webapps

Swagger UI 4.1.3 – User Interface (UI) Misrepresentation of Critical Information

# Exploit Title: Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information

Bang Resto v1.0 – ‘Multiple’ SQL Injection

# Exploit Title: Bang Resto v1.0 - 'Multiple' SQL Injection

Bang Resto v1.0 – Stored Cross-Site Scripting (XSS)

# Exploit Title: Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)

Lilac-Reloaded for Nagios 2.0.8 – Remote Code Execution (RCE)

#!/usr/bin/env python

Serendipity 2.4.0 – Cross-Site Scripting (XSS)

Exploit Title: Serendipity 2.4.0 - Cross-Site Scripting (XSS)

Serendipity 2.4.0 – Remote Code Execution (RCE) (Authenticated)

Exploit Title: Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated)

Sielco PolyEco Digital FM Transmitter 2.0.6 – Account Takeover / Lockout / EoP

## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP

Sielco PolyEco Digital FM Transmitter 2.0.6 – Unauthenticated Information Disclosure

## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure

Sielco PolyEco Digital FM Transmitter 2.0.6 – Radio Data System POST Manipulation

## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation

Sielco PolyEco Digital FM Transmitter 2.0.6 – Authorization Bypass Factory Reset

## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset

Sielco PolyEco Digital FM Transmitter 2.0.6 – Authentication Bypass Exploit

#!/usr/bin/env python3

Sielco Analog FM Transmitter 2.12 – Improper Access Control Change Admin Password

Sielco Analog FM Transmitter 2.12 – Cross-Site Request Forgery

CSRF Add Admin:

Sielco Analog FM Transmitter 2.12 – ‘id’ Cookie Brute Force Session Hijacking

## Exploit Title: Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking

InnovaStudio WYSIWYG Editor 5.4 – Unrestricted File Upload / Directory Traversal

# Exploit Title: InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal

Bludit 4.0.0-rc-2 – Account takeover

## Exploit Title: Bludit 4.0.0-rc-2 - Account takeover

Online Computer and Laptop Store 1.0 – Remote Code Execution (RCE)

#!/usr/bin/env python3

BrainyCP V1.0 – Remote Code Execution

# Exploit Title: BrainyCP V1.0 - Remote Code Execution

Roxy Fileman 1.4.5 – Arbitrary File Upload

# Exploit Title: Roxy Fileman 1.4.5 - Arbitrary File Upload

ever gauzy v0.281.9 – JWT weak HMAC secret

## Exploit Title: ever gauzy v0.281.9 - JWT weak HMAC secret

dotclear 2.25.3 – Remote Code Execution (RCE) (Authenticated)

Exploit Title: dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)

Pentaho BA Server EE 9.3.0.0-428 – Remote Code Execution (RCE) (Unauthenticated)

# Exploit Title: Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

WebsiteBaker v2.13.3 – Cross-Site Scripting (XSS)

Exploit Title: WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)

ZCBS/ZBBS/ZPBS v4.14k – Reflected Cross-Site Scripting (XSS)

# Exploit Title: ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)

X2CRM v6.6/6.9 – Reflected Cross-Site Scripting (XSS) (Authenticated)

# Exploit Title: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 – Stored Cross-Site Scripting (XSS) (Authenticated)

# Exploit Title: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

Online-Pizza-Ordering -1.0 – Remote Code Execution (RCE)

## Exploit Title: Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)

Palo Alto Cortex XSOAR 6.5.0 – Stored Cross-Site Scripting (XSS)

# Exploit Title: Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)

Symantec Messaging Gateway 10.7.4 – Stored Cross-Site Scripting (XSS)

# Exploit Title: Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)

Suprema BioStar 2 v2.8.16 – SQL Injection

# Exploit Title: Suprema BioStar 2 v2.8.16 - SQL Injection

Goanywhere Encryption helper 7.1.1 – Remote Code Execution (RCE)

// Exploit Title: Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)

Medicine Tracker System v1.0 – Sql Injection

# Exploit Title: Medicine Tracker System v1.0 - Sql Injection

Online Appointment System V1.0 – Cross-Site Scripting (XSS)

# Exploit Title: Online Appointment System V1.0 - Cross-Site Scripting (XSS)

ENTAB ERP 1.0 – Username PII leak

Exploit Title: ENTAB ERP 1.0 - Username PII leak

Joomla! v4.2.8 – Unauthenticated information disclosure

#!/usr/bin/env ruby

Restaurant Management System 1.0 – SQL Injection

# Exploit Title: Restaurant Management System 1.0 - SQL Injection

Icinga Web 2.10 – Arbitrary File Disclosure

#!/usr/bin/env python3

Adobe Connect 11.4.5 – Local File Disclosure

# Title: Adobe Connect 11.4.5 - Local File Disclosure

Altenergy Power Control Software C1.2.5 – OS command injection

# Exploit Title: Altenergy Power Control Software C1.2.5 - OS command injection

Snitz Forum v1.0 – Blind SQL Injection

# Exploit Title: Snitz Forum v1.0 - Blind SQL Injection

Rukovoditel 3.3.1 – Remote Code Execution (RCE)

Exploit Title: Rukovoditel 3.3.1 - Remote Code Execution (RCE)

ChurchCRM 4.5.1 – Authenticated SQL Injection

# Exploit Title: ChurchCRM 4.5.1 - Authenticated SQL Injection

NotrinosERP 0.7 – Authenticated Blind SQL Injection

# Exploit Title: NotrinosERP 0.7 - Authenticated Blind SQL Injection

MAC 1200R – Directory Traversal

# Exploit Title: MAC 1200R - Directory Traversal

craftercms 4.x.x – CORS

## Exploit Title: craftercms 4.x.x - CORS

Purchase Order Management-1.0 – Local File Inclusion

## Title: Purchase Order Management-1.0 - Local File Inclusion

Mitel MiCollab AWV 8.1.2.4 and 9.1.3 – Directory Traversal and LFI

# Exploit Title: Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI

Agilebio Lab Collector Electronic Lab Notebook v4.234 – Remote Code Execution (RCE)

# Exploit Title: Agilebio Lab Collector Electronic Lab Notebook v4.234 - Remote Code Execution (RCE)

ChurchCRM v4.5.3-121fcc1 – SQL Injection

## Exploit Title: ChurchCRM v4.5.3-121fcc1 - SQL Injection

flatnux 2021-03.25 – Remote Code Execution (Authenticated)

# Exploit Title: flatnux-2021-03.25 - Remote Code Execution (Authenticated)