RSA Enterprise Compromise Assessment Tool 4.1.0.1 – XML External Entity Injection
SEC Consult Vulnerability Lab Security Advisory < 20161011-0 >
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Spacemarc News – Cross-Site Request Forgery (Add New Post)
# Exploit Title : Spacemarc News - Cross-Site Request
Maian Weblog 4.0 – Cross-Site Request Forgery (Add New Post)
# Exploit Title : Maian Weblog 4.0 - Cross-Site Request
PHP Press Release – Persistent Cross-Site Scripting
# Exploit Title : PHP Press Release* - Stored Cross Site
PHP Press Release – Cross-Site Request Forgery (Add Admin)
# Exploit Title : PHP Press Release - Cross-Site Request Forgery (Add Admin - Super User )
miniblog 1.0.1 – Cross-Site Request Forgery (Add New Post)
# Exploit Title : miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)
Entrepreneur Job Portal Script 2.06 – SQL Injection
[x]==================================================================================================================...
Just Dial Clone Script – ‘fid’ SQL Injection
[x]==================================================================================================================...
MLM Unilevel Plan Script 1.0.2 – SQL Injection
######################
B2B Portal Script – Blind SQL Injection
[x]==================================================================================================================...
PHP Classifieds Rental Script – Blind SQL Injection
[x]==================================================================================================================...
Advance MLM Script – SQL Injection
[x]==================================================================================================================...
Cisco Firepower Threat Management Console 6.0.1 – Local File Inclusion
KL-001-2016-006 : Cisco Firepower Threat Management Console Local File Inclusion
Cisco Firepower Threat Management Console 6.0.1 – Remote Command Execution
KL-001-2016-007 : Cisco Firepower Threat Management Console Remote Command
Witbe – Remote Code Execution
#!/usr/bin/python
Picosafe Web GUI – Multiple Vulnerabilities
[-] Title : Picosafe Web Gui - Multiple Vulnerabilities
Mambo < 4.5.4 - SQL Injection
Mambo SQL Injection
Symantec Messaging Gateway 10.6.1 – Directory Traversal
# Title : Symantec Messaging Gateway
TP-Link Archer CR-700 – Cross-Site Scripting
# Exploit Title: TP-Link Archer CR-700 XSS vulnerability
Joomla! Component Event Booking 2.10.1 – SQL Injection
######################
Matrimonial Website Script 1.0.2 – SQL Injection
######################
Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 – Multiple Vulnerabilities
SEC Consult has also released a blog post describing the attack scenarios
Joomla! Component com_videogallerylite 1.0.9 – SQL Injection
Title: Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla
Exponent CMS 2.3.9 – Blind SQL Injection
=============================================
Microix Timesheet Module – SQL Injection
# Exploit Title: Microix timesheet module SQL Injection
Dolphin 7.3.0 – Error-Based SQL Injection
# Exploit Title: Dolphin 7.3.0 Error Based SQL Injection
VegaDNS 0.13.2 – Remote Command Injection
#!/usr/bin/perl
ShoreTel Connect ONSITE – Blind SQL Injection
# Exploit Title: ShoreTel Connect ONSITE Blind SQL Injection Vulnerability
ZineBasic 1.1 – Arbitrary File Disclosure
# Title: ZineBasic 1.1 Remote File Disclosure Exploit
MuM MapEdit 3.2.6.0 – Multiple Vulnerabilities
# Security Advisory -- Multiple Vulnerabilities - MuM Map Edit
MyBB 1.8.6 – SQL Injection
Security Advisory - Curesec Research Team
Kajona 4.7 – Cross-Site Scripting / Directory Traversal
Security Advisory - Curesec Research Team
WordPress Plugin Order Export Import for WooCommerce – Order Information Disclosure
# Exploit Title: WordPress Plugin Order Export Import for WooCommerce
Joomla! Component Portfolio Gallery 1.0.6 – SQL Injection
Title: Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Joomla extension v1.0.6
Joomla! Component Catalog 1.0.7 – SQL Injection
Title: Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla
AnoBBS 1.0.1 – Remote File Inclusion
AnoBBS 1.0.1 Remote File Inclusion Exploit
Cisco EPC 3925 – Multiple Vulnerabilities
# Title: Cisco EPC 3925 Multiple Vulnerabilities
Open-Xchange App Suite 7.8.2 – Cross-Site Scripting
Product: OX App Suite
Open-Xchange Guard 2.4.2 – Multiple Cross-Site Scripting Vulnerabilities
Product: OX Guard
ASUS DSL-X11 ADSL Router – DNS Change
#!/bin/bash
Tenda ADSL2/2+ Modem 963281TAN – DNS Change
#!/bin/bash
PLANET VDR-300NU ADSL Router – DNS Change
#!/bin/bash
PIKATEL 96338WS, 96338L-2M-8M – DNS Change
#!/bin/bash
Inteno EG101R1 VoIP Router – DNS Change
#!/bin/bash