A2billing 2.x – Backup File Download / Remote Code Execution
# Title : A2billing 2.x , Unauthenticated Backup dump / RCE flaw
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
CodeMeter 6.50 – Cross-Site Scripting
Document Title:
Wireless Repeater BE126 – Remote Code Execution
# Exploit Title: WIFI Repeater BE126 – Remote Code Execution
WordPress Plugin Participants Database < 1.7.5.10 - Cross-Site Scripting
# Exploit Title: Wordpress Plugin Participants Database < 1.7.5.10 - XSS
Sitefinity CMS 9.2 – Cross-Site Scripting
# Exploit Title: Stored Cross Site Scripting (XSS) in Progress Sitefinity CMS 9.2
Joomla! Component Huge-IT Portfolio Gallery Plugin 1.0.7 – SQL Injection
# Exploit Title Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla
Joomla! Component Huge-IT Portfolio Gallery Plugin 1.0.6 – SQL Injection
# Exploit Title Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6
Joomla! Component Huge-IT Video Gallery 1.0.9 – SQL Injection
# Exploit Title Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla
Metasploit Web UI < 4.14.1-20170828 - Cross-Site Request Forgery
# Exploit Title: CSRF
PHP-SecureArea < 2.7 - Multiple Vulnerabilities
# Exploit Title: PHP-SecureArea
Invoice Manager 3.1 – Cross-Site Request Forgery (Add Admin)
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
FineCMS 1.0 – Multiple Vulnerabilities
# # # # #
Brickcom IP Camera – Credentials Disclosure
1. Advisory Information
User Login and Management – Multiple Vulnerabilities
-----------------------------------------------------------------------------------
D-Link DIR-600 – Authentication Bypass
# Exploit Title: D-Link DIR-600 - Authentication Bypass (Absolute Path Traversal Attack)
PHP Appointment Booking Script – Authentication Bypass
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Car or Cab Booking Script – Authentication Bypass
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
NethServer 7.3.1611 – Cross-Site Request Forgery / Cross-Site Scripting
NethServer 7.3.1611 (Upload.json) CSRF Script Insertion Vulnerability
Schools Alert Management Script – Authentication Bypass
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Flash Poker 2.0 – ‘game’ SQL Injection
# # # # #
PHP Search Engine 1.0 – SQL Injection
# # # # #
Easy Web Search 4.0 – SQL Injection
# # # # #
FTP Made Easy PRO 1.2 – SQL Injection
# # # # #
Smart Chat 1.0.0 – SQL Injection
# # # # #
Matrimonial Script 2.7 – Authentication Bypass
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Wireless Repeater BE126 – Local File Inclusion
# Exploit Title: WIFI Repeater BE126 – Local File Inclusion
Matrimonial Script – SQL Injection
# # # # #
Automated Logic WebCTRL 6.5 – Unrestricted File Upload / Remote Code Execution
#!/usr/bin/env python
Automated Logic WebCTRL 6.1 – Path Traversal / Arbitrary File Write
Automated Logic WebCTRL 6.1 Path Traversal Arbitrary File Write
PHPMyWind 5.3 – Cross-Site Scripting
Exploit Title：PHPMyWind 5.3 has XSS
PHP-Lance 1.52 – ‘subcat’ SQL Injection
# # # # #