Easy File Uploader – Arbitrary File Upload
# Exploit Title: Easy File Uploader - Arbitrary File Upload
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Simple File Uploader – Arbitrary File Download
# Exploit Title: Simple File Uploader - Arbitrary File Download
TYPO3 Extension News – SQL Injection
# Exploit Title: TYPO3 News Module SQL Injection
Revive Ad Server 4.0.1 – Cross-Site Scripting / Cross-Site Request Forgery
---------------------------------------------------------------
October CMS 1.0.412 – Multiple Vulnerabilities
October CMS v1.0.412 several vulnerabilities
WordPress Plugin Wow Forms 2.1 – SQL Injection
# Exploit Title: Wow Forms v2.1 WordPress Plugin SQL Injection
WordPress Plugin Wow Viral Signups 2.1 – SQL Injection
# Exploit Title: Wow Viral Signups v2.1 WordPress Plugin SQL Injection
WordPress Plugin Car Rental System 2.5 – SQL Injection
# Exploit Title: Car Rental System v2.5
WordPress Plugin KittyCatfish 2.2 – SQL Injection
# Exploit Title: KittyCatfish 2.2 Plugin for WordPress - SQL Injection
FlySpray 1.0-rc4 – Cross-Site Scripting / Cross-Site Request Forgery
# Exploit Title: XSRF Stored FlySpray 1.0-rc4 (XSS2CSRF add admin account)
Joomla! Component Myportfolio 3.0.2 – ‘pid’ SQL Injection
# Exploit Title: Joomla Component Myportfolio 3.0.2 - SQL Injection
Mantis Bug Tracker 1.3.0/2.3.0 – Password Reset
[+] Credits: John Page a.k.a hyp3rlinx
Concrete5 CMS 8.1.0 – ‘Host’ Header Injection
[+] Credits: John Page a.k.a hyp3rlinx
Horde Groupware Webmail 3/4/5 – Multiple Remote Code Executions
Source: https://blogs.securiteam.com/index.php/archives/3107
MyBB < 1.8.11 - 'email' MyCode Cross-Site Scripting
Description:
WordPress Plugin Spider Event Calendar 1.5.51 – Blind SQL Injection
=============================================
MyClassifiedScript 5.1 – SQL Injection
# # # # #
Jobscript4Web 4.5 – Authentication Bypass
----------------
Forum Template 1.0 – SQL Injection
# # # # #
Invoice Template – ‘hash’ SQL Injection
# # # # #
Moodle 2.x/3.x – SQL Injection
# Exploit: Moodle SQL Injection via Object Injection Through User Preferences
Faveo Helpdesk Community 1.9.3 – Cross-Site Request Forgery
# Exploit Title: CSRF / Privilege Escalation (Manipulation of Role Agent to Admin) on Faveo version Community 1.9.3
HelpDEZK 1.1.1 – Cross-Site Request Forgery / Code Execution
# Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1
Appointment Script – SQL Injection
# # # # #
Sweepstakes Pro Software – SQL Injection
# # # # #
GeoMoose < 2.9.2 - Directory Traversal
# Exploit Title: GeoMoose
Pixie 1.0.4 – Arbitrary File Upload
# Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege # Google Dork: no
EyesOfNetwork (EON) 5.1 – SQL Injection
# Exploit Title: EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root