Belkin N150 Router 1.00.08/1.00.09 – Directory Traversal
# Title: Path Traversal Vulnerability
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
PROLiNK H5004NK ADSL Wireless Modem – Multiple Vulnerabilities
# Exploit Title: [PROLiNK H5004NK ADSL Wireless Modem Multiple
netis RealTek Wireless Router / ADSL Modem – Multiple Vulnerabilities
# Exploit Title: [netis RealTek wireless router / ADSL modem Multiple
ZYXEL PMG5318-B20A – OS Command Injection
# Exploit Title: [ZyXEL PMG5318-B20A OS Command Injection Vulnerability]
Kerio Control 8.6.1 – Multiple Vulnerabilities
IntelliSec Security Advisory
Netgear Voice Gateway 2.3.0.23_2.3.23 – Multiple Vulnerabilities
# Exploit Title: [Netgear Voice Gateway Multiple Vulnerabilities]
F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 – Directory Traversal
# Exploit Title: [F5 BigIP File Path Traversal Vulnerability]
Dream CMS 2.3.0 – Cross-Site Request Forgery (Add Extension) / Arbitrary File Upload / PHP Code Execution
Dream CMS 2.3.0 CSRF Add Extension And File Upload PHP Code Execution
Joomla! Component com_realestatemanager 3.7 – SQL Injection
# Description of component:
Liferay 6.1.0 CE – Privilege Escalation
# Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation
Kallithea 0.2.9 – ‘came_from’ HTTP Response Splitting
Kallithea 0.2.9 (came_from) HTTP Response Splitting Vulnerability
Zope Management Interface 4.3.7 – Cross-Site Request Forgery
[+] Credits: hyp3rlinx
ZTE ZXHN H108N Router – Configuration Disclosure
ZTE ZXHN H108N unauthenticated config download
GLPI 0.85.5 – Arbitrary File Upload / Filter Bypass / Remote Code Execution
# Exploit Title: GLPI 0.85.5 RCE through file upload filter bypass
PHP-Fusion 7.02.07 – Blind SQL Injection
=============================================
Alienvault Open Source SIEM (OSSIM) 4.3 – Cross-Site Request Forgery
# Exploit Title: [AlienVault - ossim CSRF]
ManageEngine ServiceDesk Plus 9.1 build 9110 – Directory Traversal
Exploit Title: ManageEngine ServiceDesk Plus
ElasticSearch 1.6.0 – Arbitrary File Download
# elasticpwn Script for ElasticSearch url path traversal vuln. CVE-2015-5531
FTGate 7 – Cross-Site Request Forgery
[+] Credits: hyp3rlinx
FTGate 2009 Build 6.4.00 – Multiple Vulnerabilities
[+] Credits: hyp3rlinx
Bosch Security Systems Dinion NBN-498 – Web Interface XML Injection
# Exploit Title: Bosch Security Systems - XML Injection - Dinion NBN-498 Web Interface
Kaseya Virtual System Administrator (VSA) – Multiple Vulnerabilities (2)
Kaseya VSA is an IT management platform for small and medium corporates.
Western Digital My Cloud 04.01.03-421/04.01.04-422 – Command Injection
# Exploit Title: Western Digital My Cloud Command Injection
BMC Track-It! 11.4 – Multiple Vulnerabilities
>> Multiple critical vulnerabilities in BMC Track-It! 11.4
vTiger CRM 6.3.0 – (Authenticated) Remote Code Execution
-----BEGIN PGP SIGNED MESSAGE-----
Photos in Wifi 1.0.1 iOS – Arbitrary File Upload
Document Title:
My.WiFi USB Drive 1.0 iOS – Local File Inclusion
Document Title:
Centreon 2.6.1 – Multiple Vulnerabilities
Centreon 2.6.1 Command Injection Vulnerability
Mango Automation 2.6.0 – Multiple Vulnerabilities
Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution
X2Engine 4.2 – Arbitrary File Upload
Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5074/
X2Engine 4.2 – Cross-Site Request Forgery
Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5075/
FortiManager 5.2.2 – Persistent Cross-Site Scripting
[+] Credits: hyp3rlinx
SMF (Simple Machine Forum) 2.0.10 – Remote Memory Exfiltration
#!/usr/bin/python
refbase 0.9.6 – Multiple Vulnerabilities
# Exploit Title: Refbase
SAP NetWeaver < 7.01 - XML External Entity Injection
Title: SAP Netwaver - XML External Entity Injection
Air Drive Plus 2.4 – Arbitrary File Upload
Document Title:
h5ai < 0.25.0 - Unrestricted Arbitrary File Upload
#!/usr/bin/env python
Kirby CMS 2.1.0 – Authentication Bypass
=============================================
Kirby CMS 2.1.0 – Cross-Site Request Forgery / Content Upload / PHP Script Execution
=============================================
ADH-Web Server IP-Cameras – Multiple Vulnerabilities
1. Adivisory Information
Pligg CMS 2.0.2 – ‘load_data_for_search.php’ SQL Injection
# Exploit Title: Pligg CMS 2.0.2 SQL injection
ZeusCart 4.0 – SQL Injection
ZeusCart 4.0: SQL Injection
ZeusCart 4.0 – Cross-Site Request Forgery
ZeusCart 4.0: CSRF
FAROL – SQL Injection
# Exploit Title: Web Application Farol with anauthenticated SQLi injection
Openfire 3.10.2 – Cross-Site Request Forgery
[+] Credits: hyp3rlinx
Openfire 3.10.2 – Multiple Cross-Site Scripting Vulnerabilities
[+] Credits: hyp3rlinx
Openfire 3.10.2 – Privilege Escalation
[+] Credits: hyp3rlinx