php

WordPress Plugin Like Button 1.6.0 – Authentication Bypass

Exploit Title: WP Like Button 1.6.0 - Auth Bypass

Karenderia Multiple Restaurant System 5.3 – SQL Injection

===========================================================================================

Karenderia Multiple Restaurant System 5.3 – Local File Inclusion

===========================================================================================

Centreon 19.04 – Remote Code Execution

#!/usr/bin/python

ZoneMinder 1.32.3 – Cross-Site Scripting

# Exploit Title: ZoneMinder 1.32.3 - Stored Cross Site Scripting (filters)

CiuisCRM 1.6 – ‘eventType’ SQL Injection

===========================================================================================

WorkSuite PRM 2.4 – ‘password’ SQL Injection

===========================================================================================

LibreNMS 1.46 – ‘addhost’ Remote Code Execution

#!/usr/bin/python

WordPress Plugin Live Chat Unlimited 2.8.3 – Cross-Site Scripting

# Exploit Title: Live Chat Unlimited v2.8.3 Stored XSS Injection

WordPress Plugin iLive 1.0.4 – Cross-Site Scripting

# Exploit Title: iLive - Intelligent WordPress Live Chat Support

AZADMIN CMS 1.0 – SQL Injection

[+] Sql Injection on AZADMIN CMS of HIDEA v1.0

SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting

# Exploit Title: [Persistent Cross-Site Scripting or Stored XSS in out/out.GroupMgr.php in SeedDMS before 5.1.11]

SeedDMS < 5.1.11 - 'out.UsrMgr.php' Cross-Site Scripting

# Exploit Title: [Persistent Cross-Site Scripting or Stored XSS in out/out.UsrMgr.php in SeedDMS before 5.1.11]

SeedDMS versions < 5.1.11 - Remote Command Execution

# Exploit Title: [Remote Command Execution through Unvalidated File Upload in SeedDMS versions

dotProject 2.1.9 – SQL Injection

# Exploit Title: dotProject 2.1.9 - Multiple Sql Injection (Poc)

WebERP 4.15 – SQL injection

# Exploit Title: Blind SQL injection in WebERP.

AROX School-ERP Pro – Unauthenticated Remote Command Execution (Metasploit)

##

FusionPBX 4.4.3 – Remote Command Execution

# Exploit Title: FusionPBX

phpMyAdmin 4.8 – Cross-Site Request Forgery

# Exploit Title: Cross Site Request Forgery (CSRF)

WordPress Plugin Insert or Embed Articulate Content into WordPress – Remote Code Execution

# Exploit Title: Authenticated code execution in `insert-or-embed-articulate-content-into-wordpress` Wordpress plugin

UliCMS 2019.1 ‘Spitting Lama’ – Persistent Cross-Site Scripting

# Exploit Title: UliCMS 2019.1 "Spitting Lama" - Stored Cross-Site Scripting

IceWarp 10.4.4 – Local File Inclusion

# Exploit Title: IceWarp

WordPress Plugin Form Maker 1.13.3 – SQL Injection

# -*- coding: utf-8 -*-

KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities

# Exploit Title: [Dell Kace Appliance Multiple Vulnerabilities]

pfSense 2.4.4-p3 (ACME Package 0.59_14) – Persistent Cross-Site Scripting

# Exploit Title: pfSense 2.4.4-p3 (ACMEPackage 0.5.7_1) - Stored Cross-Site Scripting

Opencart 3.0.3.2 – ‘extension/feed/google_base’ Denial of Service (PoC)

#!/bin/bash

Shopware – createInstanceFromNamedArguments PHP Object Instantiation Remote Code Execution (Metasploit)

##

Nagios XI 5.6.1 – SQL injection

# Exploit Title: Nagiosxi username sql injection

Horde Webmail 5.2.22 – Multiple Vulnerabilities

# Title: Horde Webmail - XSS + CSRF to SQLi, RCE, Stealing Emails

WordPress Plugin WPGraphQL 0.2.3 – Multiple Vulnerabilities

#!/usr/bin/env python

Moodle Jmol Filter 6.1 – Directory Traversal / Cross-Site Scripting

# Exploit Title: Moodle filter_jmol multiple vulnerabilities (Directory Traversal and XSS)

GetSimpleCMS – Unauthenticated Remote Code Execution (Metasploit)

##

eLabFTW 1.8.5 – Arbitrary File Upload / Remote Code Execution

# Exploit Title : eLabFTW 1.8.5 'EntityController' Arbitrary File Upload / RCE

Interspire Email Marketer 6.20 – ‘surveys_submit.php’ Remote Code Execution

# Exploit Title: Interspire Email Marketer 6.20 - Remote Code Execution

DeepSound 1.0.4 – SQL Injection

===========================================================================================

Legrand BTicino Driver Manager F454 1.0.51 – Cross-Site Request Forgery / Cross-Site Scripting

CommSy 8.6.5 – SQL injection

Title:

PasteShr 1.6 – Multiple SQL Injection

===========================================================================================

Schneider Electric U.Motion Builder 1.3.4 – ‘track_import_export.php object_id’ Unauthenticated Command Injection

RCE Security Advisory

Sales ERP 8.1 – Multiple SQL Injection

===========================================================================================

PHP-Fusion 9.03.00 – ‘Edit Profile’ Remote Code Execution (Metasploit)

##

OpenProject 5.0.0 – 8.3.1 – SQL Injection

SEC Consult Vulnerability Lab Security Advisory < 20190510-0 >

XOOPS 2.5.9 – SQL Injection

[+] Sql Injection on XOOPS CMS v.2.5.9

SOCA Access Control System 180612 – Cross-Site Request Forgery (Add Admin)

SOCA Access Control System 180612 CSRF Add Admin Exploit

SOCA Access Control System 180612 – SQL Injection

SOCA Access Control System 180612 SQL Injection And Authentication Bypass

SOCA Access Control System 180612 – Information Disclosure

SOCA Access Control System 180612 Information Disclosure

Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Cross-Site Scripting

[+] Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Multiple Cross-Site Scripting

PHPads 2.0 – ‘click.php3?bannerID’ SQL Injection

[+] Sql Injection on PHPads Version 2.0 based on Pixelledads 1.0 by Nile Flores

WordPress Plugin Social Warfare < 3.5.3 - Remote Code Execution

# Title: RCE in Social Warfare Plugin Wordpress (

Instagram Auto Follow – Authentication Bypass

# Exploit Title: Instagram Auto Follow - Autobot Instagram - Authentication Bypass