Humhub 0.10.0-rc.1 – Multiple Persistent Cross-Site Scripting Vulnerabilities
# Exploit Title: Humhub
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Humhub 0.10.0-rc.1 – SQL Injection
# Exploit Title: Humhub
Flat Calendar 1.1 – HTML Injection
#!/usr/bin/perl -w
WordPress Plugin Symposium 14.10 – SQL Injection
# Exploit Title: WP Symposium 14.10 SQL Injection
WordPress Plugin Ajax Store Locator 1.2 – Arbitrary File Download
######################
Free Article Submissions 1.0 – SQL Injection
# Exploit Title: Free Article Submissions SQL Injection Vulnerability
PBBoard CMS – Persistent Cross-Site Scripting
##############################################################################
IceHrm 7.1 – Multiple Vulnerabilities
IceHrm name = $saveFileName;
PBBoard CMS 3.0.1 – SQL Injection
Vulnerability title: SQL Injection in PBBoard CMS
Advertise With Pleasure! (AWP) 6.6 – SQL Injection
# Exploit Title: Advertise With Pleasure! (AWP)
Technicolor DT5130 2.05.C29GV – Multiple Vulnerabilities
Product: Wireless N ADSL 2/2+ Modem Router
ManageEngine Netflow Analyzer / IT360 – Arbitrary File Download
>> Arbitrary file download in ManageEngine Netflow Analyzer and IT360
WordPress Plugin CodeArt Google MP3 Player – File Disclosure Download
# Exploit Title: Wordpress CodeArt Google MP3 Player plugin - File
WordPress Plugin Cart66 Lite eCommerce 1.5.1.17 – Blind SQL Injection
# Exploit Title: Cart66 Lite WordPress Ecommerce 1.5.1.17 Blind SQL Injection
WordPress Plugin Google Document Embedder 2.5.16 – ‘mysql_real_escpae_string’ Bypass SQL Injection
Exploit Title : Google Document Embedder 2.5.16 mysql_real_escpae_string bypass SQL Injection
TYPO3 Extension ke DomPDF – Remote Code Execution
Advisory: Remote Code Execution in TYPO3 Extension ke_dompdf
EntryPass N5200 – Credentials Exposure
Advisory: EntryPass N5200 Credentials Disclosure
WordPress Plugin Nextend Facebook Connect 1.4.59 – Cross-Site Scripting
# Exploit Title: Nextend Facebook Connect 1.4.59 XSS
SQL Buddy 1.3.3 – Remote Code Execution
# Exploit Title: SQL Buddy Remote Code Execution
ProjectSend r-561 – Arbitrary File Upload
#!/usr/bin/python
Prolink PRN2001 – Multiple Vulnerabilities
Exploit Title: Prolink PRN2001 Multiple Vulnerabilities
xEpan 1.0.4 – Multiple Vulnerabilities
# Exploit Title: Multiple Vulnerability xEpan 1.0.4
xEpan 1.0.1 – Cross-Site Request Forgery
Advisory ID: HTB23240
WordPress Plugin DB Backup – Arbitrary File Download
|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|
Arris VAP2500 – Authentication Bypass
#!/usr/bin/env ruby
WordPress Plugin Google Document Embedder 2.5.14 – SQL Injection
# Exploit Title: Google Doc Embedder 2.5.14 SQL Injection
Crea8Social 1.3 – Persistent Cross-Site Scripting
# Exploit Title: crea8social 1.3 Stored XSS Vulnerability
PHPMyRecipes 1.2.2 – ‘dosearch.php?words_exact’ SQL Injection
#!/usr/bin/python
WordPress Plugin Download Manager 2.7.2 – Privilege Escalation
# Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation
Advantech EKI-6340 – Command Injection
Core Security - Corelabs Advisory
WordPress Plugin DukaPress 2.5.2 – Directory Traversal
# Exploit Title: DukaPress 2.5.2 Path Traversal
RobotStats 1.0 – ‘robot’ SQL Injection
# Title : RobotStats v1.0 (robot param) SQL Injection Vulnerability
WordPress Plugin wpDataTables 1.5.3 – Arbitrary File Upload
#!/usr/bin/python
WordPress Plugin wpDataTables 1.5.3 – SQL Injection
######################
Netgear WNR500 Wireless Router – ‘webproc?getpage’ Traversal Arbitrary File Access
Netgear Wireless Router WNR500 Parameter Traversal Arbitrary File Access Exploit
WordPress Plugin CM Download Manager 2.0.0 – Code Injection
# Vulnerability title: Code Injection in Wordpress CM Download Manager plugin 2.0.0
MyBB 1.8.2 – ‘unset_globals()’ Function Bypass / Remote Code Execution
# Exploit Title: MyBB unset_globals($_POST);
FluxBB < 1.5.6 - SQL Injection
#!/usr/bin/env python
WordPress Plugin SP Client Document Manager 2.4.1 – SQL Injection
Vulnerability title: Multi SQL Injection in SP Client Document Manager plugin
WordPress Plugin Paid Memberships Pro 1.7.14.2 – Directory Traversal
# Exploit Title: Paid Memberships Pro 1.7.14.2 Path Traversal
Zoph 0.9.1 – Multiple Vulnerabilities
=============================================
WebsiteBaker 2.8.3 – Multiple Vulnerabilities
=============================================
ZTE ZXHN H108L – Authentication Bypass (2)
About the software
Proticaret E-Commerce Script 3.0 – SQL Injection (2)
Document Title:
PHPFox – Persistent Cross-Site Scripting
# Exploit Title: PHPFox XSS AdminCP