php

WordPress Theme Zoner Real Estate – 4.1.1 Persistent Cross-Site Scripting

# Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting

thesystem App 1.0 – ‘username’ SQL Injection

# Exploit Title: thesystem App 1.0 - 'username' SQL Injection

thesystem App 1.0 – Persistent Cross-Site Scripting

# Exploit Title: thesystem App 1.0 - Persistent Cross-Site Scripting

thesystem App 1.0 – ‘server_name’ SQL Injection

# Exploit Title: thesystem 1.0 - 'server_name' SQL Injection

InoERP 0.7.2 – Persistent Cross-Site Scripting

# Exploit Title: InoERP 0.7.2 - Persistent Cross-Site Scripting

citecodecrashers Pic-A-Point 1.1 – ‘Consignment’ SQL Injection

# Exploit Title: citecodecrashers Pic-A-Point 1.1 - 'Consignment' SQL Injection

inoERP 4.15 – ‘download’ SQL Injection

# Exploit Title: inoERP 4.15 - 'download' SQL Injection

all-in-one-seo-pack 3.2.7 – Persistent Cross-Site Scripting

# Exploit Title: all-in-one-seo-pack 3.2.7 - Persistent Cross-Site Scripting

Duplicate-Post 3.2.3 – Persistent Cross-Site Scripting

# Exploit Title: Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting

Chamillo LMS 1.11.8 – Arbitrary File Upload

# Exploit Title: Chamillo LMS 1.11.8 - Arbitrary File Upload

YzmCMS 5.3 – ‘Host’ Header Injection

# Exploit Title: YzmCMS 5.3 - 'Host' Header Injection

WP Server Log Viewer 1.0 – ‘logfile’ Persistent Cross-Site Scripting

# Exploit Title: WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting

Pfsense 2.3.4 / 2.4.4-p3 – Remote Code Injection

# Exploit Title: Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection

vBulletin 5.0 < 5.5.4 - 'widget_php ' Unauthenticated Remote Code Execution

#!/usr/bin/python

LayerBB < 1.1.4 - Cross-Site Request Forgery

# Exploit Title: LayerBB 1.1.3 - Multiple CSRF

GOautodial 4.0 – ‘CreateEvent’ Persistent Cross-Site Scripting

# Exploit Title: GOautodial 4.0 - 'CreateEvent' Persistent Cross-Site Scripting

DIGIT CENTRIS 4 ERP – ‘datum1’ SQL Injection

# Exploit Title: DIGIT CENTRIS 4 ERP - 'datum1' SQL Injection

Hospital-Management 1.26 – ‘fname’ SQL Injection

# Exploit Title: Hospital-Management 1.26 - 'fname' SQL Injection

CollegeManagementSystem-CMS 1.3 – ‘batch’ SQL Injection

# Exploit Title: CollegeManagementSystem-CMS 1.3 - 'batch' SQL Injection

College-Management-System 1.2 – Authentication Bypass

# Exploit Title: College-Management-System 1.2 - Authentication Bypass

Ticket-Booking 1.4 – Authentication Bypass

# Exploit Title: Ticket-Booking 1.4 - Authentication Bypass

LimeSurvey 3.17.13 – Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory < 20190912-0 >

phpMyAdmin 4.9.0.1 – Cross-Site Request Forgery

=============================================

Dolibarr ERP-CRM 10.0.1 – ‘User-Agent’ Cross-Site Scripting

# Exploit Title: Dolibarr ERP/CRM 10.0.1 - User-Agent Http Header Cross

October CMS – Upload Protection Bypass Code Execution (Metasploit)

##

WordPress Plugin Photo Gallery 1.5.34 – Cross-Site Scripting (2)

# Exploit Title: WordPress Plugin Photo Gallery by 10Web

WordPress Plugin Photo Gallery 1.5.34 – Cross-Site Scripting

# Exploit Title: WordPress Plugin Photo Gallery by 10Web

WordPress Plugin Photo Gallery 1.5.34 – SQL Injection

# Exploit Title: WordPress Plugin Photo Gallery by 10Web Add new and in add galleries / Gallery groups. GET request ...

Dolibarr ERP-CRM 10.0.1 – SQL Injection

# Exploit Title: Dolibarr ERP/CRM - Multiple Sql Injection

WordPress Plugin Sell Downloads 1.0.86 – Cross-Site Scripting

# Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting

Online Appointment – SQL Injection

# Exploit Title: Online Appointment SQL Injection

Dolibarr ERP-CRM 10.0.1 – ‘elemid’ SQL Injection

# Exploit Title: Dolibarr ERP/CRM - elemid Sql Injection

WordPress Core 5.2.3 – Cross-Site Host Modification

#!/usr/bin/perl -w

Publisure Hybrid – Multiple Vulnerabilities

#####################################################################################

Inventory Webapp – ‘itemquery’ SQL injection

# Exploit Title: Inventory Webapp SQL injection

WordPress Plugin Download Manager 2.9.93 – Cross-Site Scripting

CVE:CVE-2019-15889

FileThingie 2.5.7 – Arbitrary File Upload

# Exploit Title: FileThingie 2.5.7 - Arbitrary File Upload

Craft CMS 2.7.9/3.2.5 – Information Disclosure

# Exploit Title : CraftCms Users information disclosure From uploaded File

WordPress Plugin Event Tickets 4.10.7.1 – CSV Injection

# Exploit Title: WordPress Plugin Event Tickets >= 4.10.7.1 - CSV Injection

Opencart 3.x – Cross-Site Scripting

# Exploit Title: Opencart 3.x.x Authenticated Stored XSS

WordPress Plugin WooCommerce Product Feed 2.2.18 – Cross-Site Scripting

# Exploit Title: WordPress Plugin WooCommerce Product Feed

YouPHPTube 7.4 – Remote Code Execution

# Exploit Title: YouPHPTube

DomainMod 4.13 – Cross-Site Scripting

# Exploit Title: DomainMod

Sentrifugo 3.2 – Persistent Cross-Site Scripting

# Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting

Sentrifugo 3.2 – File Upload Restriction Bypass

# Exploit Title: Sentrifugo 3.2 - File Upload Restriction Bypass

PilusCart 1.4.1 – Local File Disclosure

# Exploit Title: PilusCart

Jobberbase 2.0 – ‘subscribe’ SQL Injection

#!/bin/bash

Jobberbase 2.0 CMS – ‘jobs-in’ SQL Injection

# Exploit Title: Jobberbase 2.0 CMS - 'jobs-in' SQL Injection

SQLiteManager 1.2.0 / 1.2.4 – Blind SQL Injection

openITCOCKPIT 3.6.1-2 – Cross-Site Request Forgery

# Exploit Title: openITCOCKPIT 3.6.1-2 - CSRF 2 RCE