webapps

Nagios XI 5.6.1 – SQL injection

# Exploit Title: Nagiosxi username sql injection

Horde Webmail 5.2.22 – Multiple Vulnerabilities

# Title: Horde Webmail - XSS + CSRF to SQLi, RCE, Stealing Emails

Carel pCOWeb < B1.2.1 - Credentials Disclosure

# Exploit Title: Carel pCOWeb - Unprotected Storage of Credentials

Carel pCOWeb < B1.2.1 - Cross-Site Scripting

# Exploit Title: Carel pCOWeb - Stored XSS

AUO Solar Data Recorder < 1.3.0 - 'addr' Cross-Site Scripting

# Exploit Title: AUO Solar Data Recorder - Stored XSS

Zoho ManageEngine ServiceDesk Plus 9.3 – Cross-Site Scripting

# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting

Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions

# Exploit Title: Zoho ManageEngine ServiceDesk Plus < 10.5 Incorrect Access Control

Brocade Network Advisor 14.4.1 – Unauthenticated Remote Code Execution

Exploit Title: Brocade Network Advisor - Unauthenticated Remote Code Execution

WordPress Plugin WPGraphQL 0.2.3 – Multiple Vulnerabilities

#!/usr/bin/env python

Oracle CTI Web Service – ‘EBS_ASSET_HISTORY_OPERATIONS’ XML Entity Injection

# Exploit Title: Oracle CTI Web Service XML Entity Exp.

TP-LINK TL-WR840N v5 00000005 – Cross-Site Scripting

# Exploit Title: TL-WR840N v5 00000005

Moodle Jmol Filter 6.1 – Directory Traversal / Cross-Site Scripting

# Exploit Title: Moodle filter_jmol multiple vulnerabilities (Directory Traversal and XSS)

eLabFTW 1.8.5 – Arbitrary File Upload / Remote Code Execution

# Exploit Title : eLabFTW 1.8.5 'EntityController' Arbitrary File Upload / RCE

Interspire Email Marketer 6.20 – ‘surveys_submit.php’ Remote Code Execution

# Exploit Title: Interspire Email Marketer 6.20 - Remote Code Execution

DeepSound 1.0.4 – SQL Injection

===========================================================================================

Legrand BTicino Driver Manager F454 1.0.51 – Cross-Site Request Forgery / Cross-Site Scripting

CommSy 8.6.5 – SQL injection

Title:

PasteShr 1.6 – Multiple SQL Injection

===========================================================================================

Schneider Electric U.Motion Builder 1.3.4 – ‘track_import_export.php object_id’ Unauthenticated Command Injection

RCE Security Advisory

D-Link DWL-2600AP – Multiple OS Command Injection

Document Title:

Sales ERP 8.1 – Multiple SQL Injection

===========================================================================================

OpenProject 5.0.0 – 8.3.1 – SQL Injection

SEC Consult Vulnerability Lab Security Advisory < 20190510-0 >

XOOPS 2.5.9 – SQL Injection

[+] Sql Injection on XOOPS CMS v.2.5.9

SOCA Access Control System 180612 – Cross-Site Request Forgery (Add Admin)

SOCA Access Control System 180612 CSRF Add Admin Exploit

SOCA Access Control System 180612 – SQL Injection

SOCA Access Control System 180612 SQL Injection And Authentication Bypass

SOCA Access Control System 180612 – Information Disclosure

SOCA Access Control System 180612 Information Disclosure

CyberArk Enterprise Password Vault 10.7 – XML External Entity Injection

# Exploit Title: CyberArk XML External Entity (XXE) Injection in SAML

RICOH SP 4520DN Printer – HTML Injection

# Exploit Title: RICOH SP 4520DN Printer - HTML Injection

RICOH SP 4510DN Printer – HTML Injection

# Exploit Title: RICOH SP 4510DN Printer - HTML Injection

dotCMS 5.1.1 – HTML Injection

# Exploit Title: dotCMS 5.1.1 - HTML Injection

Cortex Unshortenlink Analyzer < 1.1 - Server-Side Request Forgery

# Exploit Title: Cortex Unshortenlink Analyzer < 1.1 - Server-Side Request Forgery

Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Cross-Site Scripting

[+] Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Multiple Cross-Site Scripting

NetNumber Titan ENUM/DNS/NP 7.9.1 – Path Traversal / Authorization Bypass

# Exploit Title: NetNumber Titan ENUM/DNS/NP - Path Traversal - Authorization Bypass

Prinect Archive System 2015 Release 2.6 – Cross-Site Scripting

Details

microASP (Portal+) CMS – ‘pagina.phtml?explode_tree’ SQL Injection

[+] Sql Injection on microASP (Portal+) CMS

PHPads 2.0 – ‘click.php3?bannerID’ SQL Injection

[+] Sql Injection on PHPads Version 2.0 based on Pixelledads 1.0 by Nile Flores

ReadyAPI 2.5.0 / 2.6.0 – Remote Code Execution

Create a new xpl

WordPress Plugin Social Warfare < 3.5.3 - Remote Code Execution

# Title: RCE in Social Warfare Plugin Wordpress (

Zotonic < 0.47.0 mod_admin - Cross-Site Scripting

# Exploit Title: Zotonic

Instagram Auto Follow – Authentication Bypass

# Exploit Title: Instagram Auto Follow - Autobot Instagram - Authentication Bypass

Crestron AM/Barco wePresent WiPG/Extron ShareLink/Teq AV IT/SHARP PN-L703WA/Optoma WPS-Pro/Blackbox HD WPS/InFocus LiteShow – Remote Command Injection

##

CentOS Web Panel 0.9.8.793 (Free) / v0.9.8.753 (Pro) / 0.9.8.807 (Pro) – Domain Field (Add DNS Zone) Cross-Site Scripting

# Exploit Title: CentOS Web Panel - Domain Field (Add DNS Zone) Cross-Site Scripting Vulnerability

Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 – Remote Code Execution

#!/usr/bin/python

Agent Tesla Botnet – Information Disclosure

################################

Hyvikk Fleet Manager – Shell Upload

========================================================================================

Joomla! Component JiFile 2.3.1 – Arbitrary File Download

# Exploit Title: Joomla! Component JiFile 2.3.1 - Arbitrary File Download

Domoticz 4.10577 – Unauthenticated Remote Command Execution

#!/usr/bin/env python

Spring Cloud Config 2.1.x – Path Traversal (Metasploit)

##

HumHub 1.3.12 – Cross-Site Scripting

# Exploit Title: HumHub 1.3.12 - Cross-Site Scripting

Intelbras IWR 3000N 1.5.0 – Cross-Site Request Forgery

IWR 3000N - CSRF on authenticated administrator