webapps

Tiki Wiki CMS Groupware 8.3 – ‘Unserialize()’ PHP Code Execution (Metasploit)

##

Flogr – ‘tag’ Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/54354/info

MGB – Multiple Cross-Site Scripting / SQL Injections

source: https://www.securityfocus.com/bid/54348/info

WebsitePanel – ‘ReturnUrl’ Open Redirection

source: https://www.securityfocus.com/bid/54346/info

sflog! – ‘section’ Local File Inclusion

source: https://www.securityfocus.com/bid/54334/info

WordPress Plugin Knews Multilingual Newsletters – Cross-Site Scripting

source: https://www.securityfocus.com/bid/54330/info

WordPress Plugin church_admin – ‘id’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54329/info

WordPress Plugin SocialFit – ‘msg’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54320/info

Webmatic 3.1.1 – Blind SQL Injection

Advisory ID: HTB23096

Event Script PHP 1.1 CMS – Multiple Vulnerabilities

Title:

sflog! 1.00 – Multiple Vulnerabilities

:::::::-. ... ::::::. :::.

CLscript CMS 3.0 – Multiple Vulnerabilities

Title:

Freeside SelfService CGI/API 2.3.3 – Multiple Vulnerabilities

Title:

Guestbook Scripts PHP 1.5 – Multiple Vulnerabilities

Title:

WordPress Plugin PHPFreeChat – ‘url’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54332/info

Classified Ads Script PHP – ‘admin.php’ Multiple SQL Injections

source: https://www.securityfocus.com/bid/54299/info

Webify Link Directory – SQL Injection

# Exploit Title: Webify Link Directory / SQL Injection

Tiki Wiki CMS Groupware 8.3 – ‘Unserialize()’ PHP Code Execution

WordPress Plugin MoodThingy Widget 0.8.7 – Blind SQL Injection

# Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection

phpMyBackupPro 2.2 – Local File Inclusion

:::::::-. ... ::::::. :::.

CLscript Classified Script 3.0 – SQL Injection

# Exploit Title: CLscript - Classified Script 3.0 / SQL Injection

gpEasy CMS Minishop 1.5 Plugin – Persistent Cross-Site Scripting

# Exploit Title: gp easy CMS Minishop 1.5 plugin persistent XSS

WordPress Plugin custom tables – ‘key’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54326/info

PHP MBB – Cross-Site Scripting / SQL Injection

source: https://www.securityfocus.com/bid/54271/info

Getsimple CMS Items Manager Plugin – ‘PHP.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/54255/info

WANGKONGBAO CNS-1000 UTM IPS-FW – Directory Traversal (Metasploit)

# Exploit Title: WANGKONGBAO CNS-1000 and 1100 Network Security Platform UTM Directory Traversal

Microsoft IIS – Short File/Folder Name Disclosure

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19525.zip

WordPress Plugin Backup 2.0.1 – Information Disclosure

# Exploit Title: WordPress Backup plugin exposes site data

WordPress Plugin Paid Business Listings 1.0.2 – Blind SQL Injection

# Exploit Title: WordPress Paid Business Listings v1.0.2 Blind SQL Injection

specview 2.5 build 853 – Directory Traversal

#######################################################################

phpmoneybooks 1.03 – Persistent Cross-Site Scripting

# Exploit Title: phpmoneybooks 1.03 Stored XSS

SWFupload – ‘movieName’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54245/info

LIOOSYS CMS – SQL Injection / Information Disclosure

source: https://www.securityfocus.com/bid/54239/info

JAKCMS PRO 2.2.6 – ‘uploader.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/54238/info

Mobile USB Drive HD – Multiple Local File Inclusion / Arbitrary File Upload Vulnerabilities

source: https://www.securityfocus.com/bid/60847/info

TEMENOS T24 – Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/54235/info

PHP-Fusion Advanced MP3 Player Infusion – ‘upload.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/54228/info

Openfire Server 3.6.0a – Admin Console Authentication Bypass (Metasploit)

##

webERP 4.08.1 – Local/Remote File Inclusion

:::::::-. ... ::::::. :::.

Zend Framework < 2.0.0 beta4 < 1.12 RC1 < 1.11.11 - Local File Disclosure

SEC Consult Vulnerability Lab Security Advisory < 20120626-0 >

symantec Web gateway 5.0.2.8 – Multiple Vulnerabilities

Software: Symantec Web Gateway

Schoolhos CMS – HTML Injection

source: https://www.securityfocus.com/bid/54204/info

DigPHP – ‘dig.php’ Script Remote File Disclosure

source: https://www.securityfocus.com/bid/54207/info

SugarCRM CE 6.3.1 – ‘Unserialize()’ PHP Code Execution (Metasploit)

##

WordPress Plugin Website FAQ 1.0 – SQL Injection

# Exploit Title: WordPress Website FAQ Plugin v1.0 SQL Injection

WordPress Plugin Fancy Gallery 1.2.4 – Arbitrary File Upload

##################################################

Parodia 6.8 – ’employer-profile.asp’ SQL Injection

# Exploit Title: Parodia 6.8 and early SQL injection

Umapresence – Local File Inclusion / Arbitrary File Deletion

source: https://www.securityfocus.com/bid/54194/info

FCKEditor Core – ‘Editor ‘spellchecker.php’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/54188/info

Drupal Module Drag & Drop Gallery 6.x-1.5 – ‘upload.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/54179/info