php

Oxwall 1.7.4 – Cross-Site Request Forgery

Advisory ID: HTB23266

Pligg CMS 2.0.2 – Cross-Site Request Forgery / Code Execution

Security Advisory - Curesec Research Team

Pligg CMS 2.0.2 – Directory Traversal

Security Advisory - Curesec Research Team

Pligg CMS 2.0.2 – Multiple SQL Injections

Security Advisory - Curesec Research Team

PHP Server Monitor 3.1.1 – Cross-Site Request Forgery / Privilege Escalation

eBay Magento 1.9.2.1 – PHP FPM XML eXternal Entity Injection

=============================================

PHP Server Monitor 3.1.1 – Multiple Cross-Site Request Forgery Vulnerabilities

[+] Credits: hyp3rlinx

Joomla! Component com_jnews 8.5.1 – SQL Injection

# Description of the component:

Th3 MMA – ‘mma.php’ Backdoor Arbitrary File Upload (Metasploit)

##

Joomla! 3.2.x < 3.4.4 - SQL Injection

Joomla! Component Realtyna RPL 8.9.2 – Persistent Cross-Site Scripting / Cross-Site Request Forgery

Realtyna RPL 8.9.2 Joomla Extension Persistent XSS And CSRF Vulnerabilities

Joomla! Component Realtyna RPL 8.9.2 – Multiple SQL Injections

Realtyna RPL 8.9.2 Joomla Extension Multiple SQL Injection Vulnerabilities

Subrion 3.x – Multiple Vulnerabilities

{-} Title => Subrion 3.X.X - Multiple Exploits

Zpanel – Remote Code Execution (Metasploit)

##

RealtyScript 4.0.2 – Multiple Blind SQL Injections

RealtyScript v4.0.2 Multiple Time-based Blind SQL Injection Vulnerabilities

RealtyScript 4.0.2 – Multiple Cross-Site Request Forgery / Persistent Cross-Site Scripting Vulnerabilities

RealtyScript v4.0.2 Multiple CSRF And Persistent XSS Vulnerabilities

Nibbleblog 4.0.3 – Arbitrary File Upload (Metasploit)

##

WordPress Plugin Ajax Load More < 2.8.2 - Arbitrary File Upload

##

Kerio Control 8.6.1 – Multiple Vulnerabilities

IntelliSec Security Advisory

Dream CMS 2.3.0 – Cross-Site Request Forgery (Add Extension) / Arbitrary File Upload / PHP Code Execution

Dream CMS 2.3.0 CSRF Add Extension And File Upload PHP Code Execution

Joomla! Component com_realestatemanager 3.7 – SQL Injection

# Description of component:

Liferay 6.1.0 CE – Privilege Escalation

# Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation

PHPMyLicense 3.0.0 < 3.1.4 - Denial of Service

Hello, I want to report following exploit:

GLPI 0.85.5 – Arbitrary File Upload / Filter Bypass / Remote Code Execution

# Exploit Title: GLPI 0.85.5 RCE through file upload filter bypass

PHP-Fusion 7.02.07 – Blind SQL Injection

=============================================

Alienvault Open Source SIEM (OSSIM) 4.3 – Cross-Site Request Forgery

# Exploit Title: [AlienVault - ossim CSRF]

vTiger CRM 6.3.0 – (Authenticated) Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE-----

Centreon 2.6.1 – Multiple Vulnerabilities

Centreon 2.6.1 Command Injection Vulnerability

X2Engine 4.2 – Arbitrary File Upload

Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5074/

X2Engine 4.2 – Cross-Site Request Forgery

Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5075/

SMF (Simple Machine Forum) 2.0.10 – Remote Memory Exfiltration

#!/usr/bin/python

refbase 0.9.6 – Multiple Vulnerabilities

# Exploit Title: Refbase

h5ai < 0.25.0 - Unrestricted Arbitrary File Upload

#!/usr/bin/env python

Kirby CMS 2.1.0 – Authentication Bypass

=============================================

Kirby CMS 2.1.0 – Cross-Site Request Forgery / Content Upload / PHP Script Execution

=============================================

Pligg CMS 2.0.2 – ‘load_data_for_search.php’ SQL Injection

# Exploit Title: Pligg CMS 2.0.2 SQL injection

ZeusCart 4.0 – SQL Injection

ZeusCart 4.0: SQL Injection

ZeusCart 4.0 – Cross-Site Request Forgery

ZeusCart 4.0: CSRF

FAROL – SQL Injection

# Exploit Title: Web Application Farol with anauthenticated SQLi injection

Silver Peak VXOA < 6.2.11 - Multiple Vulnerabilities

( , ) (,

CMS Bolt – Arbitrary File Upload (Metasploit)

##

WordPress Plugin CP Reservation Calendar 1.1.6 – SQL Injection

# Exploit Title: WordPress: cp-reservation-calendar 1.1.6 SQLi injection]

WordPress Plugin EZ SQL Reports < 4.11.37 - Multiple Vulnerabilities

# Exploit Title: EZ SQL Reports < 4.11.37: Arbitrary File Download (admin/colaborator required)

Monsta FTP 1.6.2 – Multiple Vulnerabilities

# Exploit Title: CSRF XSS Monsta FTP

Octogate UTM 3.0.12 – Admin Interface Directory Traversal

# Exploit Title: Octogate UTM Admin Interface Directory Traversal

PHP 5.5.9 – ‘zend_executor_globals’ ‘CGIMode FPM WriteProcMemFile’ disable_functions Bypass / Load Dynamic Library

PHP 5.4/5.5/5.6 – ‘Unserialize()’ Use-After-Free

Use After Free Vulnerabilities in unserialize()

PHP Session Deserializer – Use-After-Free

Use After Free Vulnerabilities in Session Deserializer

PHP 5.4/5.5/5.6 – SplObjectStorage ‘Unserialize()’ Use-After-Free

Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage

PHP GMP – ‘unserialize()’ Use-After-Free

Use After Free Vulnerability in unserialize() with GMP