webapps

Matrix MLM Script 1.0 – Information Disclosure

# Exploit Title: Matrix MLM Script 1.0 - Information Leakage

eBrigade ERP 4.5 – Arbitrary File Download

#!/usr/bin/python

PEAR Archive_Tar < 1.4.4 - PHP Object Injection

PEAR Archive_Tar < 1.4.4 - PHP Object Injection

BlogEngine 3.3 – XML External Entity Injection

XML External Entity Injection Vulnerability in BlogEngine 3.3

ZTE MF65 BD_HDV6MF65V1.0.0B05 – Cross-Site Scripting

# Exploit Title: Reflected Cross-Site Scripting on ZTE MF65

Heatmiser Wifi Thermostat 1.7 – Cross-Site Request Forgery (Update Admin)

# Exploit Title: Heatmiser Wifi Thermostat 1.7 - Cross-Site Request Forgery

Dolibarr ERP-CRM 8.0.4 – ‘rowid’ SQL Injection

# Title: Dolibarr ERP-CRM 8.0.4 - 'rowid' SQL Injection

CF Image Hosting Script 1.6.5 – (Delete all Pictures) Privilege Escalation

#!/usr/bin/env python

Huawei E5330 21.210.09.00.158 – Cross-Site Request Forgery (Send SMS)

# Exploit Title: Huawei E5330 Cross-Site Request Forgery (Send SMS)

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 – JS/HTML Code Injection

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 – Cross-Site Request Forgery

Ajera Timesheets 9.10.16 – Deserialization of Untrusted Data

# Exploit Title: Ajera Timesheets

Roxy Fileman 1.4.5 – Unrestricted File Upload / Directory Traversal

======================================================================

MyT Project Management 1.5.1 – ‘Charge[group_total]’ SQL Injection

# Exploit Title: MyT-PM 1.5.1 - 'Charge[group_total]' SQL Injection

WordPress Plugin UserPro < 4.9.21 - User Registration Privilege Escalation

# Exploit Title: Wordpress Plugin UserPro < 4.9.21 User Registration With Administrator Role

phpMoAdmin MongoDB GUI 1.1.5 – Cross-Site Request Forgery / Cross-Site Scripting

#####################################################################################################################...

PLC Wireless Router GPN2.4P21-C-CN – Cross-Site Scripting

# Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Reflected XSS

MyBB OUGC Awards Plugin 1.8.3 – Persistent Cross-Site Scripting

# Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting

LayerBB 1.1.1 – Persistent Cross-Site Scripting

# Exploit Title: LayerBB 1.1.1 - Cross-Site Scripting

All in One Video Downloader 1.2 – (Authenticated) SQL Injection

# Exploit Title: All in One Video Downloader 1.2 - SQL Injection

Embed Video Scripts – Persistent Cross-Site Scripting

# Exploit Title: Embed Video Scripts - Cross-site Script (stored)

Frog CMS 0.9.5 – Cross-Site Scripting

# Exploit Title: Frog CMS 0.9.5 - Cross-Site Scripting

WordPress Plugin Adicon Server 1.2 – ‘selectedPlace’ SQL Injection

# Exploit Title: WordPress Plugin Adicon Server 1.2 - 'selectedPlace' SQL Injection

Vtiger CRM 7.1.0 – Remote Code Execution

# Exploit Title: Vtiger CRM 7.1.0 - Remote Code Execution

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 – Arbitrary File Upload

# Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload

bludit Pages Editor 3.0.0 – Arbitrary File Upload

# Exploit Title: bludit Pages Editor 3.0.0 - Arbitrary File Upload

WordPress Plugin Audio Record 1.0 – Arbitrary File Upload

# Exploit Title: WordPress Plugin Audio Record 1.0 - Arbitrary File Upload

Craft CMS 3.0.25 – Cross-Site Scripting

# Exploit Title: Craft CMS 3.0.25 - Cross-Site Scripting

FrontAccounting 2.4.5 – ‘SubmitUser’ SQL Injection

# Exploit Title: FrontAccounting 2.4.5 - 'SubmitUser' SQL Injection

WSTMart 2.0.8 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin)

WSTMart 2.0.8 – Cross-Site Scripting

# Exploit Title: WSTMart 2.0.8 - Cross-Site Scripting

ZeusCart 4.0 – Cross-Site Request Forgery (Deactivate Customer Accounts)

# Exploit Title: ZeusCart 4.0 Deactivate Customer Accounts CSRF

IBM Operational Decision Manager 8.x – XML External Entity Injection

# Exploit Title: [XML External Entity Injection (XXE)]

Yeswiki Cercopitheque – ‘id’ SQL Injection

# Exploit Title: SQL Injection in Yeswiki (Cercopitheque)

Bolt CMS < 3.6.2 - Cross-Site Scripting

# Exploit Title: Bolt CMS [ https://github.com/rdincel1/Bolt-CMS-3.6.2---Cross-Site-Scripting/raw/master/bolt-v3.6.2...

Integria IMS 5.0.83 – Cross-Site Request Forgery

# Exploit Title: Integria IMS 5.0.83 - Cross-Site Request Forgery

Integria IMS 5.0.83 – ‘search_string’ Cross-Site Scripting

# Exploit Title: Integria IMS 5.0.83 - Cross-Site Scripting

Rukovoditel Project Management CRM 2.3.1 – Remote Code Execution (Metasploit)

##

Hotel Booking Script 3.4 – Cross-Site Request Forgery (Change Admin Password)

# Exploit Title: Admin Account take over Via CSRF

SDL Web Content Manager 8.5.0 – XML External Entity Injection

######################

phpMyAdmin 4.8.4 – ‘AllowArbitraryServer’ Arbitrary File Read

#!/usr/bin/env python

Double Your Bitcoin Script Automatic – Authentication Bypass

# Exploit Title: Double Your Bitcoin Script Automatic 2018 for $50 - Authentication Bypass

Facebook And Google Reviews System For Businesses 1.1 – Remote Code Execution

# Exploit Title: Facebook And Google Reviews System For Businesses 1.1 - Remote Code Execution

Facebook And Google Reviews System For Businesses 1.1 – SQL Injection

# Exploit Title: Facebook And Google Reviews System For Businesses 1.1 - SQL Injection

Facebook And Google Reviews System For Businesses – Cross-Site Request Forgery (Change Admin Password)

# Exploit Title: Facebook And Google Reviews System For Businesses - Cross-Site Request Forgery

Huawei Router HG532e – Command Execution

#!/bin/python

Fortify Software Security Center (SSC) 17.10/17.20/18.10 – Information Disclosure (2)

Details

Fortify Software Security Center (SSC) 17.10/17.20/18.10 – Information Disclosure

Details

Responsive FileManager 9.13.4 – Multiple Vulnerabilities

Responsive FileManager 9.13.4 - Multiple Vulnerabilities

phpBB 3.2.3 – Remote Code Execution

// All greets goes to RIPS Tech