webapps

Netsweeper 4.0.4 – SQL Injection

+----------------------------------+

Netsweeper 2.6.29.8 – SQL Injection

+-------------------------------------+

WordPress Plugin MDC Private Message 1.0.0 – Persistent Cross-Site Scripting

# Exploit Title: WordPress MDC Private Message Persistent XSS

WordPress Plugin Googmonify 0.8.1 – Cross-Site Scripting / Cross-Site Request Forgery

[+] Exploit Title : Wordpress Googmonify Plug-in XSS/CSRF

Netsweeper 4.0.8 – Authentication Bypass (via New Profile Creation)

+-----------------------------------------------------------------+

Pligg CMS 2.0.2 – Arbitrary Code Execution

{php}echo ' Hacked ';

Vifi Radio 1.0 – Cross-Site Request Forgery

.__ _____ _______

Aruba Mobility Controller 6.4.2.8 – Multiple Vulnerabilities

# Title: Aruba Mobility Controller CSRF And XSS Vulnerabilities

up.time 7.5.0 – Upload and Execute

up.time 7.5.0 Upload And Execute File Exploit

up.time 7.5.0 – Arbitrary File Disclose and Delete

up.time 7.5.0 Arbitrary File Disclose And Delete Exploit

up.time 7.5.0 – Cross-Site Scripting / Cross-Site Request Forgery (Add Admin)

up.time 7.5.0 XSS And CSRF Add Admin Exploit

up.time 7.5.0 – Superadmin Privilege Escalation

WordPress Plugin WP Symposium 15.1 – ‘get_album_item.php’ SQL Injection

# Exploit Title: Wordpress Plugin wp-symposium Unauthenticated SQL Injection Vulnerability

WordPress Plugin WP Symposium 15.1 – Blind SQL Injection

Details

BigTree CMS 4.2.3 – (Authenticated) SQL Injection

BigTree CMS 4.2.3: Multiple SQL Injection Vulnerabilities

CodoForum 3.3.1 – Multiple SQL Injections

CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities

PHPfileNavigator 2.3.3 – Privilege Escalation

[+] Credits: John Page aka hyp3rlinx

PHPfileNavigator 2.3.3 – Cross-Site Request Forgery

[+] Credits: John Page aka hyp3rlinx

PHPfileNavigator 2.3.3 – Cross-Site Scripting

[+] Credits: John Page aka hyp3rlinx

Cisco Unified Communications Manager – Multiple Vulnerabilities

Vantage Point Security Advisory 2015-001

vBulletin < 4.2.2 - Memcache Remote Code Execution

vBulletin's memcache setting is vulnerable in certain versions(all

Magento CE < 1.9.0.1 - (Authenticated) Remote Code Execution

#!/usr/bin/python

Nuts CMS – PHP Remote Code Injection / Execution

Sagemcom F@ST 3864 V2 – Get Admin Password

#!/bin/bash

Security IP Camera Star Vision DVR – Authentication Bypass

# Exploit Title: Security IP Camera Star Vision DVR Authentication Bypass

Joomla! Component com_informations – SQL Injection

# Exploit Title: Joomla com_informations component SQL Injection vulnerability

Joomla! Component com_memorix – SQL Injection

# Exploit Title: Joomla com_memorix component SQL Injection vulnerability

TOTOLINK Routers – Backdoor / Remote Code Execution

# Exploit Title: TOTOLINK backdoor and RCE exploit POC

Gkplugins Picasaweb – Download File

# Exploit Title: Gkplugins Picasaweb Download File

Joomla! Component com_jem 2.1.4 – Multiple Vulnerabilities

# Exploit Title: Joomla Event Manager 2.1.4 - Multiple Vulnerabilities

Zend Framework 2.4.2 – PHP FPM XML eXternal Entity Injection

=============================================

Printer Pro 5.4.3 IOS – Persistent Cross-Site Scripting

Document Title:

Geoserver < 2.7.1.1 / < 2.6.4 / < 2.5.5.1 - XML External Entity

# Exploit Title : GeoServer XXE

WordPress Plugin Candidate Application Form 1.0 – Arbitrary File Download

Title: Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin

WordPress Plugin Simple Image Manipulator 1.0 – Arbitrary File Download

Title: Remote file download in simple-image-manipulator v1.0 wordpress plugin

WordPress Plugin Recent Backups 0.7 – Arbitrary File Download

Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin

WordPress Plugin WPTF Image Gallery 1.03 – Arbitrary File Download

Title: Remote file download vulnerability in wptf-image-gallery v1.03

WDS CMS – SQL Injection

# ( In The Name Of ALLAH )

WordPress Plugin Video Gallery 2.7 – SQL Injection

# Exploit Title: WordPress Video Gallery 2.7 SQL Injection

WordPress Plugin Job Manager 0.7.22 – Persistent Cross-Site Scripting

Job Manager Persistent XSS

Microweber 1.0.3 – Arbitrary File Upload / Filter Bypass / PHP Remote Code Execution

Microweber v1.0.3 File Upload Filter Bypass Remote PHP Code Execution

Microweber 1.0.3 – Persistent Cross-Site Scripting / Cross-Site Request Forgery (Add Admin)

Microweber v1.0.3 Stored XSS And CSRF Add Admin Exploit

PHP News Script 4.0.0 – SQL Injection

# Exploit Title: PHP News Script 4.0.0 Sql Injection

Froxlor Server Management Panel 0.9.33.1 – MySQL Login Information Disclosure

#------------------------------------------------------------------------------------------#

Netgear ReadyNAS LAN /dbbroker 6.2.4 – Credential Disclosure

#!/usr/bin/env python

Tendoo CMS 1.3 – Cross-Site Scripting

# Exploit Title: Tendoo CMS Stored And Reflected Xss Vulnerability

JoomShopping – Blind SQL Injection

# Exploit Title: [JoomShopping Blind Sql injection]

2Moons – Multiple Vulnerabilities

# Title: 2Moons - Multiple Vulnerabilities

phpFileManager 0.9.8 – Cross-Site Request Forgery

# Exploit Title: CSRF Remote Backdoor Shell

phpFileManager 0.9.8 – Remote Command Execution

# Exploit Title: Remote Command Execution