webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
vTiger CRM 5.1.0 – Local File Inclusion
# Exploit Title: VTiger CRM
Mega File Manager – File Download
# Exploit Title: [MegaFileManager FileDownload Vulnerability
Waylu CMS – ‘/products_xx.php’ SQL Injection / HTML Injection
source: https://www.securityfocus.com/bid/53202/info
Anchor CMS 0.6-14-ga85d0a0 – ‘id’ Multiple HTML Injection Vulnerabilities
source: https://www.securityfocus.com/bid/53181/info
Pendulab ChatBlazer 8.5 – ‘Username’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/53168/info
XOOPS 2.5.4 – Multiple Cross-Site Scripting Vulnerabilities
Advisory ID: HTB23062
newscoop 3.5.3 – Multiple Vulnerabilities
Advisory ID: HTB23084
Scrutinizer NetFlow & sFlow Analyzer – Multiple Vulnerabilities
Trustwave SpiderLabs Security Advisory TWSL2012-008:
ownCloud 3.0.0 – ‘index.php?redirect_url’ Arbitrary Site Redirect
source: https://www.securityfocus.com/bid/53145/info
XOOPS 2.5.4 – ‘/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php’ Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/53143/info
XOOPS 2.5.4 – ‘/modules/pm/pmlite.php?to_userid’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/53143/info
Acuity CMS 2.6.2 – ‘Username’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/53048/info
Joomla! Component JA T3 Framework – Directory Traversal
source: https://www.securityfocus.com/bid/53039/info
TeamPass 2.1.5 – ‘login’ HTML Injection
source: https://www.securityfocus.com/bid/53038/info
WordPress Plugin Yahoo Answer – Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/53037/info
Joomla! Plugin Beatz 1.1 – Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/53030/info
Bioly 1.3 – ‘/index.php’ Cross-Site Scripting / SQL Injection
source: https://www.securityfocus.com/bid/53018/info
Seditio CMS 165 – ‘plug.php’ SQL Injection
source: https://www.securityfocus.com/bid/53036/info
ManageEngine Support Center Plus 7903 – Multiple Vulnerabilities
_______ _______ _______ __
MediaXxx Adult Video / Media Script – SQL Injection
# Exploit Title: MediaXxx Adult Video / Media Script SQL Injection
NetworX CMS – Cross-Site Request Forgery (Add Admin)
# Exploit Title: NetworX CMS - CSRF Add Admin
Joomla! Component com_ponygallery – SQL Injection
##################################################
Ushahidi 2.2 – Multiple Vulnerabilities
# Exploit Title: Ushahidi 2.2 Multiple Vulnerabilites
Invision Power Board 3.3.0 – Local File Inclusion
[waraxe-2012-SA#086] - Local File Inclusion in Invision Power Board 3.3.0
Munin 2.0~rc4-1 – Remote Command Injection
source: https://www.securityfocus.com/bid/53032/info
SoftwareDEP Classified Script 2.5 – SQL Injection (2)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
WordPress Plugin All-in-One Event Calendar 1.4 – ‘agenda-widget.php’ Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/52986/info
WordPress Plugin All-in-One Event Calendar 1.4 – ‘save_successful.php?msg’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/52986/info
WordPress Plugin All-in-One Event Calendar 1.4 – ‘box_publish_button.php?button_value’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/52986/info
WordPress Plugin All-in-One Event Calendar 1.4 – ‘agenda-widget-form.php?title’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/52986/info
BGS CMS 2.2.1 – Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
source: https://www.securityfocus.com/bid/52983/info
Matterdaddy Market 1.1 – ‘cat_name’ Multiple SQL Injections
source: https://www.securityfocus.com/bid/52970/info
Joomla! Component com_bearleague – SQL Injection
##################################################
Joomla! Component Estate Agent – SQL Injection
##################################################
Dolibarr ERP/CRM < 3.2.0 / < 3.1.1 - OS Command Injection
Dolibarr ERP & CRM OS Command Injection
CitrusDB 2.4.1 – Local File Inclusion / SQL Injection
source: https://www.securityfocus.com/bid/52946/info
ZTE – Change Admin Password
# Exploit Title: ZTE Change admin password
Utopia News Pro 1.4.0 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: Utopia News Pro 1.4.0
w-CMS 2.0.1 – Multiple Vulnerabilities
+----------------------------------------------------------------------+
WordPress Plugin Uploadify Integration 0.9.6 – Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/52944/info
WordPress Plugin TagGator – ‘tagid’ SQL Injection
source: https://www.securityfocus.com/bid/52908/info
GENU CMS – SQL Injection
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Hotel Booking Portal – SQL Injection
'Hotel Booking Portal' SQL Injection (CVE-2012-1672)
phpPaleo – Local File Inclusion
'phpPaleo' Local File Inclusion (CVE-2012-1671)