webapps

webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。

BitDefender GravityZone 5.1.5.386 – Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory < 20140716-3 >

2014-07-16 SEC Consult webapps

Shopizer 1.1.5 – Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----

2014-07-14 SEC Consult webapps

WEBMIS CMS – Arbitrary File Upload

source: https://www.securityfocus.com/bid/68658/info

2014-07-14 Jagriti Sahu webapps

WordPress Plugin CopySafe PDF Protection – Arbitrary File Upload

source: https://www.securityfocus.com/bid/68656/info

2014-07-14 Jagriti Sahu webapps

WordPress Plugin DZS-VideoGallery – Cross-Site Scripting / Command Injection

source: https://www.securityfocus.com/bid/68525/info

2014-07-13 MustLive webapps

Aerohive HiveOS 5.1r5 < 6.1r5 - Multiple Vulnerabilities

# Exploit Title: Aerohive HiveOS XSS and (limited) LFI

2014-07-12 DearBytes webapps

Infoblox 6.8.2.11 – OS Command Injection

Product: Network Automation, licensed as:

2014-07-10 Nate Kettlewell webapps

C99Shell (Web Shell) – ‘c99.php’ Authentication Bypass

# Exploit Title: C99 Shell Authentication Bypass via Backdoor

2014-07-10 Mandat0ry webapps

WeBid – Multiple Cross-Site Scripting / LDAP Injection Vulnerabilities

source: https://www.securityfocus.com/bid/68519/info

2014-07-10 Govind Singh webapps

WordPress Plugin BSK PDF Manager – ‘/wp-admin/admin.php’ Multiple SQL Injections

source: https://www.securityfocus.com/bid/68488/info

2014-07-09 Claudio Viviani webapps

Dolibarr ERP/CRM 3.5.3 – Multiple Vulnerabilities

Vulnerability Name: SQL injection

2014-07-08 Deepak Rathore webapps

Photo Org WonderApplications 8.3 iOS – Local File Inclusion

Document Title:

2014-07-07 Vulnerability-Lab webapps

Netgear WNR1000v3 – Password Recovery Credential Disclosure (Metasploit)

#

2014-07-07 c1ph04 webapps

xClassified – ‘ads.php’ SQL Injection

source: https://www.securityfocus.com/bid/68438/info

2014-07-07 Lazmania61 webapps

AtomCMS – SQL Injection / Arbitrary File Upload

source: https://www.securityfocus.com/bid/68437/info

2014-07-07 Jagriti Sahu webapps

Frog CMS 0.9.5 – Arbitrary File Upload

Exploit Title: Arbitrary File Upload in Frog CMS 0.9.5

2014-07-06 Javid Hussain webapps

Kerio Control 8.3.1 – Blind SQL Injection

Document Title:

2014-07-02 Khashayar Fereidani webapps

Zurmo CRM – Persistent Cross-Site Scripting

# Affected software: Zurmo CRM

2014-07-02 Provensec webapps

IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----

2014-07-01 SEC Consult webapps

Endeca Latitude 2.2.2 – Cross-Site Request Forgery

Advisory: Endeca Latitude Cross-Site Request Forgery

2014-06-27 RedTeam Pentesting webapps

WordPress Plugin Simple Share Buttons Adder 4.4 – Multiple Vulnerabilities

Details

2014-06-27 dxw webapps

Python CGIHTTPServer – Encoded Directory Traversal

Advisory: Python CGIHTTPServer File Disclosure and Potential Code

2014-06-27 RedTeam Pentesting webapps

Mailspect Control Panel 4.0.5 – Multiple Vulnerabilities

Document Title:

2014-06-27 Onur Alanbel (BGA) webapps

Lunar CMS 3.3 – Remote Command Execution

#!/usr/bin/env python

2014-06-25 LiquidWorm webapps

Thomson TWG87OUIR – POST Password Cross-Site Request Forgery

#Author: nopesled

2014-06-25 nopesled webapps

Multiple WordPress Plugins (TimThumb 2.8.13 / WordThumb 1.07) – ‘WebShot’ Remote Code Execution

######################################################################

2014-06-24 @u0x webapps

ZeusCart – ‘prodid’ SQL Injection

source: https://www.securityfocus.com/bid/68182/info

2014-06-24 Kenny Mathis webapps

ZeroCMS 1.0 – ‘zero_transact_article.php’ SQL Injection

ZeroCMS v1.0 SQL Injection Vulnerability (zero_transact_article.php article_id POST parameter)

2014-06-23 Filippos Mastrogiannis webapps

Lunar CMS 3.3 – Cross-Site Request Forgery / Persistent Cross-Site Scripting

CSRF Add Admin

2014-06-21 LiquidWorm webapps

D-Link DSL-2760U-E1 – Persistent Cross-Site Scripting

#!/bin/bash

2014-06-21 Yuval tisf Nativ webapps

web2Project 3.1 – Multiple Vulnerabilities

Advisory ID: HTB23213

2014-06-19 High-Tech Bridge SA webapps

Cacti Superlinks Plugin 1.4-2 – SQL Injection

$$$$$$\ $$\ $$\ $$$$$$\

2014-06-18 Napsterakos webapps

ZTE WXV10 W300 – Multiple Vulnerabilities

# Exploit Title: ZTE WXV10 W300 Multiple Vulnerabilities

2014-06-18 Osanda Malith Jayathissa webapps

Motorola SBG901 Wireless Modem – Cross-Site Request Forgery

Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability

2014-06-17 Blessen Thomas webapps

ZeroCMS 1.0 – ‘zero_transact_user.php’ Handling Privilege Escalation

import sys,getopt,cookielib,urllib2,urllib

2014-06-13 Tiago Carvalho webapps

Yealink VoIP Phone SIP-T38G – Local File Inclusion

Title: Yealink VoIP Phone SIP-T38G Local File Inclusion

2014-06-13 Mr.Un1k0d3r webapps

Plesk 10.4.4/11.0.9 – SSO XML External Entity / Cross-Site Scripting Injection

# Exploit Title: Plesk SSO XXE injection (Old bug) Exploit #

2014-06-13 BLacK ZeRo webapps

Yealink VoIP Phones – ‘/servlet’ HTTP Response Splitting

source: https://www.securityfocus.com/bid/68022/info

2014-06-12 Jesus Oquendo webapps

SHOUTcast DNAS 2.2.1 – Persistent Cross-Site Scripting

# Exploit Title: SHOUTcast DNAS v2.2.1 win32 XSS\HTML Injection in Song history (other version may be also affected)

2014-06-11 rob222 webapps

ZeroCMS 1.0 – ‘zero_view_article.php’ SQL Injection

ZeroCMS 1.0 (article_id) SQL Injection Vulnerability

2014-06-10 LiquidWorm webapps

WordPress Plugin Featured Comments – Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/67955/info

2014-06-10 Tom Adams webapps

WordPress Plugin JW Player for Flash & HTML5 Video – Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/67954/info

2014-06-10 Tom Adams webapps

DevExpress ASPxFileManager 10.2 < 13.2.8 - Directory Traversal

Advisory: Directory Traversal in DevExpress ASP.NET File Manager

2014-06-09 RedTeam Pentesting webapps

WebTitan 4.01 (Build 68) – Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory < 20140606-0 >

2014-06-09 SEC Consult webapps

eFront 3.6.14.4 – ‘surname’ Persistent Cross-Site Scripting

# Exploit Title: Persistent Cross Site Scripting Vulnerability in eFront

2014-06-09 shyamkumar somana webapps

WordPress Theme Elegance – ‘/elegance/lib/scripts/dl-skin.php’ Local File Disclosure

source: https://www.securityfocus.com/bid/67935/info

2014-06-08 Felipe Andrian Peixoto webapps

WordPress Theme Infocus – ‘/infocus/lib/scripts/dl-skin.php’ Local File Disclosure

source: https://www.securityfocus.com/bid/67934/info

2014-06-08 Felipe Andrian Peixoto webapps

Madness Pro 1.14 – SQL Injection

#!/usr/bin/env python2

2014-06-06 bwall webapps

Madness Pro 1.14 – Persistent Cross-Site Scripting

#!/usr/bin/env python2

2014-06-06 bwall webapps

IPSwitch IMail Server WEB client 12.4 – Persistent Cross-Site Scripting

# Exploit Title: IPSwitch IMail Server WEB client 12.4 persistent XSS

2014-06-03 Peru webapps