php

Pimcore < 5.71 - Unserialize Remote Code Execution (Metasploit)

##

Agent Tesla Botnet – Information Disclosure

################################

Hyvikk Fleet Manager – Shell Upload

========================================================================================

Moodle 3.6.3 – ‘Install Plugin’ Remote Command Execution (Metasploit)

##

Joomla! Component JiFile 2.3.1 – Arbitrary File Download

# Exploit Title: Joomla! Component JiFile 2.3.1 - Arbitrary File Download

HumHub 1.3.12 – Cross-Site Scripting

# Exploit Title: HumHub 1.3.12 - Cross-Site Scripting

Joomla! Component ARI Quiz 3.7.4 – SQL Injection

# Exploit Title: Joomla! Component ARI Quiz 3.7.4 - SQL Injection

osTicket 1.11 – Cross-Site Scripting / Local File Inclusion

# Exploit Title: osTicket v1.11 - Cross-Site Scripting to Local File

UliCMS 2019.2 / 2019.1 – Multiple Cross-Site Scripting

# Exploit Title: UliCMS - 2019.2 , 2019.1 - Multiple Cross-Site Scripting

Msvod 10 – Cross-Site Request Forgery (Change User Information)

# Exploit Title: Msvod v10 has a CSRF vulnerability to change user information

74CMS 5.0.1 – Cross-Site Request Forgery (Add New Admin User)

# Exploit Title: 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user

WordPress Plugin Contact Form Builder 1.0.67 – Cross-Site Request Forgery / Local File Inclusion

# Exploit Title: Contact Form Builder [CSRF → LFI]

Joomla! Core 1.5.0 – 3.9.4 – Directory Traversal / Authenticated Arbitrary File Deletion

# Exploit Title: Joomla Core (1.5.0 through 3.9.4) - Directory Traversal && Authenticated Arbitrary File Deletion

CuteNews 2.1.2 – ‘avatar’ Remote Code Execution (Metasploit)

##

DirectAdmin 1.561 – Multiple Vulnerabilities

# Title: DirectAdmin Multiple Vulnerabilities to Takeover the Server

ATutor < 2.2.4 - 'file_manager' Remote Code Execution (Metasploit)

##

Dell KACE Systems Management Appliance (K1000) 6.4.120756 – Unauthenticated Remote Code Execution

#!/usr/bin/python

Ashop Shopping Cart Software – ‘bannedcustomers.php?blacklistitemid’ SQL Injection

# Exploit Title: Ashop Shopping Cart Software - SQL Injection

WordPress Plugin Limit Login Attempts Reloaded 2.7.4 – Login Limit Bypass

#!/usr/bin/env node

Tradebox CryptoCurrency – ‘symbol’ SQL Injection

# Title: Tradebox - CryptoCurrency Buy Sell and Trading

ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities

# Exploit Title: Shoretel Connect Multiple Vulnerability

Bolt CMS 3.6.6 – Cross-Site Request Forgery / Remote Code Execution

Jobgator – ‘experience’ SQL Injection

# Exploit Title: NCrypted Jobgator - SQL Injection

WordPress Core 5.0.0 – Crop-image Shell Upload (Metasploit)

##

WordPress Plugin Contact Form Maker 1.13.1 – Cross-Site Request Forgery

# Exploit Title: Contact Form by WD [CSRF → LFI]

FreeSMS 2.1.2 – SQL Injection (Authentication Bypass)

# Exploit Title: FreeSMS 2.1.2 - Authentication Bypass

PhreeBooks ERP 5.2.3 – Arbitrary File Upload

PhreeBooks ERP v5.2.3 - Arbitrary File Upload

Ashop Shopping Cart Software – SQL Injection

# Exploit Title: Ashop Shopping Cart Software - SQL Injection

Clinic Pro v4 – ‘month’ SQL Injection

# Title: Clinic Pro - Clinic Management Software

TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit)

##

iScripts ReserveLogic – SQL Injection

# Exploit Title: iScripts ReserveLogic - SQL Injection

phpFileManager 1.7.8 – Local File Inclusion

# Exploit Title: phpFileManager 1.7.8 - Local File Inclusion

Fiverr Clone Script 1.2.2 – SQL Injection / Cross-Site Scripting

# Exploit Title: Fiverr Clone Script 1.2.2 - SQL Injection / Cross Site Scripting

CMS Made Simple < 2.2.10 - SQL Injection

#!/usr/bin/env python

LimeSurvey < 3.16 - Remote Code Execution

#!/usr/bin/python

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 – Parameter Tampering

# Exploit Title: cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPre...

Inout RealEstate – ‘city’ SQL Injection

# Exploit Title: Inout RealEstate - SQL Injection

Inout EasyRooms – SQL Injection

# Exploit Title: Inout EasyRooms Ultimate Edition - SQL Injection

CMS Made Simple (CMSMS) Showtime2 – File Upload Remote Code Execution (Metasploit)

##

Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 – ‘arac_kategori_id’ SQL Injection

# Exploit Title: Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 - 'arac_kategori_id' SQL Injection

BigTree 4.3.4 CMS – Multiple SQL Injection

===========================================================================================

Job Portal 3.1 – ‘job_submit’ SQL Injection

===========================================================================================

i-doit 1.12 – ‘qr.php’ Cross-Site Scripting

# Exploit Title: i-doit 1.12 Cross Site Scripting on qr.php file

WordPress Plugin Loco Translate 2.2.1 – Local File Inclusion

# Exploit Title: Wordpress Loco Translate (Version 2.2.1) Plugin LFI

WordPress Plugin Anti-Malware Security and Brute-Force Firewall 4.18.63 – Local File Inclusion (PoC)

# Exploit Title: Wordpress Anti-Malware Security and Bruteforce Firewall - Local File Inclusion

Airbnb Clone Script – Multiple SQL Injection

# Exploit Title: Homey BNB (Airbnb Clone Script) - Multiple SQL Injection

Jettweb Hazır Rent A Car Scripti V4 – SQL Injection

# Exploit Title: Jettweb Hazır Rent A Car Scripti V4 - SQL Injection

SJS Simple Job Script – SQL Injection / Cross-Site Scripting

# Exploit Title: Simple Job Script - Multiple Vulnerabilities

XooDigital – ‘p’ SQL Injection

# Exploit Title: XooDigital - 'p' SQL Injection

XooGallery – Multiple SQL Injection

# Exploit Title: XooGallery - Multiple SQL Injections