webapps

Web Viewer 1.0.0.193 (Samsung SRN-1670D) – Unrestricted File Upload

# Exploit Title: Unrestricted file upload vulnerability - Web Viewer 1.0.0.193 on Samsung SRN-1670D

osCommerce 2.3.4.1 – Arbitrary File Upload

# Exploit Title: osCommerce 2.3.4.1 Authenticated Arbitrary File Upload

MyBB 1.8.13 – Cross-Site Scripting

# Exploit Title: XSS in MyBB up to 1.8.13 via installer

MyBB 1.8.13 – Remote Code Execution

# Exploit Title: RCE in MyBB up to 1.8.13 via installer

Ametys CMS 4.0.2 – Password Reset

## Vulnerability Summary

ManageEngine Applications Manager 13 – SQL Injection

ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities.

pfSense 2.3.1_1 – Command Execution

# Exploit Title: pfSense Groups) in the handling of the members[] parameter. This allows an authenticated WebGUI use...

WordPress Plugin Userpro < 4.9.17.1 - Authentication Bypass

# Exploit Title: Userpro – WordPress Plugin – Authentication Bypass

Logitech Media Server 7.9.0 – ‘Radio URL’ Cross-Site Scripting

# Exploit Title: Logitech Media Server : HTML code injection and execution.

Logitech Media Server 7.9.0 – ‘favorites’ Cross-Site Scripting

# Exploit Title: Logitech Media Server : Persistent Cross Site Scripting(XSS)

Ladon Framework for Python 0.9.40 – XML External Entity Expansion

Advisory: XML External Entity Expansion in Ladon Webservice

WordPress Plugin JTRT Responsive Tables 4.1 – SQL Injection

# Exploit Title: JTRT Responsive Tables 4.1 – WordPress Plugin – Sql Injection

Ingenious School Management System 2.3.0 – ‘friend_index’ SQL injection

# Exploit Title: Ingenious School Management System 2.3.0 - SQL injection

OctoberCMS 1.0.426 (Build 426) – Cross-Site Request Forgery

# Exploit Title: OctoberCMS 1.0.426 - CSRF to Admin Account Takover

Oracle Java SE – Web Start jnlp XML External Entity Processing Information Disclosure

#!/usr/local/bin/python

Ingenious 2.3.0 – Arbitrary File Upload

# # # # #

D-Park Pro 1.0 – SQL Injection

Username:

Adult Script Pro 2.2.4 – SQL Injection

# # # # #

Article Directory Script 3.0 – ‘id’ SQL Injection

# # # # #

iProject Management System 1.0 – ‘ID’ SQL Injection

# # # # #

iStock Management System 1.0 – Arbitrary File Upload

# # # # #

iTech Gigs Script 1.21 – SQL Injection

# # # # #

Job Board Script – ‘nice_theme’ SQL Injection

# # # # #

Joomla! Component NS Download Shop 2.2.6 – ‘id’ SQL Injection

# # # # #

Joomla! Component Zh YandexMap 6.1.1.0 – ‘placemarklistid’ SQL Injection

# # # # #

Mailing List Manager Pro 3.0 – SQL Injection

# # # # #

MyBuilder Clone 1.0 – ‘subcategory’ SQL Injection

# # # # #

PG All Share Video 1.0 – SQL Injection

# # # # #

PHP CityPortal 2.0 – SQL Injection

# # # # #

Same Sex Dating Software Pro 1.0 – SQL Injection

# # # # #

SoftDatepro Dating Social Network 1.3 – SQL Injection

# # # # #

Sokial Social Network Script 1.0 – SQL Injection

# # # # #

tPanel 2009 – Authentication Bypass

# # # # #

Vastal I-Tech Dating Zone 0.9.9 – ‘product_id’ SQL Injection

# # # # #

ZeeBuddy 2x – ‘groupid’ SQL Injection

# # # # #

Protected Links – SQL Injection

Username

AROX School ERP PHP Script – ‘id’ SQL Injection

# # # # #

Shareet – ‘photo’ SQL Injection

# # # # #

US Zip Codes Database – ‘state’ SQL Injection

# # # # #

Newspaper 1.0 – SQL Injection

# # # # #

MyMagazine 1.0 – ‘id’ SQL Injection

# # # # #

CmsLite 1.4 – ‘S’ SQL Injection

# # # # #

Basic B2B Script – SQL Injection

# # # # #

CPA Lead Reward Script – SQL Injection

Fake Magazine Cover Script – SQL Injection

# # # # #

Nice PHP FAQ Script – ‘nice_theme’ SQL Injection

# # # # #

Online Exam Test Application – ‘sort’ SQL Injection

# # # # #

Php Inventory – Arbitrary File Upload

# # # # #

Vastal I-Tech Agent Zone – ‘searchCommercial.php’ / ‘searchResidential.php’ SQL Injection

# # # # #

Website Broker Script – ‘status_id’ SQL Injection

# # # # #