WordPress Theme Authentic – ‘download.php’ Arbitrary File Download
source: https://www.securityfocus.com/bid/69671/info
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
WordPress Theme Urban City – ‘download.php’ Arbitrary File Download
source: https://www.securityfocus.com/bid/69670/info
WordPress Plugin Spider Facebook – ‘facebook.php’ SQL Injection
source: https://www.securityfocus.com/bid/69675/info
PhpOnlineChat 3.0 – Cross-Site Scripting
# Exploit Title: [phponlinechat xss ]
WordPress Plugin Like Dislike Counter 1.2.3 – SQL Injection
#################################################################################################
LoadedCommerce7 – Systemic Query Factory
Title: LoadedCommerce7 Systemic Query Factory Vulnerability
Invision Power Board (IP.Board) 3.x – Cross-Site Request Forgery / Token Hjiacking
#Title: IP Board 3.x CSRF - Token hjiacking
MyBB User Social Networks Plugin 1.2 – Persistent Cross-Site Scripting
# Exploit Title: User Social Networks MyBB Plugin 1.2 - Cross Site Scripting
WordPress Plugin Premium Gallery Manager – Configuration Access
#Exploit Title : Wordpress Plugins Premium Gallery Manager Unauthenticated Configuration Access Vulnerability
vBulletin 4.0.x < 4.1.2 - 'search.php?cat' SQL Injection
# vBulletin 4.0.x => 4.1.2 AUTOMATIC SQL Injection exploit
Syslog LogAnalyzer 3.6.5 – Persistent Cross-Site Scripting
Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS
WordPress Plugin Huge-IT Image Gallery 1.0.1 – (Authenticated) SQL Injection
######################
ManageEngine EventLog Analyzer – Multiple Vulnerabilities (1)
Mogwai Security Advisory MSA-2014-01
ManageEngine Desktop Central – Arbitrary File Upload / Remote Code Execution
Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP
WordPress Plugin Slideshow Gallery 1.4.6 – Arbitrary File Upload
Summary: WordPress Slideshow Gallery plugin version 1.4.6 suffers from a remote shell upload vulnerability.
Arachni Web Application Scanner Web UI – Persistent Cross-Site Scripting
Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability
Mulitple WordPress Themes – ‘admin-ajax.php?img’ Arbitrary File Download
# WordPress CuckooTap Theme & eShop Arbitrary File Download
XRms – Blind SQL Injection / Command Execution
#######################
PhpWiki – Remote Command Execution
###############################################################
ActualAnalyzer Lite 2.81 – Command Execution
###############################
ManageEngine DeviceExpert 5.9 – User Credential Disclosure
>> User credential disclosure in ManageEngine DeviceExpert 5.9
Plogger 1.0-RC1 – (Authenticated) Arbitrary File Upload
#!/usr/bin/env python
WordPress Plugin ShortCode 0.2.3 – Local File Inclusion
#################################################################################################
WordPress Plugin WooCommerce Store Exporter 1.7.5 – Multiple Cross-Site Scripting Vulnerabilities
# Exploit Title: WooCommerce Store Exporter v1.7.5 Stored XSS
VTLS Virtua InfoStation.cgi – SQL Injection
=====[Alligator Security Team - Security Advisory]============================
ntopng 1.2.0 – Cross-Site Scripting Injection
ntopng 1.2.0 XSS injection using monitored network traffic
Joomla! Component spidervideoplayer – ‘theme’ SQL Injection
source: https://www.securityfocus.com/bid/69422/info
Innovaphone PBX Admin-GUI – Cross-Site Request Forgery
Title: Innovaphone PBX Admin-GUI CSRF
PHP Stock Management System 1.02 – Multiple Persistent Cross-Site Scripting Vulnerabilities
# Exploit Title: Multiple Persistent Cross Site Scripting Vulnerabilities
WordPress Plugin KenBurner Slider – ‘admin-ajax.php’ Arbitrary File Download
source: https://www.securityfocus.com/bid/69387/info
LiveWorld Multiple Products – Cross Site Scripting
LiveWorld Cross Site Scripting
MyAwards MyBB Module – Cross-Site Request Forgery
source: https://www.securityfocus.com/bid/69386/info
MyBB 1.8 Beta 3 – Multiple Vulnerabilities
# Title: MyBB 1.8 Beta 3 - Cross Site Scripting & SQL Injection
ArticleFR – ‘id’ SQL Injection
source: https://www.securityfocus.com/bid/69307/info
ManageEngine Password Manager Pro / ManageEngine IT360 – SQL Injection
source: https://www.securityfocus.com/bid/69303/info
WordPress Plugin WP Content Source Control – ‘download.php’ Directory Traversal
source: https://www.securityfocus.com/bid/69278/info
Tenda A5s Router 3.02.05_CN – Authentication Bypass
-----------------------------------------------------------------------
WordPress Plugin GB Gallery Slideshow – ‘/wp-admin/admin-ajax.php’ SQL Injection
source: https://www.securityfocus.com/bid/69181/info
Easy FTP Pro 4.2 iOS – Command Injection
Document Title:
PhotoSync Wifi & Bluetooth 1.0 – Local File Inclusion
Document Title:
VoipSwitch – ‘user.php’ Local File Inclusion
source: https://www.securityfocus.com/bid/69109/info
WordPress Plugin wpSS – ‘ss_handler.php’ SQL Injection
source: https://www.securityfocus.com/bid/69089/info
Feng Office – Persistent Cross-Site Scripting
# Affected software: Feng Office - URL: http://www.fengoffice.com/web/demo.php
Pro Chat Rooms 8.2.0 – Multiple Vulnerabilities
# Exploit Title: Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities
HybridAuth 2.2.2 – Remote Code Execution
######################################################################
FreeDisk 1.01 iOS – Multiple Vulnerabilities
Document Title:
Video WiFi Transfer 1.01 – Directory Traversal
Document Title: