php

Forma LMS 1.3 – Multiple PHP Object Injection Vulnerabilities

Forma LMS 1.3 Multiple PHP Object Injection Vulnerabilities

ElasticSearch < 1.4.5 / < 1.5.2 - Directory Traversal

#!/usr/bin/python

Chronosite 5.12 – SQL Injection

# Exploit Title: Chronosite 5.12 SQL Injection

Burning Board < 2.3.1 - SQL Injection

Burning Board SQL Injection

PHPCollab 2.5 – ‘deletetopics.php’ SQL Injection

# Exploit Title: PHPCollab 2.5 - SQL Injection

WordPress Plugin Booking Calendar Contact Form 1.0.2 – Multiple Vulnerabilities

# Exploit Title: WordPress Booking Calendar Contact Form 1.0.2[Multiple

SQLBuddy 1.3.3 – Directory Traversal

# Exploit Title: Path traversal vulnerability

Wing FTP Server Admin 4.4.5 – Cross-Site Request Forgery (Add User)

# Exploit Title: CSRF add arbitrary users

eFront 3.6.15 – PHP Object Injection

eFront 3.6.15 PHP Object Injection Vulnerability

eFront 3.6.15 – Directory Traversal

eFront 3.6.15 Path Traversal Vulnerability

eFront 3.6.15 – Multiple SQL Injections

eFront 3.6.15 Multiple SQL Injection Vulnerabilities

Pluck CMS 4.7 – Directory Traversal

# Exploit Title: Pluck 4.7 Directory Traversal

WordPress Plugin N-Media Website Contact Form with File Upload 1.3.4 – Arbitrary File Upload (2)

#!/bin/bash

WordPress Plugin Ad Inserter 1.5.2 – Cross-Site Request Forgery

================================================================

WordPress Plugin ClickBank Ads 1.7 – Cross-Site Request Forgery

================================================================

WordPress Plugin Ultimate Profile Builder 2.3.3 – Cross-Site Request Forgery

================================================================

WordPress Plugin RevSlider 3.0.95 – Arbitrary File Upload / Execution (Metasploit)

##

WordPress Plugin Yet Another Related Posts 4.2.4 – Cross-Site Request Forgery

Homepage

SynTail 1.5 Build 566 – Multiple Vulnerabilities

# Exploit Title: Multiple vulnerabilities in SynTail 1.5 Build 566 (CSRF/Stored XSS)

WordPress Plugin N-Media Website Contact Form with File Upload 1.5 – Local File Inclusion

# Exploit Title: website contact form with file upload 1.5 Exploit Local File Inclusion

SynaMan 3.4 Build 1436 – Multiple Vulnerabilities

# Exploit Title: Multiple vulnerabilities in SynaMan 3.4 Build 1436 (CSRF/Stored XSS)

Syncrify Server 3.6 Build 833 – Multiple Vulnerabilities

# Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 (CSRF/Stored XSS)

Xeams 4.5 Build 5755 – Multiple Vulnerabilities

# Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 (CSRF/Stored XSS)

WordPress Plugin Freshmail 1.5.8 – ‘shortcode.php’ SQL Injection

# Exploit Title: Unauthenticated SQL Injection on Wordpress Freshmail (#1)

elFinder 2 – Remote Command Execution (via File Creation)

#[+] Author: TUNISIAN CYBER

Invision Power Board (IP.Board) < 2.0.3 - Multiple Vulnerabilities

IP.Board Multiple Vulnerabilities

WordPress Plugin Ultimate Product Catalogue 3.1.2 – Multiple Persistent Cross-Site Scripting / Cross-Site Request Forgery / Arbitrary File Upload Vulnerabilities

# Exploit Title: Multiple Persistent XSS & CSRF & File Upload on Ultimate

OS Solution OSProperty 2.8.0 – SQL Injection

OS Solution OSProperty 2.8.0 was vulnerable to an unauthenticated SQL

WordPress Plugin TheCartPress 1.3.9 – Multiple Vulnerabilities

Advisory ID: HTB23254

WordPress Core 4.2 – Persistent Cross-Site Scripting

Source: http://klikki.fi/adv/wordpress2.html

OTRS < 3.1.x / < 3.2.x / < 3.3.x - Persistent Cross-Site Scripting

# Exploit Title: Stored Cross-Site Scripting (XSS) in OTRS

WordPress Plugin Ultimate Product Catalogue – SQL Injection (2)

# Exploit Title: Unauthenticated SQLi on Ultimate Product Catalogue

WordPress Plugin Ultimate Product Catalogue – SQL Injection (1)

# Exploit Title: Unauthenticated SQLi in Item_ID POST parameter on Ultimate

WebUI 1.5b6 – Remote Code Execution

#[+] Author: TUNISIAN CYBER

Wolf CMS 0.8.2 – Arbitrary File Upload

Open-Letters – Remote PHP Code Injection

WordPress Plugin Work The Flow – Arbitrary File Upload (Metasploit)

##

WordPress Plugin Creative Contact Form – Arbitrary File Upload (Metasploit)

##

WordPress Plugin N-Media Website Contact Form – Arbitrary File Upload (Metasploit)

##

WordPress Plugin Reflex Gallery – Arbitrary File Upload (Metasploit)

##

GoAutoDial CE 3.3-1406088000 – Authentication Bypass / Arbitrary File Upload / Command Injection

Affected software: GoAutoDial

WordPress Plugin Community Events 1.3.5 – SQL Injection

=======================================================================

MediaSuite CMS – Artibary File Disclosure

.__ _____ _______

WordPress Plugin Tune Library 1.5.4 – SQL Injection

=======================================================================

WordPress Plugin MiwoFTP 1.0.5 – Arbitrary File Download (2)

######################

WordPress Plugin NEX-Forms < 3.0 - SQL Injection

######################

AZBB < 1.0.07d - Multiple Vulnerabilities

AZBB Multiple Vulnerabilities

WordPress Plugin Ajax Store Locator 1.2 – SQL Injection

######################

WordPress Plugin MiwoFTP 1.0.5 – Arbitrary File Download (1)

# Exploit Title :WordPress MiwoFTP Plugin 1.0.5 Arbitrary File Download Exploit

WordPress Plugin MiwoFTP 1.0.5 – Cross-Site Request Forgery / Arbitrary File Creation / Remote Code Execution

WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Creation Exploit (RCE)