php

Zechat 1.5 – SQL Injection / Cross-Site Request Forgery

# Exploit Title: Zechat 1.5 - 'hashtag' / 'v' SQL Injection / Cross site request forgery

Wchat PHP AJAX Chat Script 1.5 – Cross-Site Scripting

# Exploit Title: Wchat - Fully Responsive PHP AJAX Chat Script 1.5 - Persistent cross site scripting

Model Agency Media House & Model Gallery 1.0 – Multiple Vulnerabilities

# Exploit Title: Model Agency Media House & Model Gallery 1.0 - Persistent Cross-Site Scripting / Cross-Site Request ...

Auto Dealership & Vehicle Showroom WebSys 1.0 – Multiple Vulnerabilities

# Exploit Title: Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Reques...

Zenar Content Management System – Cross-Site Scripting

# Exploit Title: Zenar Content Management System - Cross-Site Scripting

Flippy DamnFacts – Viral Fun Facts Sharing Script 1.1.0 – Cross-Site Scripting / Cross-Site Request Forgery

# Exploit Title: Flippy DamnFacts - Viral Fun Facts Sharing Script 1.1.0 - Persistent cross site scripting / Cross s...

Private Message PHP Script 2.0 – Cross-Site Scripting

# Exploit Title: Private Message PHP Script 2.0 - Persistent Cross-Site scripting

Superfood 1.0 – Multiple Vulnerabilities

# Exploit Title: Superfood - Restaurants & Online Food Order System 1.0 - Persistent cross site scripting / Cross s...

Joomla! Component EkRishta 2.10 – Cross-Site Scripting / SQL Injection

# Exploit Title: Joomla! extension EkRishta 2.10 - Persistent Cross-Site Scripting / SQL Injection

Infinity Market Classified Ads Script 1.6.2 – Cross-Site Request Forgery

# Exploit Title: Infinity Market Classified Ads Script 1.6.2 - Cross-Site Request Forgery

Monstra CMS < 3.0.4 - Cross-Site Scripting (2)

# Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting

Healwire Online Pharmacy 3.0 – Cross-Site Scripting / Cross-Site Request Forgery

# Exploit Title: Healwire Online Pharmacy 3.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery

SuperCom Online Shopping Ecommerce Cart 1 – Persistent Cross-Site scripting / Cross site request forgery / Authentication bypass

# Exploit Title: SuperCom Online Shopping Ecommerce Cart 1 - Persistent Cross-Site scripting / Cross site request for...

NodAPS 4.0 – SQL injection / Cross-Site Request Forgery

# Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery

WordPress Plugin Metronet Tag Manager 1.2.7 – Cross-Site Request Forgery

Press submit on a page containing the following HTML snippet:

Multiplayer BlackJack Online Casino Game 2.5 – Cross-Site Scripting

# Exploit Title: Multiplayer BlackJack - Online Casino Game 2.5 - Persistent Cross-Site scripting

VirtueMart 3.1.14 – Persistent Cross-Site Scripting

# Exploit Title: VirtueMart 3.1.14 - Persistent Cross-Site Scripting

MyBB Admin Notes Plugin 1.1 – Cross-Site Request Forgery

# Exploit Title: MyBB Admin Notes Plugin - CSRF

XATABoost 1.0.0 – SQL Injection

# Exploit Title: XATABoost CMS Sql Injection

WUZHI CMS 4.1.0 – ‘tag[pinyin]’ Cross-Site Scripting

# Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability

WUZHI CMS 4.1.0 – ‘form[qq_10]’ Cross-Site Scripting

# Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability

Mantis Bug Tracker 1.1.3 – ‘manage_proj_page’ PHP Code Execution (Metasploit)

##

MyBB Latest Posts on Profile Plugin 1.1 – Cross-Site Scripting

# Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting

PlaySMS 1.4 – ‘sendfromfile.php?Filename’ (Authenticated) ‘Code Execution (Metasploit)

##

PlaySMS – ‘import.php’ (Authenticated) CSV File Upload Code Execution (Metasploit)

##

WordPress Plugin User Role Editor < 4.25 - Privilege Escalation

##

IceWarp Mail Server < 11.1.1 - Directory Traversal

Vendor: IceWarp (http://www.icewarp.com)

WordPress Plugin WF Cookie Consent 1.1.3 – Cross-Site Scripting

# Exploit Title: WF Cookie Consent - Authenticated Persistent Cross-Site Scripting

xdebug < 2.5.5 - OS Command Execution (Metasploit)

##

Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery

# SSRF（Server Side Request Forgery） in Cockpit 0.4.4-0.5.5 (CVE-2018-9302)

WordPress Plugin Responsive Cookie Consent 1.7 / 1.6 / 1.5 – (Authenticated) Persistent Cross-Site Scripting

# Exploit Title: Wordpress Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting

Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root

# Exploit Title: Nagios XI 5.2.[6-9], 5.3, 5.4 Chained Remote Root

WordPress Plugin Form Maker 1.12.20 – CSV Injection

# Exploit Title: Wordpress Plugin Form Maker version 1.12.20 vulnerable to to Formula Injection (CSV Injection)

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)

##

Frog CMS 0.9.5 – Persistent Cross-Site Scripting

# Exploit Title: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings

GitList 0.6 – Remote Code Execution

'''

MyBB Threads to Link Plugin 1.3 – Cross-Site Scripting

# Exploit Title: MyBB Threads to Link Plugin v1.3 - Persistent XSS

October CMS User Plugin 1.4.5 – Persistent Cross-Site Scripting

# Exploit Title: October CMS User Plugin v1.4.5 - Persistent Cross-Site Scripting

WordPress Plugin WP with Spritz 1.0 – Remote File Inclusion

# Exploit Title: WordPress Plugin WP with Spritz 1.0 - Remote File Inclusion

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)

This is a sample of exploit for Drupal 7 new vulnerability SA-CORE-2018-004 / CVE-2018-7602.

HRSALE The Ultimate HRM 1.0.2 – Local File Inclusion

# Exploit Title: HRSALE The Ultimate HRM v1.0.2 - Local File Inclusion

HRSALE The Ultimate HRM 1.0.2 – (Authenticated) Cross-Site Scripting

# Exploit Title: HRSALE The Ultimate HRM 1.0.2 - Authenticated Cross Site Scripting

HRSALE The Ultimate HRM 1.0.2 – ‘award_id’ SQL Injection

# Exploit Title: HRSALE The Ultimate HRM v1.0.2 - 'award_id' SQL Injection

HRSALE The Ultimate HRM 1.0.2 – CSV Injection

# Exploit Title: HRSALE The Ultimate HRM 1.0.2 - CSV Injection

Blog Master Pro 1.0 – CSV Injection

# Exploit Title: Blog Master Pro v1.0 - CSV Injection

Shopy Point of Sale 1.0 – CSV Injection

# Exploit Title: Shopy Point of Sale v1.0 - CSV Injection

WordPress Plugin Woo Import Export 1.0 – Arbitrary File Deletion

Ericsson-LG iPECS NMS A.1Ac – Cleartext Credential Disclosure

# -*- coding: utf-8 -*-

Interspire Email Marketer < 6.1.6 - Remote Admin Authentication Bypass

'''

Monstra CMS 3.0.4 – Arbitrary Folder Deletion

# Exploit Title: Monstra CMS 3.0.4 allows remote attackers to delete folder via an get request