webapps

HP WebInspect 10.4 – XML External Entity Injection

# Exploit Title: HP WebInspect - XML External Entity

Milw0rm Clone Script 1.0 – ‘related.php?program’ Blind SQL Injection

| Exploit Title: Milw0rm Clone Script v1.0 - (time based) SQLi |

Pasworld – ‘detail.php’ Blind SQL Injection

=========================================================

WordPress Plugin WP Mobile Edition – Local File Inclusion

######################################################################################

WordPress Plugin Wp-ImageZoom 1.1.0 – Multiple Vulnerabilities

# Exploit Title: wp-imagezoom Remote Image Upload

D-Link DSL-526B ADSL2+ AU_2.01 – Remote DNS Change

D-Link DSL-526B ADSL2+ AU_2.01

D-Link DSL-2730B AU_2.01 – Authentication Bypass DNS Change

D-Link DSL-2730B AU_2.01

TP-Link TD-W8950ND ADSL2+ – Remote DNS Change

TP-Link ADSL2+ TD-W8950ND

D-Link DSL-2780B DLink_1.01.14 – Remote DNS Change

D-Link DSL-2780B DLink_1.01.14

Broadlight Residential Gateway DI3124 – Remote DNS Change

Broadlight Residential Gateway DI3124

WiFi HD 8.1 – Directory Traversal / Denial of Service

# Exploit Title: WiFi HD 8.1 - Directory Traversal and Denial of Service

WordPress Plugin Nmedia WordPress Member Conversation 1.35.0 – ‘doupload.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/53790/info

WordPress Plugin Really Simple Guest Post 1.0.6 – Local File Inclusion

# Exploit Title: Wordpress Really Simple Guest Post File Include

WordPress Plugin zM Ajax Login & Register 1.0.9 – Local File Inclusion

# Exploit Title: CVE-2015-4153 - WordPress zM Ajax Login & Register

SysAid Help Desk Administrator Portal < 14.4 - Arbitrary File Upload (Metasploit)

##

VFront 0.99.2 – Cross-Site Request Forgery / Persistent Cross-Site Scripting

# Exploit Title: CSRF & Persistent XSS

Seagate Central 2014.0410.0026-F – Remote Facebook Access Token

#!/usr/bin/python

WordPress Plugin LeagueManager 3.9.11 – SQL Injection

###################################################################################################

Aruba ClearPass Policy Manager – Persistent Cross-Site Scripting

===============================================================================

WordPress Plugin dzs-zoomsounds 2.0 – Arbitrary File Upload

###################################################################################################

ESC 8832 Data Controller – Multiple Vulnerabilities

=begin

JSPMyAdmin 1.1 – Multiple Vulnerabilities

# Exploit Title: JSPMyAdmin 1.1 SQL Injection, CSRF & XSS

TCPDF Library 5.9 – Arbitrary File Deletion

TCPDF library Universal POI Payload to Arbitrary File Deletion

WordPress Plugin Free Counter 1.1 – Persistent Cross-Site Scripting

# Exploit Title: WordPress Free Counter Plugin [Stored XSS]

ClickHeat 1.13+ – Remote Command Execution

Clickheat 1.13+ Unauthenticated RCE

Sendio ESP – Information Disclosure

1. Advisory Information

WordPress Plugin Simple Photo Gallery 1.7.8 – Blind SQL Injection

# Exploit Title: Wordpess Simple Photo Gallery Blind SQL Injection

WordPress Plugin church_admin 0.800 – Persistent Cross-Site Scripting

# Exploit Title: Wordpress church_admin Stored XSS

WordPress Plugin MailChimp Subscribe Forms 1.1 – Remote Code Execution

# Exploit Title: Wordpress MailChimp Subscribe Forms Remote Code Execution

Apache JackRabbit – WebDAV XML External Entity

#!/usr/bin/env python

WordPress Plugin GigPress 2.3.8 – SQL Injection

# Title: SQLi vulnerabilities in WordPress plugin "GigPress"

WordPress Plugin Landing Pages 1.8.4 – Multiple Vulnerabilities

# Title: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages"

WordPress Plugin NewStatPress 0.9.8 – Multiple Vulnerabilities

# Title: Multiple vulnerabilities in WordPress plugin "NewStatPress"

WordPress Plugin Video Gallery 2.8 – Arbitrary Mail Relay

######################

WordPress Plugin WP Symposium 15.1 – ‘&show=’ SQL Injection

=======================================================================

Forma LMS 1.3 – Multiple SQL Injections

Forma LMS 1.3 Multiple SQL Injections

WordPress Plugin WP Membership 1.2.3 – Multiple Vulnerabilities

# Exploit Title: WordPress WP Membership plugin [Multiple Vulnerabilities]

WordPress Plugin FeedWordPress 2015.0426 – SQL Injection

# Exploit Title: SQLi in FeedWordPress WordPress plugin

ManageEngine EventLog Analyzer 10.0 Build 10001 – Cross-Site Request Forgery

OYO File Manager 1.1 (iOS / Android) – Multiple Vulnerabilities

Document Title:

Wireless Photo Transfer 3.0 iOS – Local File Inclusion

Document Title:

Forma LMS 1.3 – Multiple PHP Object Injection Vulnerabilities

Forma LMS 1.3 Multiple PHP Object Injection Vulnerabilities

ElasticSearch < 1.4.5 / < 1.5.2 - Directory Traversal

#!/usr/bin/python

Chronosite 5.12 – SQL Injection

# Exploit Title: Chronosite 5.12 SQL Injection

Burning Board < 2.3.1 - SQL Injection

Burning Board SQL Injection

PHPCollab 2.5 – ‘deletetopics.php’ SQL Injection

# Exploit Title: PHPCollab 2.5 - SQL Injection

WordPress Plugin Booking Calendar Contact Form 1.0.2 – Multiple Vulnerabilities

# Exploit Title: WordPress Booking Calendar Contact Form 1.0.2[Multiple

SQLBuddy 1.3.3 – Directory Traversal

# Exploit Title: Path traversal vulnerability

Wing FTP Server Admin 4.4.5 – Cross-Site Request Forgery (Add User)

# Exploit Title: CSRF add arbitrary users

eFront 3.6.15 – PHP Object Injection

eFront 3.6.15 PHP Object Injection Vulnerability