php

WordPress Plugin Ultimate Product Catalog 3.8.1 – Privilege Escalation

phpATM 1.32 – Multiple Vulnerabilities

phpATM 1.32 (Windows) – Arbitrary File Upload / Remote Command Execution

Vicidial 2.11 – Scripts Persistent Cross-Site Scripting

# Exploit Title: Vicidial 2.11 Scripts - Authenticated Stored XSS

WordPress Plugin Gravity Forms 1.8.19 – Arbitrary File Upload

Tiki Wiki CMS Calendar 6.15/9.11 LTS/12.5 LTS/14.2 – Remote Code Execution

# Exploit Title: Tiki-Calendar-RCE

SlimCMS 0.1 – Cross-Site Request Forgery (Change Admin Password)

Roxy Fileman 1.4.4 – Arbitrary File Upload

# Exploit Title: Roxy Fileman

PHPLive 4.4.8 < 4.5.4 - Password Recovery SQL Injection

#!/bin/env python

jbFileManager – Directory Traversal

# Exploit Title: jbFileManager - Path Traversal(view/add/delete)

BookingWizz Booking System < 5.5 - Multiple Vulnerabilities

1. ADVISORY INFORMATION

Joomla! Component com_enmasse 5.1 < 6.4 - SQL Injection

# Exploit Title: Joomla com_enmasse - SQL Injection

Dokeos 2.2.1 – Blind SQL Injection

# Exploit Title: Dokeos Blind SQL Injection

w2wiki – Multiple Cross-Site Scripting Vulnerabilities

# Exploit Title: w2wiki - Multiple XSS(Stored/Reflected)

Ultrabenosaurus ChatBoard – Cross-Site Request Forgery (Send Message)

Ultrabenosaurus ChatBoard – Persistent Cross-Site Scripting

# Exploit Title: Ultrabenosaurus ChatBoard - Stored XSS

WordPress Plugin Social Stream 1.5.15 – wp_options Overwrite

Zabbix 2.2 < 3.0.3 - API JSON-RPC Remote Code Execution

#!/usr/bin/env python

Joomla! Component com_payplans 3.3.6 – SQL Injection

######################

Dream Gallery 2.0 – Admin Panel Authentication Bypass

Viart Shopping Cart 5.0 – Cross-Site Request Forgery / Arbitrary File Upload

FRticket Ticket System – Persistent Cross-Site Scripting

# Exploit Title: FRticket - Ticket System - Stored XSS

Grid Gallery 1.0 – Admin Panel Authentication Bypass

phpMyFAQ 2.9.0 – Persistent Cross-Site Scripting

# Exploit Title: phpMyFAQ 2.9.0 Stored XSS

miniMySQLAdmin 1.1.3 – Cross-Site Request Forgery (SQL Execution)

Mobiketa 1.0 – Cross-Site Request Forgery (Add Admin)

Drale DBTableViewer 100123 – Blind SQL Injection

Drale DBTableViewer v100123 - Blind SQL Injection

Nagios XI 5.2.7 – Multiple Vulnerabilities

( , ) (,

rConfig 3.1.1 – Local File Inclusion

Title

WordPress Plugin Double Opt-In for Download 2.0.9 – SQL Injection

# Exploit Title: Double Opt-In for Download 2.0.9 Sql Injection

WordPress Theme Uncode 1.3.1 – Arbitrary File Upload

WordPress Theme Newspaper 6.7.1 – Privilege Escalation

WordPress Plugin WP PRO Advertising System 4.6.18 – SQL Injection

WordPress Theme Creative Multi-Purpose 9.1.3 – Persistent Cross-Site Scripting

WordPress Plugin WP Mobile Detector 3.5 – Arbitrary File Upload

#Exploit Title: WP Mobile Detector

Electroweb Online Examination System 1.0 – SQL Injection

# Exploit Title: Online examination system 1.0 - SQL Injection

ArticleSetup 1.00 – Cross-Site Request Forgery (Change Admin Password)

Dream Gallery 1.0 – Cross-Site Request Forgery (Add Admin)

WordPress Plugin Simple Backup 2.7.11 – Multiple Vulnerabilities

####################

Joomla! Component SecurityCheck 2.8.9 – Multiple Vulnerabilities

Information

Relay Ajax Directory Manager relayb01-071706/1.5.1/1.5.3 – Arbitrary File Upload

Advisory: Unauthenticated File Upload in Relay Ajax Directory Manager

AjaxExplorer 1.10.3.2 – Multiple Vulnerabilities

[+] Credits: hyp3rlinx

ProcessMaker 3.0.1.7 – Multiple Vulnerabilities

######################################################################

Flatpress 1.0.3 – Cross-Site Request Forgery / Arbitrary File Upload

FlatPress 1.0.3 CSRF Arbitrary File Upload RCE PoC

Open Source Real Estate Script 3.6.0 – SQL Injection

# Exploit Title: real-estate classified script Sql Injection

PHP Realestate Script Script 4.9.0 – SQL Injection

# Exploit Title: Property Agent RealeState Script Sql Injection

EduSec 4.2.5 – SQL Injection

EduSec 4.2.5 Multiple SQL Injection Vulnerabilities

Real Estate Portal 4.1 – Multiple Vulnerabilities

Real Estate Portal v4.1 Remote Code Execution Vulnerability

XenAPI 1.4.1 for XenForo – Multiple SQL Injections

[RCESEC-2016-002] XenAPI v1.4.1 for XenForo Multiple Unauthenticated SQL Injections

WordPress Plugin Job Script by Scubez – Remote Code Execution

#!C:/Python27/python.exe -u