webapps

Ultrabenosaurus ChatBoard – Cross-Site Request Forgery (Send Message)

Ultrabenosaurus ChatBoard – Persistent Cross-Site Scripting

# Exploit Title: Ultrabenosaurus ChatBoard - Stored XSS

WordPress Plugin Social Stream 1.5.15 – wp_options Overwrite

Zabbix 2.2 < 3.0.3 - API JSON-RPC Remote Code Execution

#!/usr/bin/env python

Joomla! Component com_payplans 3.3.6 – SQL Injection

######################

Dream Gallery 2.0 – Admin Panel Authentication Bypass

Viart Shopping Cart 5.0 – Cross-Site Request Forgery / Arbitrary File Upload

FRticket Ticket System – Persistent Cross-Site Scripting

# Exploit Title: FRticket - Ticket System - Stored XSS

Grid Gallery 1.0 – Admin Panel Authentication Bypass

phpMyFAQ 2.9.0 – Persistent Cross-Site Scripting

# Exploit Title: phpMyFAQ 2.9.0 Stored XSS

miniMySQLAdmin 1.1.3 – Cross-Site Request Forgery (SQL Execution)

Mobiketa 1.0 – Cross-Site Request Forgery (Add Admin)

Dell OpenManage Server Administrator 8.3 – XML External Entity

#!/usr/bin/ruby

Drale DBTableViewer 100123 – Blind SQL Injection

Drale DBTableViewer v100123 - Blind SQL Injection

Cisco EPC 3928 – Multiple Vulnerabilities

# Title: Cisco EPC 3928 Multiple Vulnerabilities

Nagios XI 5.2.7 – Multiple Vulnerabilities

( , ) (,

rConfig 3.1.1 – Local File Inclusion

Title

Notilus Travel Solution Software 2012 R3 – SQL Injection

Exploit Title: Notilus SQL injection

WordPress Plugin Double Opt-In for Download 2.0.9 – SQL Injection

# Exploit Title: Double Opt-In for Download 2.0.9 Sql Injection

WordPress Theme Uncode 1.3.1 – Arbitrary File Upload

WordPress Theme Newspaper 6.7.1 – Privilege Escalation

WordPress Plugin WP PRO Advertising System 4.6.18 – SQL Injection

WordPress Theme Creative Multi-Purpose 9.1.3 – Persistent Cross-Site Scripting

WordPress Plugin WP Mobile Detector 3.5 – Arbitrary File Upload

#Exploit Title: WP Mobile Detector

Electroweb Online Examination System 1.0 – SQL Injection

# Exploit Title: Online examination system 1.0 - SQL Injection

ArticleSetup 1.00 – Cross-Site Request Forgery (Change Admin Password)

Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 – Command Injection (Shellshock)

# Exploit Title: ShellShock On Sun Secure Global Desktop & Oracle Global desktop

Apache Continuum 1.4.2 – Multiple Vulnerabilities

# Exploit Title: Unauthenticated command injection - Apache Continuum

Dream Gallery 1.0 – Cross-Site Request Forgery (Add Admin)

WordPress Plugin Simple Backup 2.7.11 – Multiple Vulnerabilities

####################

Liferay CE < 6.2 CE GA6 - Persistent Cross-Site Scripting

CVE-2016-3670 Stored Cross Site Scripting in Liferay CE

Joomla! Component SecurityCheck 2.8.9 – Multiple Vulnerabilities

Information

Relay Ajax Directory Manager relayb01-071706/1.5.1/1.5.3 – Arbitrary File Upload

Advisory: Unauthenticated File Upload in Relay Ajax Directory Manager

AjaxExplorer 1.10.3.2 – Multiple Vulnerabilities

[+] Credits: hyp3rlinx

ProcessMaker 3.0.1.7 – Multiple Vulnerabilities

######################################################################

AirOS NanoStation M2 5.6-beta – Multiple Vulnerabilities

# AirOS NanoStation M2 v5.6-beta

Flatpress 1.0.3 – Cross-Site Request Forgery / Arbitrary File Upload

FlatPress 1.0.3 CSRF Arbitrary File Upload RCE PoC

Open Source Real Estate Script 3.6.0 – SQL Injection

# Exploit Title: real-estate classified script Sql Injection

PHP Realestate Script Script 4.9.0 – SQL Injection

# Exploit Title: Property Agent RealeState Script Sql Injection

EduSec 4.2.5 – SQL Injection

EduSec 4.2.5 Multiple SQL Injection Vulnerabilities

Real Estate Portal 4.1 – Multiple Vulnerabilities

Real Estate Portal v4.1 Remote Code Execution Vulnerability

AfterLogic WebMail Pro ASP.NET 6.2.6 – Administrator Account Disclosure via XML External Entity Injection

1. ADVISORY INFORMATION

XenAPI 1.4.1 for XenForo – Multiple SQL Injections

[RCESEC-2016-002] XenAPI v1.4.1 for XenForo Multiple Unauthenticated SQL Injections

WordPress Plugin Job Script by Scubez – Remote Code Execution

#!C:/Python27/python.exe -u

SAP NetWeaver AS JAVA 7.1 < 7.5 - Information Disclosure

Application:SAP NetWeaver AS JAVA

SAP NetWeaver AS JAVA 7.1 < 7.5 - SQL Injection

Application: SAP NetWeaver AS JAVA

Magento < 2.0.6 - Arbitrary Unserialize / Arbitrary Write File

SAP xMII 15.0 – Directory Traversal

Application: SAP xMII

Meteocontrol WEB’log – Admin Password Disclosure (Metasploit)

# Exploit Title: [Meteocontrol WEB'log - Extract Admin password]

Web2py 2.14.5 – Multiple Vulnerabilities

Title - Web2py 2.14.5 Multiple Vulnerabilities LFI,XSS,CSRF