XOOPS < 2.0.11 - Multiple Vulnerabilities
XOOPS Multiple Vulnerabilities
php
php 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
DeDeCMS < 5.7-sp1 - Remote File Inclusion
==========================
Koha 3.20.1 – Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities
# Exploit Title: Koha Open Source ILS - Multiple XSS and XSRF Vulnerabilities
Koha 3.20.1 – Directory Traversal
# Exploit Title: Koha Open Source ILS - Path Traversal in STAFF client
Koha 3.20.1 – Multiple SQL Injections
# Exploit Title: Koha Open Source ILS - Unauthenticated SQL Injection in OPAC
Vesta Control Panel 0.9.8 – OS Command Injection
Advisory ID: HTB23261
Joomla! Component com_simpleimageupload – Arbitrary File Upload
# Exploit Title: Joomla Simple Image Upload - Arbitrary File Upload
GeniXCMS 0.0.3 – ‘register.php’ SQL Injection
# Exploit Title: Genixcms register.php multiple SQL vuln
WordPress Plugin Huge-IT Slider 2.7.5 – Multiple Vulnerabilities
# Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider dele...
GeniXCMS 0.0.3 – Cross-Site Scripting
# Exploit Title: Persistent XSS
BlackCat CMS 1.1.1 – Arbitrary File Download
# Exploit Title: BlackCat CMS v1.1.1 Arbitrary File Download Vulnerability
E-Detective Lawful Interception System – Multiple Vulnerabilities
Advisory: E-Detective Lawful Interception System
TYPO3 Extension Akronymmanager 0.5.0 – SQL Injection
Advisory: SQL Injection in TYPO3 Extension Akronymmanager
Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) – Cross-Site Request Forgery
# Vulnerability type: Cross-site Request Forgery
Milw0rm Clone Script 1.0 – ‘/admin/login.php’ Authentication Bypass
| Exploit Title: Milw0rm Clone Script v1.0 (Auth Bypass) SQL Injection Vulnerability |
WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta – Arbitrary File Upload
Title: Remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms v3.0beta Wordpress plugin
WordPress Plugin SE HTML5 Album Audio Player 1.1.0 – Directory Traversal
Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0
Nakid CMS – Multiple Vulnerabilities
# Exploit Title: CSRF, Persistent XSS & LFI
ClickHeat 1.14 – Cross-Site Request Forgery (Change Admin Password)
# Exploit Title: ClickHeat
WordPress Plugin Encrypted Contact Form 1.0.4 – Cross-Site Request Forgery
# Title: CVE-2015-4010 - Cross-site Request Forgery & Cross-site Scripting in Encrypted
AnimaGallery 2.6 – Local File Inclusion
# Exploit Title: AnimaGallery 2.6 (theme and lang cookie parametre) Local File Include Vulnerability
ISPConfig 3.0.5.4p6 – Multiple Vulnerabilities
Advisory ID: HTB23260
FiverrScript – Cross-Site Request Forgery (Add Admin)
# Exploit Title: FiverrScript CSRF Vulnerability (add New admin)
Pandora FMS 5.0/5.1 – Authentication Bypass
# Exploit Title: Authentication Bypass in Pandora FMS
WordPress Plugin History Collection 1.1.1 – Arbitrary File Download
# Exploit Title: Wordpress History Collection
WordPress Plugin Paypal Currency Converter Basic For WooCommerce – File Read
# Exploit Title: Paypal Currency Converter Basic For Woocommerce File Read
WordPress Plugin RobotCPA V5 – Local File Inclusion
# Exploit Title: Wordpress Plugin RobotCPA V5 - Local File Include
Milw0rm Clone Script 1.0 – ‘related.php?program’ Blind SQL Injection
| Exploit Title: Milw0rm Clone Script v1.0 - (time based) SQLi |
Pasworld – ‘detail.php’ Blind SQL Injection
=========================================================
WordPress Plugin WP Mobile Edition – Local File Inclusion
######################################################################################
WordPress Plugin Wp-ImageZoom 1.1.0 – Multiple Vulnerabilities
# Exploit Title: wp-imagezoom Remote Image Upload
WordPress Plugin Nmedia WordPress Member Conversation 1.35.0 – ‘doupload.php’ Arbitrary File Upload
source: https://www.securityfocus.com/bid/53790/info
WordPress Plugin Really Simple Guest Post 1.0.6 – Local File Inclusion
# Exploit Title: Wordpress Really Simple Guest Post File Include
WordPress Plugin zM Ajax Login & Register 1.0.9 – Local File Inclusion
# Exploit Title: CVE-2015-4153 - WordPress zM Ajax Login & Register
VFront 0.99.2 – Cross-Site Request Forgery / Persistent Cross-Site Scripting
# Exploit Title: CSRF & Persistent XSS
WordPress Plugin LeagueManager 3.9.11 – SQL Injection
###################################################################################################
WordPress Plugin dzs-zoomsounds 2.0 – Arbitrary File Upload
###################################################################################################
TCPDF Library 5.9 – Arbitrary File Deletion
TCPDF library Universal POI Payload to Arbitrary File Deletion
WordPress Plugin Free Counter 1.1 – Persistent Cross-Site Scripting
# Exploit Title: WordPress Free Counter Plugin [Stored XSS]
WordPress Plugin Simple Photo Gallery 1.7.8 – Blind SQL Injection
# Exploit Title: Wordpess Simple Photo Gallery Blind SQL Injection
WordPress Plugin church_admin 0.800 – Persistent Cross-Site Scripting
# Exploit Title: Wordpress church_admin Stored XSS
WordPress Plugin MailChimp Subscribe Forms 1.1 – Remote Code Execution
# Exploit Title: Wordpress MailChimp Subscribe Forms Remote Code Execution
WordPress Plugin GigPress 2.3.8 – SQL Injection
# Title: SQLi vulnerabilities in WordPress plugin "GigPress"
WordPress Plugin Landing Pages 1.8.4 – Multiple Vulnerabilities
# Title: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages"
WordPress Plugin NewStatPress 0.9.8 – Multiple Vulnerabilities
# Title: Multiple vulnerabilities in WordPress plugin "NewStatPress"
WordPress Plugin Video Gallery 2.8 – Arbitrary Mail Relay
######################
WordPress Plugin WP Symposium 15.1 – ‘&show=’ SQL Injection
=======================================================================
Forma LMS 1.3 – Multiple SQL Injections
Forma LMS 1.3 Multiple SQL Injections
WordPress Plugin WP Membership 1.2.3 – Multiple Vulnerabilities
# Exploit Title: WordPress WP Membership plugin [Multiple Vulnerabilities]
WordPress Plugin FeedWordPress 2015.0426 – SQL Injection
# Exploit Title: SQLi in FeedWordPress WordPress plugin