webapps

webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。

Red-Gate SQL Monitor < 3.10 / 4.2 - Authentication Bypass

# Exploit Title: Red-Gate SQL Monitor authentication bypass

2017-08-10 Paul Taylor webapps

Piwigo Plugin User Tag 0.9.0 – Cross-Site Scripting

# Exploit Title: Piwigo plugin User Tag , Persistent XSS

2017-08-10 Touhid M.Shaikh webapps

GIF Collection 2.0 – SQL Injection

# # # # #

2017-08-10 Ihsan Sencan webapps

ImageBay 1.0 – SQL Injection

# # # # #

2017-08-10 Ihsan Sencan webapps

Symantec Messaging Gateway < 10.6.3-267 - Cross-Site Request Forgery

# Exploit Title: CSRF

2017-08-09 Dhiraj Mishra webapps

WebFile Explorer 1.0 – Arbitrary File Download

# # # # #

2017-08-09 Ihsan Sencan webapps

DALIM SOFTWARE ES Core 5.0 build 7184.1 – Server-Side Request Forgery

DALIM SOFTWARE ES Core 5.0 build 7184.1 Server-Side Request Forgery

2017-08-09 LiquidWorm webapps

DALIM SOFTWARE ES Core 5.0 build 7184.1 – Directory Traversal

DALIM SOFTWARE ES Core 5.0 build 7184.1 Multiple Remote File Disclosures

2017-08-09 LiquidWorm webapps

DALIM SOFTWARE ES Core 5.0 build 7184.1 – Cross-Site Scripting / Cross-Site Request Forgery

2017-08-09 LiquidWorm webapps

DALIM SOFTWARE ES Core 5.0 build 7184.1 – User Enumeration

#!/usr/bin/env python

2017-08-09 LiquidWorm webapps

Unitrends UEB 9.1 – Privilege Escalation

# Exploit Title: Authenticated lowpriv RCE for Unitrends UEB 9.1

2017-08-08 Jared Arave webapps

Synology Photo Station 6.7.3-3432 / 6.3-2967 – Remote Code Execution

'''

2017-08-08 Kacper Szurek webapps

WordPress Plugin Easy Modal 2.0.17 – SQL Injection

DefenseCode ThunderScan SAST Advisory

2017-08-07 defensecode webapps

Horde Groupware 5.2.21 – Unauthorized File Download

## Vulnerability Summary

2017-08-03 SecuriTeam webapps

Tiandy IP Cameras 5.56.17.120 – Sensitive Information Disclosure

## Vulnerability Summary

2017-08-03 SecuriTeam webapps

Technicolor TC7337 – ‘SSID’ Persistent Cross-Site Scripting

// Device : Technicolor TC7337

2017-08-03 Geolado giolado webapps

Joomla! Component StreetGuessr Game 1.1.8 – SQL Injection

# # # # #

2017-08-03 Ihsan Sencan webapps

Muviko 1.0 – ‘q’ SQL Injection

Exploit Title: Muviko - Video CMS v1.0 – 'q' Parameter SQL Injection

2017-08-02 Kaan KAMIS webapps

EDUMOD Pro 1.3 – SQL Injection

Exploit Title: School Management System | EDUMOD Pro v1.3 – SQL Injection

2017-08-02 Kaan KAMIS webapps

Premium Servers List Tracker 1.0 – SQL Injection

Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection

2017-08-02 Kaan KAMIS webapps

Joomla! Component Ultimate Property Listing 1.0.2 – SQL Injection

# # # # #

2017-08-02 Ihsan Sencan webapps

Joomla! Component Event Registration Pro Calendar 4.1.3 – SQL Injection

# # # # #

2017-08-02 Ihsan Sencan webapps

Joomla! Component LMS King Professional 3.2.4.0 – SQL Injection

# # # # #

2017-08-02 Ihsan Sencan webapps

Joomla! Component PHP-Bridge 1.2.3 – SQL Injection

# # # # #

2017-08-02 Ihsan Sencan webapps

Joomla! Component SIMGenealogy 2.1.5 – SQL Injection

# # # # #

2017-08-02 Ihsan Sencan webapps

Entrepreneur B2B Script – ‘pid’ SQL Injection

# Exploit Title: Entrepreneur B2B Script - 'pid' Parameter SQL Injection

2017-08-02 Meisam Monsef webapps

JoySale 2.2.1 – Arbitrary File Upload

JoySale Arbitrary File Upload

2017-08-01 Mutlu Benmutlu webapps

SOL.Connect ISET-mpp meter 1.2.4.2 – SQL Injection

Vulnerability type:

2017-08-01 Andy Tan webapps

VehicleWorkshop – Arbitrary File Upload

# Exploit Title: VehicleWorkshop Unrestricted File Upload or Shell Upload

2017-08-01 Touhid M.Shaikh webapps

VehicleWorkshop – Authentication Bypass

[*] Type: Admin or Customer login bypass via SQL injection

2017-08-01 Touhid M.Shaikh webapps

Advantech SUSIAccess < 3.0 - 'RecoveryMgmt' File Upload

#!/usr/bin/env ruby

2017-08-01 James Fitts webapps

Advantech SUSIAccess < 3.0 - Directory Traversal / Information Disclosure (Metasploit)

require 'msf/core'

2017-08-01 James Fitts webapps

VehicleWorkshop – SQL Injection

# Exploit Title: VehicleWorkshop SQL Injection

2017-07-28 Shahab Shamsi webapps

Fortinet FortiOS < 5.6.0 - Cross-Site Scripting

# Title: FortiOS

2017-07-28 patryk_bogdan webapps

Joomla! Component CCNewsLetter 2.1.9 – ‘sbid’ SQL Injection

"Joomla Component ccnewsletter 2.1.9 - 'sbid' Parameter SQL Injection"

2017-07-27 Shahab Shamsi webapps

Friends in War Make or Break 1.7 – Cross-Site Request Forgery (Change Admin Password)

Friends in War Make or Break 1.7 - Unauthenticated admin password change

2017-07-26 shinnai webapps

Friends in War Make or Break 1.7 – SQL Injection

# # # # #

2017-07-26 Ihsan Sencan webapps

WordPress Plugin Ads Pro < 3.4 - Cross-Site Scripting / SQL Injection

# Exploit Title: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager = 5.0.12 AND time-based blind

2017-07-25 8bitsec webapps

Friends in War Make or Break 1.7 – Authentication Bypass

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2017-07-25 Adam webapps

WebKit JSC – ‘JSObject::putInlineSlow’ / ‘JSValue::putToPrimitive’ Universal Cross-Site Scripting

2017-07-25 Google Security Research webapps

REDDOXX Appliance Build 2032 / 2.0.625 – Arbitrary File Disclosure

Advisory: Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance

2017-07-24 RedTeam Pentesting webapps

REDDOXX Appliance Build 2032 / 2.0.625 – Remote Command Execution

Advisory: Remote Command Execution as root in REDDOXX Appliance

2017-07-24 RedTeam Pentesting webapps

PaulShop – SQL Injection / Cross-Site Scripting

# Exploit Title: PaulShop CMS - Sql Injection and stored XSS

2017-07-24 BTIS Team webapps

ManageEngine Desktop Central 10 Build 100087 – Remote Code Execution (Metasploit)

# Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE

2017-07-24 Kacper Szurek webapps

vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit)

##

2017-07-24 Metasploit webapps

NEC UNIVERGE UM4730 < 11.8 - SQL Injection

# Exploit Title: NEC UNIVERGE UM4730 < 11.8 SQL injection

2017-07-21 b0x41s webapps

VACRON VIG-US731VE 1.0.18-09-B727 IP Camera – Authentication Bypass

# Exploit Title: IP Camera VACRON VIG-US731VE

2017-07-20 Viktoras webapps

WordPress Plugin IBPS Online Exam 1.0 – SQL Injection / Cross-Site Scripting

# Exploit Title: IBPS Online Exam Plugin for WordPress v1.0 - XSS SQLi

2017-07-20 8bitsec webapps

Tilde CMS 1.01 – Multiple Vulnerabilities

# Exploit Title: Tilde CMS 1.01 Multiple Vulnerabilities

2017-07-20 Raffaele Forte webapps

Joomla! Component JoomRecipe 1.0.4 – ‘search_author’ SQL Injection

# Exploit Title: Joomla JoomRecipe 1.0.4 Component - Blind SQL Injection Vulnerability

2017-07-20 Teng webapps