webapps

pfSense 2.4.4-p1 (HAProxy Package 0.59_14) – Persistent Cross-Site Scripting

# Exploit Title: pfSense 2.4.4-p1 (HAProxy Package 0.59_14) - Stored Cross-Site Scripting

WordPress Plugin GraceMedia Media Player 1.0 – Local File Inclusion

=============================================

PilusCart 1.4.1 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)

Flexpaper PHP Publish Service 2.3.6 – Remote Code Execution

#!/usr/bin/env python

PRTG Network Monitor 18.2.38 – (Authenticated) Remote Code Execution

#!/bin/bash

OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)

##

Liferay CE Portal < 7.1.2 ga3 - Remote Command Execution (Metasploit)

##

DirectAdmin 1.55 – ‘CMD_ACCOUNT_ADMIN’ Cross-Site Request Forgery

# Exploit title: DirectAdmin v1.55 - CSRF via CMD_ACCOUNT_ADMIN Admin Panel

McAfee ePO 5.9.1 – Registered Executable Local Access Bypass

# Exploit Title: McAfee ePO 5.9.1 Registered Executable Local Access Bypass

OrientDB 3.0.17 GA Community Edition – Cross-Site Request Forgery / Cross-Site Scripting

#####################################################################################################################...

Kados R10 GreenBee – Multiple SQL Injection

===========================================================================================

OpenDocMan 1.3.4 – ‘search.php where’ SQL Injection

===========================================================================================

Fiberhome AN5506-04-F RP2669 – Persistent Cross-Site Scripting

# Exploit Title: Fiberhome AN5506-04-F - Stored Cross Site Scripting

WordPress Plugin Cerber Security, Antispam & Malware Scan 8.0 – Multiple Bypass Vulnerabilities

# Exploit Title: WordPress Cerber Security, Antispam & Malware Scan - Multiple Bypass Vulnerabilities

Craft CMS 3.1.12 Pro – Cross-Site Scripting

# Exploit Title: Craft CMS 3.1.12 Pro - Cross-Site Scripting

Bolt CMS 3.6.4 – Cross-Site Scripting

# Exploit Title: Bolt CMS - 3.6.4 - Cross-Site Scripting

MarcomCentral FusionPro VDP Creator < 10.0 - Directory Traversal

#!/usr/bin/env python

Raisecom XPON ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 – Remote Code Execution

# Exploit Title: Remote code execution in Raisecom xpon

zzzphp CMS 1.6.1 – Cross-Site Request Forgery

# Exploit Title: Cross-Site Request Forgery(CSRF) of zzzphp cms 1.6.1

Splunk Enterprise 7.2.4 – Custom App Remote Command Execution (Persistent Backdoor / Custom Binary)

#!/usr/bin/python

Booked Scheduler 2.7.5 – Remote Command Execution (Metasploit)

##

OOP CMS BLOG 1.0 – Multiple Cross-Site Request Forgery

# Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Delete Admin)

OOP CMS BLOG 1.0 – Multiple SQL Injection

# Exploit Title: OOP CMS BLOG 1.0 - SQL Injection

elFinder 2.1.47 – ‘PHP connector’ Command Injection

#!/usr/bin/python

CMSsite 1.0 – Multiple Cross-Site Request Forgery

# Exploit Title: CMSsite 1.0 - Cross-Site Request Forgery (Delete Admin)

WordPress Core 5.0 – Remote Code Execution

var wpnonce = '';

Feng Office 3.7.0.5 – Remote Command Execution (Metasploit)

##

Usermin 1.750 – Remote Command Execution (Metasploit)

##

Joomla! Component J2Store < 3.3.7 - SQL Injection

# Exploit Title: J2Store Plugin for Joomla! < 3.3.6 - SQL Injection

Simple Online Hotel Reservation System – Cross-Site Request Forgery (Delete Admin)

# Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery (Delete Admin)

Simple Online Hotel Reservation System – Cross-Site Request Forgery (Add Admin)

# Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery (Add Admin)

Simple Online Hotel Reservation System – SQL Injection

# Exploit Title: Simple Online Hotel Reservation System - SQL Injection / Authentication Bypass

Drupal < 8.6.9 - REST Module Remote Code Execution

#!/usr/bin/env python3

Advance Gift Shop Pro Script 2.0.3 – SQL Injection

# Exploit Title: Advance Gift Shop Pro Script 2.0.3 - SQL Injection

News Website Script 2.0.5 – SQL Injection

# Exploit Title: News Website Script 2.0.5 - SQL Injection

PHP Ecommerce Script 2.0.6 – Cross-Site Scripting / SQL Injection

# Exploit Title: PHP Ecommerce Script 2.0.6 - Cross Site Scripting / SQL Injection

zzzphp CMS 1.6.1 – Remote Code Execution

# Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1

Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 – Remote Code Execution

#!/usr/bin/env python

Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution

Analyzing the patch

Teracue ENC-400 – Command Injection / Missing Authentication

Introduction

Micro Focus Filr 3.4.0.217 – Path Traversal / Local Privilege Escalation

SecureAuth - SecureAuth Labs Advisory

Quest NetVault Backup Server < 11.4.5 - Process Manager Service SQL Injection / Remote Code Execution

# Exploit Title: Quest NetVault Backup Server < 11.4.5 Process Manager Service SQL Injection Remote Code Execution Vu...

EI-Tube 3 – SQL Injection

# Exploit Title: PHP EI-Tube Script - Sql Injection

C4G Basic Laboratory Information System (BLIS) 3.4 – SQL Injection

# Exploit Title: C4G Basic Laboratory Information System (BLIS) 3.4 - Multiples SQL Injection

HotelDruid 2.3 – Cross-Site Scripting

===========================================================================================

Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)

In the exploitation, the target is always escalating the read primitive or write primitive to code execution! From th...

Ask Expert Script 3.0.5 – Cross Site Scripting / SQL Injection

# Exploit Title: Ask Expert Script 3.0.5 - Cross Site Scripting / SQL Injection

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 – Path Traversal / Cross-Site Scripting

XAMPP 5.6.8 – SQL Injection / Persistent Cross-Site Scripting

eDirectory – SQL Injection

# Exploit Title: Admin auth bypass, SQLi and File Disclosure