php

Zimbra 8.6.0_GA_1153 – Cross-Site Scripting

# Exploit Title: Xss Zimbra Mail server

Monstra-Dev 3.0.4 – Cross-Site Request Forgery (Account Hijacking)

# Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request Forgery(Account Hijacking)

OpenEMR 5.0.1.3 – Remote Code Execution (Authenticated)

# Title: OpenEMR 5.0.1.3 - Remote Code Execution (Authenticated)

CMS ISWEB 3.5.3 – Directory Traversal

# Exploit Title: CMS ISWEB 3.5.3 - Directory Traversal

onArcade 2.4.2 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: Cross-Site Request Forgery (Add Admin)

Subrion CMS 4.2.1 – Cross-Site Scripting

# Exploit Title: [Subrion CMS- 4.2.1 XSS (Using component with known

PHP Template Store Script 3.0.6 – Cross-Site Scripting

# Exploit Title: PHP Template Store Script- 3.0.6 - Stored XSS via Addres ,Bank Name,and A/c Holder Name

CoSoSys Endpoint Protector 4.5.0.1 – (Authenticated) Remote Root Command Injection

# Title : CoSoSys Endpoint Protector - Authenticated Remote Root Command Injection

PageResponse FB Inboxer Add-on 1.2 – ‘search_field’ SQL Injection

# Exploit Title: FB Inboxer 1.2 - 'search_field' SQL Injection

TI Online Examination System v2 – Arbitrary File Download

# Exploit Title: TI Online Examination System v2 - Arbitrary File Download

WityCMS 0.6.2 – Cross-Site Request Forgery (Password Change)

WordPress Plugin Responsive Thumbnail Slider – Arbitrary File Upload (Metasploit)

##

SoftNAS Cloud < 4.0.3 - OS Command Injection

Core Security - Corelabs Advisory

Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit)

##

Kirby CMS 2.5.12 – Cross-Site Scripting

# Exploit Title:​​ Kirby CMS 2.5.12 - Cross-Site Scripting

MSVOD 10 – ‘cid’ SQL Injection

# Exploit Title: MSVOD V10 ¡V SQL Injection

MyBB New Threads Plugin 1.1 – Cross-Site Scripting

# Exploit Title: MyBB New Threads Plugin - Cross-Site Scripting

WordPress Plugin All In One Favicon 4.6 – (Authenticated) Cross-Site Scripting

# Exploit Title: WordPress Plugin All In One Favicon

Modx Revolution < 2.6.4 - Remote Code Execution

# Exploit Title: Modx Revolution < 2.6.4 - Remote Code Execution

FTP2FTP 1.0 – Arbitrary File Download

# Exploit Title: FTP2FTP 1.0 - Arbitrary File Download

Smart SMS & Email Manager 3.3 – ‘contact_type_id’ SQL Injection

# Exploit Title: Smart SMS & Email Manager v3.3 - SQL Injection

PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation

#!/usr/bin/env python3

PrestaShop < 1.6.1.19 - 'AES CBC' Privilege Escalation

#!/usr/bin/env python3

WordPress Plugin Job Manager 4.1.0 – Cross-Site Scripting

# Exploit Title: Wordpress Plugin Job Manager v4.1.0 Stored Cross Site

phpMyAdmin – (Authenticated) Remote Code Execution (Metasploit)

##

Zeta Producer Desktop CMS 14.2.0 – Remote Code Execution / Local File Disclosure

SEC Consult Vulnerability Lab Security Advisory < 20180712-0 >

WAGO e!DISPLAY 7300T – Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory < 20180711-0 >

Instagram-Clone Script 2.0 – Cross-Site Scripting

# Exploit Title: Instagram-clone Script 2.0 - Cross-Site Scripting

WolfSight CMS 3.2 – SQL Injection

# Exploit Title: WolfSight CMS 3.2 - SQL Injection

GitList 0.6.0 – Argument Injection (Metasploit)

##

Umbraco CMS SeoChecker Plugin 1.9.2 – Cross-Site Scripting

######################

SoftExpert Excellence Suite 2.0 – ‘cddocument’ SQL Injection

# Exploit Title: SoftExpert Excellence Suite 2.0 - 'cddocument' SQL Injection

ShopNx – Arbitrary File Upload

# Exploit Title: ShopNx - Angular5 Single Page Shopping Cart Application 1 - Arbitrary File Upload

Online Trade – Information Disclosure

# Exploit Title: Online Trade 1 - Information Disclosure

CMS Made Simple 2.2.5 – (Authenticated) Remote Code Execution

# Exploit Title: CMS Made Simple 2.2.5 authenticated Remote Code Execution

Dolibarr ERP/CRM < 7.0.3 - PHP Code Injection

# Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =

DAMICMS 6.0.0 – Cross-Site Request Forgery (Add Admin)

hycus CMS 1.0.4 – Authentication Bypass

# Exploit Title: hycus Content Management System v1.0.4 Login Page Bypass

HongCMS 3.0.0 – (Authenticated) SQL Injection

# Exploit Title: HongCMS 3.0.0 - SQL Injection

BEESCMS 4.0 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: A CSRF vulnerability exists in BEESCMS_V4.0: The administrator can be added arbitrarily.

WordPress Core < 4.9.6 - (Authenticated) Arbitrary File Deletion

# Exploit Title: Wordpress

WordPress Plugin iThemes Security < 7.0.3 - SQL Injection

# Exploit Title: WordPress Plugin iThemes Security(better-wp-security)

WordPress Plugin Comments Import & Export < 2.0.4 - CSV Injection

# Exploit Title: Wordpress Plugin Comments Import & Export < 2.0.4 - CSV Injection

WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection

# Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection

phpMyAdmin 4.8.1 – (Authenticated) Local File Inclusion (2)

# Exploit Title: phpMyAdmin 4.8.1 - Local File Inclusion to Remote Code Execution

Opencart < 3.0.2.0 - Denial of Service

#!/usr/bin/perl -w

phpLDAPadmin 1.2.2 – ‘server_id’ LDAP Injection (Username)

# Exploit Title: phpLDAPadmin 1.2.2 - 'server_id' LDAP Injection (Username)

GreenCMS 2.3.0603 – Information Disclosure

# Exploit Title: GreenCMS 2.3.0603 - remote obtain sensitive information

phpMyAdmin 4.8.1 – (Authenticated) Local File Inclusion (1)

The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip

LFCMS 3.7.0 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: administrator account can be added arbitrarily.