webapps

Joomla! Component ARI Quiz 3.7.4 – SQL Injection

# Exploit Title: Joomla! Component ARI Quiz 3.7.4 - SQL Injection

Veeam ONE Reporter 9.5.0.3201 – Persistent Cross-site Scripting (Add/Edit Widget)

# Exploit Title: Veeam ONE Reporter - Stored Cross-site Scripting (Add/Edit Widget)

Veeam ONE Reporter 9.5.0.3201 – Persistent Cross-Site Scripting

# Exploit Title: Veeam ONE Reporter - Stored Cross-site Scripting (Stored XSS)

Veeam ONE Reporter 9.5.0.3201 – Multiple Cross-Site Request Forgery

# Exploit Title: Veeam ONE Reporter - Cross-Site Request Forgery (All Actions/Methods)

Netgear DGN2200 / DGND3700 – Admin Password Disclosure

#/bin/bash

Apache Pluto 3.0.0 / 3.0.1 – Persistent Cross-Site Scripting

Exploit Title: Stored XSS

osTicket 1.11 – Cross-Site Scripting / Local File Inclusion

# Exploit Title: osTicket v1.11 - Cross-Site Scripting to Local File

JioFi 4G M2S 1.0.2 – ‘mask’ Cross-Site Scripting

# Exploit Title: cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST p...

UliCMS 2019.2 / 2019.1 – Multiple Cross-Site Scripting

# Exploit Title: UliCMS - 2019.2 , 2019.1 - Multiple Cross-Site Scripting

Msvod 10 – Cross-Site Request Forgery (Change User Information)

# Exploit Title: Msvod v10 has a CSRF vulnerability to change user information

74CMS 5.0.1 – Cross-Site Request Forgery (Add New Admin User)

# Exploit Title: 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user

WordPress Plugin Contact Form Builder 1.0.67 – Cross-Site Request Forgery / Local File Inclusion

# Exploit Title: Contact Form Builder [CSRF → LFI]

Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 – XML External Entity Injection

# Exploit Title: XXE in Oracle Business Intelligence and XML Publisher

Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 – Directory Traversal

# Exploit Title: Directory traversal in Oracle Business Intelligence

Joomla! Core 1.5.0 – 3.9.4 – Directory Traversal / Authenticated Arbitrary File Deletion

# Exploit Title: Joomla Core (1.5.0 through 3.9.4) - Directory Traversal && Authenticated Arbitrary File Deletion

Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 – Login Page Cross-Site Scripting

# Exploit Title: Reflected XSS on Zyxel login pages

DirectAdmin 1.561 – Multiple Vulnerabilities

# Title: DirectAdmin Multiple Vulnerabilities to Takeover the Server

ATutor < 2.2.4 - 'file_manager' Remote Code Execution (Metasploit)

##

D-Link DI-524 V2.06RU – Multiple Cross-Site Scripting

# Exploit Title: Multiple Stored and Reflected XSS vulnerabilities in D-Link DI-524

Dell KACE Systems Management Appliance (K1000) 6.4.120756 – Unauthenticated Remote Code Execution

#!/usr/bin/python

Ashop Shopping Cart Software – ‘bannedcustomers.php?blacklistitemid’ SQL Injection

# Exploit Title: Ashop Shopping Cart Software - SQL Injection

ManageEngine ServiceDesk Plus 9.3 – User Enumeration

# Exploit Title: ManageEngine ServiceDesk Plus - 9.3 User enumeration vulnerability

WordPress Plugin Limit Login Attempts Reloaded 2.7.4 – Login Limit Bypass

#!/usr/bin/env node

Tradebox CryptoCurrency – ‘symbol’ SQL Injection

# Title: Tradebox - CryptoCurrency Buy Sell and Trading

CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) – Cross-Site Scripting

# Exploit Title: CentOS Web Panel v0.9.8.793 (Free) and v0.9.8.753 (Pro) - Email Field Stored Cross-Site Scripting Vu...

SaLICru -SLC-20-cube3(5) – HTML Injection

# Exploit Title: Reflected HTML Injection

ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities

# Exploit Title: Shoretel Connect Multiple Vulnerability

Bolt CMS 3.6.6 – Cross-Site Request Forgery / Remote Code Execution

Jobgator – ‘experience’ SQL Injection

# Exploit Title: NCrypted Jobgator - SQL Injection

WordPress Plugin Contact Form Maker 1.13.1 – Cross-Site Request Forgery

# Exploit Title: Contact Form by WD [CSRF → LFI]

Manage Engine ServiceDesk Plus 10.0 – Privilege Escalation

#!/usr/bin/python

FreeSMS 2.1.2 – SQL Injection (Authentication Bypass)

# Exploit Title: FreeSMS 2.1.2 - Authentication Bypass

PhreeBooks ERP 5.2.3 – Arbitrary File Upload

PhreeBooks ERP v5.2.3 - Arbitrary File Upload

Ashop Shopping Cart Software – SQL Injection

# Exploit Title: Ashop Shopping Cart Software - SQL Injection

Clinic Pro v4 – ‘month’ SQL Injection

# Title: Clinic Pro - Clinic Management Software

iScripts ReserveLogic – SQL Injection

# Exploit Title: iScripts ReserveLogic - SQL Injection

phpFileManager 1.7.8 – Local File Inclusion

# Exploit Title: phpFileManager 1.7.8 - Local File Inclusion

Fiverr Clone Script 1.2.2 – SQL Injection / Cross-Site Scripting

# Exploit Title: Fiverr Clone Script 1.2.2 - SQL Injection / Cross Site Scripting

CMS Made Simple < 2.2.10 - SQL Injection

#!/usr/bin/env python

LimeSurvey < 3.16 - Remote Code Execution

#!/usr/bin/python

JioFi 4G M2S 1.0.2 – Cross-Site Request Forgery

# Exploit Title: JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Setti...

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 – Parameter Tampering

# Exploit Title: cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPre...

Inout RealEstate – ‘city’ SQL Injection

# Exploit Title: Inout RealEstate - SQL Injection

Inout EasyRooms – SQL Injection

# Exploit Title: Inout EasyRooms Ultimate Edition - SQL Injection

CentOS Web Panel 0.9.8.789 – NameServer Field Persistent Cross-Site Scripting

# Exploit Title: CentOS Web Panel 0.9.8.789 - NameServer Field Stored Cross-Site Scripting Vulnerability

Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 – ‘arac_kategori_id’ SQL Injection

# Exploit Title: Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 - 'arac_kategori_id' SQL Injection

BigTree 4.3.4 CMS – Multiple SQL Injection

===========================================================================================

Job Portal 3.1 – ‘job_submit’ SQL Injection

===========================================================================================

i-doit 1.12 – ‘qr.php’ Cross-Site Scripting

# Exploit Title: i-doit 1.12 Cross Site Scripting on qr.php file

WordPress Plugin Loco Translate 2.2.1 – Local File Inclusion

# Exploit Title: Wordpress Loco Translate (Version 2.2.1) Plugin LFI