webapps

Citrix Nitro SDK – Command Injection

Abstract

Citrix Command Center – Credential Disclosure

Abstract

EMC M&R (Watch4net) – Directory Traversal

Abstract

Joomla! Component ECommerce-WD 1.2.5 – SQL Injection

Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple

EMC M&R (Watch4net) – Credential Disclosure

Abstract

Chamilo LMS 1.9.10 – Multiple Vulnerabilities

I. Overview

Websense Appliance Manager – Command Injection

Abstract

Metasploit Project < 4.11.1 - Initial User Creation Cross-Site Request Forgery (Metasploit)

# Exploit Title: Metasploit Project initial User Creation CSRF

Moodle 2.5.9/2.6.8/2.7.5/2.8.3 – Block Title Handler Cross-Site Scripting

Moodle 2.5.9/2.6.8/2.7.5/2.8.3 Block Title Handler Cross-Site Scripting

WordPress Plugin WPML 3.1.9 – Multiple Vulnerabilities

OVERVIEW

WordPress Plugin SEO by Yoast 1.7.3.3 – Blind SQL Injection

Title: WordPress SEO by Yoast

Smart PHP Poll – Authentication Bypass

# Exploit Title: Smart PHP Poll Auth Bypass Vulnerability

Joomla! Component com_simplephotogallery 1.0 – SQL Injection

#======================================================================================

WoltLab Community Gallery – Persistent Cross-Site Scripting

#Vulnerability title: Community Gallery - Stored Cross-Site Scripting

Codiad 2.5.3 – Local File Inclusion

[+]Title: Codiad v2.5.3 - LFI Vulnerability

Citrix Netscaler NS10.5 – WAF Bypass (Via HTTP Header Pollution)

# Exploit Title: [Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution]

CS-Cart 4.2.4 – Cross-Site Request Forgery

# Exploit Title: CS-Cart 4.2.4 CSRF

Joomla! Component com_simplephotogallery 1.0 – Arbitrary File Upload

######################################################################

GeniXCMS 0.0.1 – Multiple Vulnerabilities

GeniXCMS v0.0.1 Remote Unauthenticated SQL Injection Exploit

CodoForum 2.5.1 – Arbitrary File Download

# Exploit Title: Codoforum 2.5.1 Arbitrary File Download

WordPress Plugin Reflex Gallery 3.1.3 – Arbitrary File Upload

# Exploit Title: Wordpress Plugin Reflex Gallery - Arbitrary File Upload

Elastix 2.x – Blind SQL Injection

# Title: Elastix v2.x Blind SQL Injection Vulnerability

PHP Betoffice (Betster) 1.0.4 – Authentication Bypass / SQL Injection

ProjectSend r561 – SQL Injection

#Vulnerability title: ProjectSend r561 - SQL injection vulnerability

WordPress Theme DesignFolio Plus 1.2 – Arbitrary File Upload

#########################################################

BEdita CMS 3.5.0 – Multiple Vulnerabilities

BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0

SolarWinds Orion Service – SQL Injection

I found a couple SQL injection vulnerabilities in the core Orion service

PHPMoAdmin – Unauthorized Remote Code Execution

######################################################################

WordPress Plugin cp-multi-view-calendar 1.1.4 – SQL Injection

# Exploit Title: WordPress: cp-multi-view-calendar.1.1.4 [SQL Injection

WordPress Theme Photocrati 4.x – SQL Injection / Cross-Site Scripting

# Exploit Title: [ wordpress theme photocrati 4.X.X SQL INJECTION ]

Sagem F@st 3304-V2 – Local File Inclusion

# Title : Sagem F@st 3304-V2 Directory Traversal Vulnerability

vBulletin vBSEO 4.x – ‘visitormessage.php’ Remote Code Injection

#################################################################################################################

WordPress Plugin Calculated Fields Form 1.0.10 – SQL Injection

[+] Calculated Fields Form Wordpress Plugin

Seagate Business NAS 2014.00319 – Remote Code Execution

#!/usr/bin/env python

GoAutoDial CE 2.0 – Arbitrary File Upload

# Title : GoAutoDial CE 2.0 Shell Upload

D-Link/TRENDnet – NCC Service Command Injection (Metasploit)

##

WordPress Plugin Easy Social Icons 1.2.2 – Cross-Site Request Forgery

====================================================

phpBugTracker 1.6.0 – Multiple Vulnerabilities

Advisory: Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities in

Zeuscart 4.0 – Multiple Vulnerabilities

Advisory: Multiple reflecting XSS-, SQLi and

Zabbix 2.0.5 – Cleartext ldap_bind_Password Password Disclosure (Metasploit)

##

Clipbucket 2.7 RC3 0.9 – Blind SQL Injection

# Exploit Title : Clipbucket 2.7 RC3 0.9 Blind SQL Injection

WeBid 1.1.1 – Unrestricted Arbitrary File Upload

Beehive Forum 1.4.4 – Persistent Cross-Site Scripting

Document Title:

Pentaho < 4.5.0 - User Console XML Injection

========================================================================

Piwigo 2.7.3 – Multiple Vulnerabilities

Advisory: Reflecting XSS- and SQL Injection vulnerability in CMS Piwigo

CrushFTP 7.2.0 – Multiple Vulnerabilities

========================================================

Piwigo 2.7.3 – SQL Injection

[CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3

WordPress Plugin Duplicator 0.5.8 – Privilege Escalation

# Exploit Title: Duplicator 0.5.8 Privilege Escalation

D-Link DSL-2640B ADSL Router – ‘ddnsmngr’ Remote DNS Change

#!/bin/bash

GuppY CMS 5.0.9 < 5.00.10 - Multiple Cross-Site Request Forgery Vulnerabilities