php

OOP CMS BLOG 1.0 – Multiple Cross-Site Request Forgery

# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Delete Admin)

OOP CMS BLOG 1.0 – Multiple SQL Injection

# Exploit Title: OOP CMS BLOG 1.0 - SQL Injection

elFinder 2.1.47 – ‘PHP connector’ Command Injection

#!/usr/bin/python

CMSsite 1.0 – Multiple Cross-Site Request Forgery

# Exploit Title: CMSsite 1.0 - Cross-Site Request Forgery (Delete Admin)

WordPress Core 5.0 – Remote Code Execution

var wpnonce = '';

Feng Office 3.7.0.5 – Remote Command Execution (Metasploit)

##

Joomla! Component J2Store < 3.3.7 - SQL Injection

# Exploit Title: J2Store Plugin for Joomla! < 3.3.6 - SQL Injection

Simple Online Hotel Reservation System – Cross-Site Request Forgery (Delete Admin)

# Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery (Delete Admin)

Simple Online Hotel Reservation System – Cross-Site Request Forgery (Add Admin)

# Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery (Add Admin)

Simple Online Hotel Reservation System – SQL Injection

# Exploit Title: Simple Online Hotel Reservation System - SQL Injection / Authentication Bypass

PHP 7.2 – ‘imagecolormatch()’ Out of Band Heap Write

Drupal < 8.6.9 - REST Module Remote Code Execution

#!/usr/bin/env python3

Advance Gift Shop Pro Script 2.0.3 – SQL Injection

# Exploit Title: Advance Gift Shop Pro Script 2.0.3 - SQL Injection

News Website Script 2.0.5 – SQL Injection

# Exploit Title: News Website Script 2.0.5 - SQL Injection

PHP Ecommerce Script 2.0.6 – Cross-Site Scripting / SQL Injection

# Exploit Title: PHP Ecommerce Script 2.0.6 - Cross Site Scripting / SQL Injection

zzzphp CMS 1.6.1 – Remote Code Execution

# Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1

Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution

Analyzing the patch

EI-Tube 3 – SQL Injection

# Exploit Title: PHP EI-Tube Script - Sql Injection

C4G Basic Laboratory Information System (BLIS) 3.4 – SQL Injection

# Exploit Title: C4G Basic Laboratory Information System (BLIS) 3.4 - Multiples SQL Injection

HotelDruid 2.3 – Cross-Site Scripting

===========================================================================================

Ask Expert Script 3.0.5 – Cross Site Scripting / SQL Injection

# Exploit Title: Ask Expert Script 3.0.5 - Cross Site Scripting / SQL Injection

XAMPP 5.6.8 – SQL Injection / Persistent Cross-Site Scripting

eDirectory – SQL Injection

# Exploit Title: Admin auth bypass, SQLi and File Disclosure

Zuz Music 2.1 – ‘zuzconsole/___contact ‘ Persistent Cross-Site Scripting

# Exploit Title: Zuz Music 2.1 - 'zuzconsole/___contact ' Persistent Cross-site Scripting

Listing Hub CMS 1.0 – ‘pages.php id’ SQL Injection

# Exploit Title: Listing Hub CMS 1.0 - 'pages.php id' SQL Injection

Find a Place CMS Directory 1.5 – ‘assets/external/data_2.php cate’ SQL Injection

# Exploit Title: Find a Place CMS Directory 1.5 - 'assets/external/data_2.php cate' SQL Injection

WordPress Plugin WooCommerce – GloBee (cryptocurrency) Payment Gateway 1.1.1 – Payment Bypass / Unauthorized Order Status Spoofing

Webiness Inventory 2.3 – ‘ProductModel’ Arbitrary File Upload

===========================================================================================

CMSsite 1.0 – ‘post’ SQL Injection

# Exploit Title: CMSsite 1.0 - 'post' SQL Injection

MISP 2.4.97 – SQL Command Execution via Command Injection in STIX Module

#-*-coding:utf-8-*-

qdPM 9.1 – ‘search[keywords]’ Cross-Site Scripting

===========================================================================================

qdPM 9.1 – ‘type’ Cross-Site Scripting

===========================================================================================

UniSharp Laravel File Manager 2.0.0-alpha7 – Arbitrary File Upload

### Exploit Title: UniSharp Laravel File Manager - Arbitrary File Upload

qdPM 9.1 – ‘search_by_extrafields[]’ SQL Injection

===========================================================================================

MyBB Trash Bin Plugin 1.1.3 – Cross-Site Scripting / Cross-Site Request Forgery

# Exploit Title: MyBB Trash Bin Plugin 1.1.3 - Cross-Site Scripting / CSRF

LayerBB 1.1.2 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery

WordPress Plugin Booking Calendar 8.4.3 – (Authenticated) SQL Injection

# Exploit Title: Wordpress Booking Calendar v8.4.3 - Authenticated SQL Injection Vulnerability

DomainMOD 4.11.01 – ‘assets/edit/host.php?whid=5’ Cross-Site Scripting

# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 – ‘assets/add/dns.php’ Cross-Site Scripting

# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 – ‘category.php CatagoryName, StakeHolder’ Cross-Site Scripting

# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 – ‘ssl-accounts.php username’ Cross-Site Scripting

# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 – ‘ssl-provider-name’ Cross-Site Scripting

# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting

PilusCart 1.4.1 – ‘send’ SQL Injection

####################################################################

Rukovoditel Project Management CRM 2.4.1 – Cross-Site Scripting

####################################################################

LayerBB 1.1.2 – Cross-Site Scripting

# Exploit Title: LayerBB 1.1.2 - Cross-Site Scripting

OPNsense < 19.1.1 - Cross-Site Scripting

#####################################################################################################################...

Webiness Inventory 2.3 – ’email’ SQL Injection

===========================================================================================

VA MAX 8.3.4 – (Authenticated) Remote Code Execution

root@nippur:/home/c/src/nippur# cat vamax3.py

MyBB Bans List 1.0 – Cross-Site Scripting

# Exploit Title: MyBB Bans List - Cross Site Scripting

NUUO NVRmini – upgrade_handle.php Remote Command Execution (Metasploit)

##