webapps

Sentrifugo 3.2 – Persistent Cross-Site Scripting

# Exploit Title: Sentrifugo 3.2 - Persistent Cross-Site Scripting

Sentrifugo 3.2 – File Upload Restriction Bypass

# Exploit Title: Sentrifugo 3.2 - File Upload Restriction Bypass

PilusCart 1.4.1 – Local File Disclosure

# Exploit Title: PilusCart

Jobberbase 2.0 – ‘subscribe’ SQL Injection

#!/bin/bash

Jobberbase 2.0 CMS – ‘jobs-in’ SQL Injection

# Exploit Title: Jobberbase 2.0 CMS - 'jobs-in' SQL Injection

SQLiteManager 1.2.0 / 1.2.4 – Blind SQL Injection

Tableau – XML External Entity

# Exploit Title: Tableau XXE

openITCOCKPIT 3.6.1-2 – Cross-Site Request Forgery

# Exploit Title: openITCOCKPIT 3.6.1-2 - CSRF 2 RCE

WordPress Plugin UserPro 4.9.32 – Cross-Site Scripting

# Exploit Title: UserPro

WordPress Plugin Import Export WordPress Users 1.3.1 – CSV Injection

# Exploit Title: Wordpress Plugin Import Export WordPress Users

LSoft ListServ < 16.5-2018a - Cross-Site Scripting

# Exploit Title: LSoft ListServ < 16.5 - Cross-Site Scripting (XSS)

Nimble Streamer 3.0.2-2 < 3.5.4-9 - Directory Traversal

# Nimble Streamer 3.0.2-2 to 3.5.4-9 - Path Traversal

Nagios XI 5.6.5 – Remote Code Execution / Root Privilege Escalation

Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN – Arbitrary File Disclosure (Metasploit)

# Exploit Title: File disclosure in Pulse Secure SSL VPN (metasploit)

WordPress Plugin Add Mime Types 2.2.1 – Cross-Site Request Forgery

# Exploit Title: CSRF vulnerabilities in WP Add Mime Types Plugin

YouPHPTube 7.2 – ‘userCreate.json.php’ SQL Injection

# Exploit Title: YouPHPTube < 7.3 SQL Injection

Webmin 1.920 – Remote Code Execution

#!/bin/sh

Neo Billing 3.5 – Persistent Cross-Site Scripting

# Exploit Title: Neo Billing 3.5 - Stored Cross Site Scripting Vulnerability

Fortinet FortiOS 5.6.3 – 5.6.7 / FortiOS 6.0.0 – 6.0.4 – Credentials Disclosure

# Exploit Title: Fortinet FortiOS Leak file - Reading login/passwords in clear text.

Fortinet FortiOS 5.6.3 – 5.6.7 / FortiOS 6.0.0 – 6.0.4 – Credentials Disclosure (Metasploit)

# Exploit Title: Fortinet FortiOS Leak file - Reading login/passwords in clear text.

Kimai 2 – Persistent Cross-Site Scripting

# Exploit Title: Kimai 2- persistent cross-site scripting (XSS)

Web Wiz Forums 12.01 – ‘PF’ SQL Injection

# Exploit Title: Web Wiz Forums 12.01 - 'PF' SQL Injection

Integria IMS 5.0.86 – Arbitrary File Upload

# Exploit Title: Integria IMS 5.0.86 - Arbitrary File Upload

Joomla! component com_jsjobs 1.2.6 – Arbitrary File Deletion

# Exploit Title: Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion

EyesOfNetwork 5.1 – Authenticated Remote Command Execution

# Exploit Title: EyesOfNetwork 5.1 - Authenticated Remote Command Execution

ManageEngine opManager 12.3.150 – Authenticated Code Execution

#!/usr/bin/env python3

TortoiseSVN 1.12.1 – Remote Code Execution

Document Title:

WordPress Plugin Download Manager 2.5 – Cross-Site Request Forgery

# Exploit Title: CSRF vulnerabilities in WordPress Download Manager Plugin 2.5

D-Link DIR-600M – Authentication Bypass (Metasploit)

##

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 – ‘customfields.php’ SQL Injection

#Exploit Title: Joomla! component com_jsjobs - 'customfields.php' SQL Injection

SugarCRM Enterprise 9.0.0 – Cross-Site Scripting

# Exploit Title: 0Day UnauthenticatedXSS SugarCRM Enterprise

Mitsubishi Electric smartRTU / INEA ME-RTU – Unauthenticated OS Command Injection Bind Shell

#!/usr/bin/python

Mitsubishi Electric smartRTU / INEA ME-RTU – Unauthenticated Configuration Download

#!/usr/bin/python

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 – ‘cities.php’ SQL Injection

#Exploit Title: Joomla! component com_jsjobs - SQL Injection

osTicket 1.12 – Persistent Cross-Site Scripting

# Exploit Title: osTicket-v1.12 Stored XSS

osTicket 1.12 – Formula Injection

# Exploit Title: osTicket-v1.12 Formula Injection

osTicket 1.12 – Persistent Cross-Site Scripting via File Upload

# Exploit Title: osTicket-v1.12 Stored XSS via File Upload

Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 – ‘ticket.php’ Arbitrary File Deletion

#Exploit Title: Joomla! component com_jssupportticket - Authenticated Arbitrary File Deletion

Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 – ‘ticketreply.php’ SQL Injection

#Exploit Title: Joomla! component com_jssupportticket - Authenticated SQL Injection

UNA 10.0.0 RC1 – ‘polyglot.php’ Persistent Cross-Site Scripting

# Exploit Title: [UNA - 10.0.0-RC1 stored XSS vuln.]

Cisco Adaptive Security Appliance – Path Traversal (Metasploit)

require 'msf/core'

BSI Advance Hotel Booking System 2.0 – ‘booking_details.php Persistent Cross-Site Scripting

# Exploit Title:BSI Advance Hotel Booking System Persistent XSS

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – SQL Injection

#Exploit Title: Joomla! component com_jssupportticket - SQL Injection

Adive Framework 2.0.7 – Cross-Site Request Forgery

# Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery (CSRF)

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – Arbitrary File Download

#Exploit Title: Joomla! component com_jssupportticket - Arbitrary File Download

Aptana Jaxer 1.0.3.4547 – Local File inclusion

# Exploit Title: Aptana Jaxer Remote Local File inclusion

Daily Expense Manager 1.0 – Cross-Site Request Forgery (Delete Income)

# Exploit Title: Daily Expense Manager - CSRF (Delete Income)

Open-School 3.0 / Community Edition 2.3 – Cross-Site Scripting

# Exploit Title: [title]

WordPress Plugin JoomSport 3.3 – SQL Injection

# Exploit Title: JoomSport 3.3 – for Sports - SQL injection

1CRM On-Premise Software 8.5.7 – Persistent Cross-Site Scripting

////////////////////////////////////////////////////////////////////////////////////