webapps

eFront 3.6.15 – Directory Traversal

eFront 3.6.15 Path Traversal Vulnerability

eFront 3.6.15 – Multiple SQL Injections

eFront 3.6.15 Multiple SQL Injection Vulnerabilities

D-Link DSL-500B Gen 2 – URL Filter Configuration Panel Persistent Cross-Site Scripting

#!/usr/bin/perl

D-Link DSL-500B Gen 2 – Parental Control Configuration Panel Persistent Cross-Site Scripting

#!/usr/bin/perl

Pluck CMS 4.7 – Directory Traversal

# Exploit Title: Pluck 4.7 Directory Traversal

WordPress Plugin N-Media Website Contact Form with File Upload 1.3.4 – Arbitrary File Upload (2)

#!/bin/bash

ZTE F660 – Remote Configuration Download

Exploit Title : ZTE remote configuration download

Alienvault OSSIM/USM 4.14/4.15/5.0 – Multiple Vulnerabilities

Details

WordPress Plugin Ad Inserter 1.5.2 – Cross-Site Request Forgery

================================================================

Manage Engine Asset Explorer 6.1.0 Build: 6110 – Cross-Site Request Forgery

===============================================================================

WordPress Plugin ClickBank Ads 1.7 – Cross-Site Request Forgery

================================================================

WordPress Plugin Ultimate Profile Builder 2.3.3 – Cross-Site Request Forgery

================================================================

WordPress Plugin Yet Another Related Posts 4.2.4 – Cross-Site Request Forgery

Homepage

SynTail 1.5 Build 566 – Multiple Vulnerabilities

# Exploit Title: Multiple vulnerabilities in SynTail 1.5 Build 566 (CSRF/Stored XSS)

WordPress Plugin N-Media Website Contact Form with File Upload 1.5 – Local File Inclusion

# Exploit Title: website contact form with file upload 1.5 Exploit Local File Inclusion

SynaMan 3.4 Build 1436 – Multiple Vulnerabilities

# Exploit Title: Multiple vulnerabilities in SynaMan 3.4 Build 1436 (CSRF/Stored XSS)

Syncrify Server 3.6 Build 833 – Multiple Vulnerabilities

# Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 (CSRF/Stored XSS)

Xeams 4.5 Build 5755 – Multiple Vulnerabilities

# Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 (CSRF/Stored XSS)

Album Streamer 2.0 iOS – Directory Traversal

Document Title:

WordPress Plugin Freshmail 1.5.8 – ‘shortcode.php’ SQL Injection

# Exploit Title: Unauthenticated SQL Injection on Wordpress Freshmail (#1)

IBM Websphere Portal – Persistent Cross-Site Scripting

IBM WebSphere Portal Stored Cross-Site Scripting Vulnerability [CVE-2014-0910]

Dell SonicWALL Secure Remote Access (SRA) Appliance – Cross-Site Request Forgery

# Exploit Title: Dell SonicWALL Secure Remote Access (SRA) Appliance Cross-Site Request Forgery

WordPress Plugin Freshmail 1.5.8 – SQL Injection

# Exploit Title: Unauthenticated SQL Injection on Wordpress Freshmail (#1)

elFinder 2 – Remote Command Execution (via File Creation)

#[+] Author: TUNISIAN CYBER

PDF Converter & Editor 2.1 iOS – Local File Inclusion

Document Title:

vPhoto-Album 4.2 iOS – Local File Inclusion

Document Title:

Invision Power Board (IP.Board) < 2.0.3 - Multiple Vulnerabilities

IP.Board Multiple Vulnerabilities

WordPress Plugin Ultimate Product Catalogue 3.1.2 – Multiple Persistent Cross-Site Scripting / Cross-Site Request Forgery / Arbitrary File Upload Vulnerabilities

# Exploit Title: Multiple Persistent XSS & CSRF & File Upload on Ultimate

PhotoWebsite 3.1 iOS – Local File Inclusion

Document Title:

OS Solution OSProperty 2.8.0 – SQL Injection

OS Solution OSProperty 2.8.0 was vulnerable to an unauthenticated SQL

Wing FTP Server Admin 4.4.5 – Multiple Vulnerabilities

Document Title:

WordPress Plugin TheCartPress 1.3.9 – Multiple Vulnerabilities

Advisory ID: HTB23254

WordPress Core 4.2 – Persistent Cross-Site Scripting

Source: http://klikki.fi/adv/wordpress2.html

OTRS < 3.1.x / < 3.2.x / < 3.3.x - Persistent Cross-Site Scripting

# Exploit Title: Stored Cross-Site Scripting (XSS) in OTRS

WordPress Plugin Ultimate Product Catalogue – SQL Injection (2)

# Exploit Title: Unauthenticated SQLi on Ultimate Product Catalogue

WordPress Plugin Ultimate Product Catalogue – SQL Injection (1)

# Exploit Title: Unauthenticated SQLi in Item_ID POST parameter on Ultimate

WebUI 1.5b6 – Remote Code Execution

#[+] Author: TUNISIAN CYBER

Wolf CMS 0.8.2 – Arbitrary File Upload

Open-Letters – Remote PHP Code Injection

BlueDragon CFChart Servlet 7.1.1.17759 – Arbitrary File Retrieval/Deletion

Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet

GoAutoDial CE 3.3-1406088000 – Authentication Bypass / Arbitrary File Upload / Command Injection

Affected software: GoAutoDial

WordPress Plugin Community Events 1.3.5 – SQL Injection

=======================================================================

MediaSuite CMS – Artibary File Disclosure

.__ _____ _______

WordPress Plugin Tune Library 1.5.4 – SQL Injection

=======================================================================

WordPress Plugin MiwoFTP 1.0.5 – Arbitrary File Download (2)

######################

WordPress Plugin NEX-Forms < 3.0 - SQL Injection

######################

Photo Manager Pro 4.4.0 iOS – Code Execution

Document Title:

Mobile Drive HD 1.8 – Local File Inclusion

Document Title:

Photo Manager Pro 4.4.0 iOS – Local File Inclusion

Document Title:

Wifi Drive Pro 1.2 iOS – Local File Inclusion

Document Title: