversal

source: https://www.securityfocus.com/bid/66350/info

GNUBoard 4.3x – ‘ajax.autosave.php’ Multiple SQL Injections

source: https://www.securityfocus.com/bid/66228/info