eCom Cart 1.3 – SQL Injection
# Exploit Title: eCom Cart 1.3 Exploit
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
nuevoMailer 6.0 – SQL Injection
# Exploit Title: nuevoMailer version 6.0 and earlier time-based SQL Injection
Nuevomailer < 6.0 - SQL Injection
# Exploit Title: Nuevo mailer version
EFS Easy Chat Server 3.1 – Password Reset
# Exploit Title: Easy Chat Server Remote Password Reset
EFS Easy Chat Server 3.1 – Password Disclosure
# Exploit Title: Easy Chat Server Remote Password Disclosure
Uniview NVR – Password Disclosure
#Uniview NVR remote passwords disclosure
IDERA Uptime Monitor 7.8 – Multiple Vulnerabilities
## Vulnerabilities Summary
Craft CMS 2.6 – Cross-Site Scripting
# Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload
Robert 0.5 – Multiple Vulnerabilities
# Exploit Title: Robert 0.5 - Multiple Vulnerabilities XSS, CSRF, Directory
Xavier 2.4 – SQL Injection
Document Title:
Grav CMS 1.4.2 Admin Plugin – Cross-Site Scripting
# Exploit Title: GravCMS Core (Admin Plugin) v1.4.2 - Persistent Cross-Site Scripting
Peplink Balance Routers 7.0.0-build1904 – SQL Injection / Cross-Site Scripting / Information Disclosure
X41 D-Sec GmbH Security Advisory: X41-2017-005
WordPress Plugin Tribulant Newsletters 4.6.4.2 – File Disclosure / Cross-Site Scripting
DefenseCode WebScanner DAST Advisory
Kronos Telestaff < 2.92EU29 - SQL Injection
Software: Kronos Telestaff Web Application
Subsonic 6.1.1 – Cross-Site Request Forgery / Cross-Site Scripting
[+] Credits: John Page a.k.a hyp3rlinx
Subsonic 6.1.1 – Server-Side Request Forgery
[+] Credits: John Page a.k.a hyp3rlinx
Subsonic 6.1.1 – Cross-Site Request Forgery
[+] Credits: John Page a.k.a hyp3rlinx
WordPress Plugin Event List < 0.7.8 - SQL Injection
# Exploit Title: WordPress Plugin Event List
EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 – Remote Code Execution
#!/usr/bin/env python
WordPress Plugin WP-Testimonials < 3.4.1 - SQL Injection
# Exploit Title: WP-Testimonials < 3.4.1 Union Based SQL Injection
Joomla! Component Payage 2.05 – ‘aid’ SQL Injection
# Exploit Title: Joomla Payage 2.05 - SQL Injection
Sungard eTRAKiT3 <= 3.2.1.17 - SQL Injection
Software: Sungard eTRAKiT3
CMS Web-Gooroo < 1.141 - Multiple Vulnerabilities
# Exploit Title: CMS Web-Gooroo
WebKit – ‘CachedFrameBase::restore’ Universal Cross-Site Scripting
Click anywhere...
Riverbed SteelHead VCX 9.6.0a – Arbitrary File Read
# Exploit title : Arbitry file reading by authenticated users on Riverbed SteelHead VCX
Piwigo Plugin Facetag 0.0.3 – Cross-Site Scripting
# Exploit Title: Piwigo plugin Facetag , Persistent XSS
OV3 Online Administration 3.0 – SQL Injection
OV3 Online Administration 3.0 Multiple Unauthenticated SQL Injection Vulnerabilities
OV3 Online Administration 3.0 – Directory Traversal
OV3 Online Administration 3.0 Parameter Traversal Arbitrary File Access PoC Exploit
Piwigo Plugin Facetag 0.0.3 – SQL Injection
# Exploit Title: Facetag Extension in Piwigo, Multiple SQL injection
TerraMaster F2-420 NAS TOS 3.0.30 – Root Remote Code Execution
# Source: https://www.evilsocket.net/2017/05/30/Terramaster-NAS-Unauthenticated-RCE-as-root/
KEMP LoadMaster 7.135.0.13245 – Persistent Cross-Site Scripting / Remote Code Execution
Vulnerability Summary
Trend Micro Deep Security 6.5 – XML External Entity Injection / Local Privilege Escalation / Remote Code Execution
The following advisory describes three (3) vulnerabilities found in Trend Micro Deep Security version 6.5.
WordPress Plugin Huge-IT Video Gallery 2.0.4 – SQL Injection
DefenseCode ThunderScan SAST Advisory
QWR-1104 Wireless-N Router – Cross-Site Scripting
# Exploit Title: Aries QWR-1104 Wireless-N Router Execute JavaScript in Wireless Site Survey page.
Sophos Cyberoam – Cross-site scripting
# Exploit Title: Sophos Cyberoam – Cross-site scripting (XSS) vulnerability
Aerohive HiveOS 5.1r5 < 6.1r5 - Remote Code Execution
#!/usr/bin/python3
PlaySMS 1.4 – ‘import.php’ Remote Code Execution
# Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php