FUDforum 3.0.6 – Cross-Site Scripting / Cross-Site Request Forgery
Security Advisory - Curesec Research Team
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
LEPTON 2.2.2 – Remote Code Execution
Security Advisory - Curesec Research Team
LEPTON 2.2.2 – SQL Injection
Security Advisory - Curesec Research Team
Mezzanine 4.2.0 – Cross-Site Scripting
Security Advisory - Curesec Research Team
Atlassian Confluence AppFusions Doxygen 1.3.0 – Directory Traversal
RCE Security Advisory
ScriptCase 8.1.053 – Multiple Vulnerabilities
[+] Credits: hyp3rlinx
EditMe CMS – Cross-Site Request Forgery (Add Admin)
Document Title:
WordPress Plugin Sirv 1.3.1 – SQL Injection
# Exploit Title: Sirv 1.3.1 Plugin For WordPress Sql Injection
WordPress Plugin Answer My Question 1.3 – SQL Injection
# Exploit Title: Answer My Question 1.3 Plugin for WordPress – Sql Injection
CS-Cart 4.3.10 – XML External Entity Injection
# Software : CS-Cart
Boonex Dolphin 7.3.2 – Authentication Bypass / Remote Code Execution
#!/usr/bin/env python
ATutor 2.2.2 – Cross-Site Request Forgery (Add New Course)
# Exploit Title: ATutor_2.2.2 Learning Management System
Schoolhos CMS 2.29 – Remote Code Execution / SQL Injection
\x0d\x0a-----------------------------26518470919255\x0d\x0a\x0d\x0a' \
WordPress Plugin Product Catalog 8 1.2.0 – SQL Injection
# Exploit Title: Product Catalog 8 1.2 Plugin WordPress – Sql Injection
WordPress Plugin BBS e-Franchise 1.1.1 – SQL Injection
# Exploit Title: BBS e-Franchise 1.1.1 Plugin of WordPress – Sql Injection
InvoicePlane 1.4.8 – Password Reset
# Exploit Title: InvoicePlane v1.4.8 Incorrect Access Control for password =
4Images 1.7.13 – SQL Injection
# vulnerable app : 4images query($sql);
MyBB 1.8.6 – Cross-Site Scripting
Security Advisory - Curesec Research Team
e107 CMS 2.1.2 – Privilege Escalation
# Exploit Title: e107 CMS 2.1.2 Privilege Escalation
Adobe Connect 9.5.7 – Cross-Site Scripting
Document Title:
WordPress Plugin WassUp Real Time Analytics 1.9 – Persistent Cross-Site Scripting
Source: https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_wassup_real_time_analytics_wordpress_plu...
WordPress Plugin 404 to 301 2.2.8 – Persistent Cross-Site Scripting
Source: https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_404_to_301_wordpress_plugin.html
Sophos Web Appliance 4.2.1.3 – Remote Code Execution
KL-001-2016-009 : Sophos Web Appliance Remote Code Execution
Piwik 2.16.0 – ‘layout’ PHP Object Injection
---------------------------------------------------------------
Schoolhos CMS 2.29 – ‘kelas’ SQL Injection
Document Title:
SweetRice 1.5.1 – Backup Disclosure
Title: SweetRice 1.5.1 - Backup Disclosure
SweetRice 1.5.1 – Arbitrary File Upload
#/usr/bin/python
Redaxo 5.2.0 – Cross-Site Request Forgery
# Exploit Title : redaxo CMS CSRF(Add Admin)
nodCMS – Cross-Site Request Forgery
# Exploit Title : nodcms Cross Site Request Forgery
sNews 1.7.1 – Arbitrary File Upload
# Exploit Title : Snews CMS upload sheller
sNews 1.7.1 – Cross-Site Request Forgery
# Exploit Title : Snews CMS Cross Site Request Forgery
ETchat 3.7 – Cross-Site Request Forgery
# Exploit Title: ETchat(persian version) CMS Xsrf vulnerability
SweetRice 1.5.1 – Arbitrary File Download
#/usr/bin/python
LifeSize Room 5.0.9 – Multiple Vulnerabilities
Source: https://github.com/XiphosResearch/exploits/tree/master/deathsize
School Registration and Fee System – Authentication Bypass
# Exploit Title.............. School Registration and Fee System Auth Bypass
S9Y Serendipity 2.0.4 – Cross-Site Scripting
========================================
InfraPower PPS-02-S Q213V1 – Cross-Site Request Forgery
InfraPower PPS-02-S Q213V1 Cross-Site Request Forgery
InfraPower PPS-02-S Q213V1 – Authentication Bypass
InfraPower PPS-02-S Q213V1 Authentication Bypass Vulnerability
InfraPower PPS-02-S Q213V1 – Insecure Direct Object Reference
InfraPower PPS-02-S Q213V1 Insecure Direct Object Reference Authorization Bypass
InfraPower PPS-02-S Q213V1 – Local File Disclosure
InfraPower PPS-02-S Q213V1 Local File Disclosure Vulnerability
InfraPower PPS-02-S Q213V1 – Multiple Cross-Site Scripting Vulnerabilities
InfraPower PPS-02-S Q213V1 Multiple XSS Vulnerabilities
InfraPower PPS-02-S Q213V1 – Remote Command Execution
InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution