php

WordPress Plugin UserPro 4.9.32 – Cross-Site Scripting

# Exploit Title: UserPro

WordPress Plugin Import Export WordPress Users 1.3.1 – CSV Injection

# Exploit Title: Wordpress Plugin Import Export WordPress Users

Nagios XI 5.6.5 – Remote Code Execution / Root Privilege Escalation

WordPress Plugin Add Mime Types 2.2.1 – Cross-Site Request Forgery

# Exploit Title: CSRF vulnerabilities in WP Add Mime Types Plugin

YouPHPTube 7.2 – ‘userCreate.json.php’ SQL Injection

# Exploit Title: YouPHPTube < 7.3 SQL Injection

Neo Billing 3.5 – Persistent Cross-Site Scripting

# Exploit Title: Neo Billing 3.5 - Stored Cross Site Scripting Vulnerability

Kimai 2 – Persistent Cross-Site Scripting

# Exploit Title: Kimai 2- persistent cross-site scripting (XSS)

Integria IMS 5.0.86 – Arbitrary File Upload

# Exploit Title: Integria IMS 5.0.86 - Arbitrary File Upload

Joomla! component com_jsjobs 1.2.6 – Arbitrary File Deletion

# Exploit Title: Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion

EyesOfNetwork 5.1 – Authenticated Remote Command Execution

# Exploit Title: EyesOfNetwork 5.1 - Authenticated Remote Command Execution

Agent Tesla Botnet – Arbitrary Code Execution (Metasploit)

##

WordPress Plugin Download Manager 2.5 – Cross-Site Request Forgery

# Exploit Title: CSRF vulnerabilities in WordPress Download Manager Plugin 2.5

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 – ‘customfields.php’ SQL Injection

#Exploit Title: Joomla! component com_jsjobs - 'customfields.php' SQL Injection

SugarCRM Enterprise 9.0.0 – Cross-Site Scripting

# Exploit Title: 0Day UnauthenticatedXSS SugarCRM Enterprise

AZORult Botnet – SQL Injection

import requests

Agent Tesla Botnet – Arbitrary Code Execution

import requests

Mitsubishi Electric smartRTU / INEA ME-RTU – Unauthenticated OS Command Injection Bind Shell

#!/usr/bin/python

Mitsubishi Electric smartRTU / INEA ME-RTU – Unauthenticated Configuration Download

#!/usr/bin/python

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 – ‘cities.php’ SQL Injection

#Exploit Title: Joomla! component com_jsjobs - SQL Injection

osTicket 1.12 – Persistent Cross-Site Scripting

# Exploit Title: osTicket-v1.12 Stored XSS

osTicket 1.12 – Formula Injection

# Exploit Title: osTicket-v1.12 Formula Injection

osTicket 1.12 – Persistent Cross-Site Scripting via File Upload

# Exploit Title: osTicket-v1.12 Stored XSS via File Upload

Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 – ‘ticket.php’ Arbitrary File Deletion

#Exploit Title: Joomla! component com_jssupportticket - Authenticated Arbitrary File Deletion

Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 – ‘ticketreply.php’ SQL Injection

#Exploit Title: Joomla! component com_jssupportticket - Authenticated SQL Injection

UNA 10.0.0 RC1 – ‘polyglot.php’ Persistent Cross-Site Scripting

# Exploit Title: [UNA - 10.0.0-RC1 stored XSS vuln.]

BSI Advance Hotel Booking System 2.0 – ‘booking_details.php Persistent Cross-Site Scripting

# Exploit Title:BSI Advance Hotel Booking System Persistent XSS

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – SQL Injection

#Exploit Title: Joomla! component com_jssupportticket - SQL Injection

Adive Framework 2.0.7 – Cross-Site Request Forgery

# Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery (CSRF)

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – Arbitrary File Download

#Exploit Title: Joomla! component com_jssupportticket - Arbitrary File Download

Baldr Botnet Panel – Arbitrary Code Execution (Metasploit)

##

Daily Expense Manager 1.0 – Cross-Site Request Forgery (Delete Income)

# Exploit Title: Daily Expense Manager - CSRF (Delete Income)

Open-School 3.0 / Community Edition 2.3 – Cross-Site Scripting

# Exploit Title: [title]

WordPress Plugin JoomSport 3.3 – SQL Injection

# Exploit Title: JoomSport 3.3 – for Sports - SQL injection

1CRM On-Premise Software 8.5.7 – Persistent Cross-Site Scripting

////////////////////////////////////////////////////////////////////////////////////

Rest – Cafe and Restaurant Website CMS – ‘slug’ SQL Injection

# Exploit Title: Rest - Cafe and Restaurant Website CMS - SQL Injection

Sar2HTML 3.2.1 – Remote Command Execution

# Exploit Title: sar2html Remote Code Execution

WebIncorp ERP – SQL injection

# Exploit Title: WebIncorp ERP - SQL injection

WordPress Plugin Database Backup < 5.2 - Remote Code Execution (Metasploit)

##

GigToDo 1.3 – Cross-Site Scripting

# Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection

WordPress Theme Real Estate 2.8.9 – Cross-Site Scripting

# Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9

WordPress Plugin Simple Membership 3.8.4 – Cross-Site Request Forgery

# Exploit Title: Cross Site Request Forgery in Wordpress Simple Membership plugin

Moodle Filepicker 3.5.2 – Server Side Request Forgery

# Exploit Title: Server Side Request Forgery in Moodle Filepicker

MyBB < 1.8.21 - Remote Code Execution

# Exploit Title: MyBB < 1.8.21 Authenticated RCE

Ovidentia 8.4.3 – SQL Injection

#-------------------------------------------------------

Ovidentia 8.4.3 – Cross-Site Scripting

#-------------------------------------------------------

WordPress Plugin Hybrid Composer 1.4.6 – Improper Access Restrictions

# Exploit Title: Wordpress Hybrid Composer

NoviSmart CMS – SQL injection

# Exploit Title: NoviSmart CMS SQL injection

REDCap < 9.1.2 - Cross-Site Scripting

# Exploit Title: REDCap < 9.1.2 - Cross-Site Scripting

FlightPath < 4.8.2 / < 5.0-rc2 - Local File Inclusion

# Exploit Title: FlightPath < 4.8.2 & < 5.0-rc2 - Local File Inclusion

MyT Project Management 1.5.1 – User[username] Persistent Cross-Site Scripting

# Exploit Title: MyT Project Management - User[username] Stored Cross Site