webapps

Time and Expense Management System 3.0 – ‘table’ SQL Injection

# Exploit Title: Time and Expense Management System 3.0 - 'table' SQL Injection

TP-Link TL-SC3130 1.6.18 – RTSP Stream Disclosure

# Exploit Title: TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure

Time and Expense Management System 3.0 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: Time and Expense Management System 3.0 - Cross-Site Request Forgery (Add Admin)

BigTree CMS 4.2.23 – Cross-Site Scripting

# Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting

Heatmiser Wifi Thermostat 1.7 – Credential Disclosure

# Exploit Title: Heatmiser Wifi Thermostat 1.7 - Credential Disclosure

GIU Gallery Image Upload 0.3.1 – ‘category’ SQL Injection

# Exploit Title: GIU Gallery Image Upload 0.3.1 - 'category' SQL Injection

MV Video Sharing Software 1.2 – ‘searchname’ SQL Injection

# Exploit Title: MV Video Sharing Software 1.2 - 'searchname' SQL Injection

Rukovoditel Project Management CRM 2.3 – ‘path’ SQL Injection

# Exploit Title: Rukovoditel Project Management CRM 2.3 - 'path' SQL Injection

WordPress Plugin Support Board 1.2.3 – Cross-Site Scripting

# Exploit Title: Wordpress Plugin Support Board 1.2.3 - Cross-Site Scripting

Vishesh Auto Index 3.1 – ‘fid’ SQL Injection

# Exploit Title: Vishesh Auto Index 3.1 - 'fid' SQL Injection

Kados R10 GreenBee – ‘release_id’ SQL Injection

# Exploit Title: Kados R10 GreenBee - 'release_id' SQL Injection

Library CMS 2.1.1 – Cross-Site Scripting

# Exploit Title: Library CMS 2.1.1 - Cross-Site Scripting

Navigate CMS 2.8.5 – Arbitrary File Download

# Exploit Title: Navigate CMS 2.8.5 - Arbitrary File Download

HotelDruid 2.2.4 – ‘anno’ SQL Injection

# Exploit Title: HotelDruid 2.2.4 - 'anno' SQL Injection

KORA 2.7.0 – ‘cid’ SQL Injection

# Exploit Title: KORA 2.7.0 - SQL Injection

Academic Timetable Final Build 7.0 – Information Disclosure

Centos Web Panel 0.9.8.480 – Multiple Vulnerabilities

# Exploit Title: Centos Web Panel 0.9.8.480 Multiple Vulnerabilities

FLIR Brickstream 3D+ – RTSP Stream Disclosure

FLIR Systems FLIR Brickstream 3D+ Unauthenticated RTSP Stream Disclosure

FLIR AX8 Thermal Camera 1.32.16 – RTSP Stream Disclosure

# Exploit Title: FLIR AX8 Thermal Camera 1.32.16 - RTSP Stream Disclosure

MaxOn ERP Software 8.x-9.x – ‘nomor’ SQL Injection

# Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection

Advanced HRM 1.6 – Remote Code Execution

# Exploit Title: Advanced HRM 1.6 - Remote Code Execution

College Notes Management System 1.0 – ‘user’ SQL Injection

# Exploit Title: College Notes Management System 1.0 - 'user' SQL Injection

FLIR AX8 Thermal Camera 1.32.16 – Remote Code Execution

# Exploit Title: FLIR AX8 Thermal Camera 1.32.16 - Remote Code Execution

AlchemyCMS 4.1 – Cross-Site Scripting

# Exploit Title: AlchemyCMS 4.1 - Cross-Site Scripting

Academic Timetable Final Build 7.0b – Cross-Site Request Forgery (Add Admin)

# Exploit Title: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin)

FLIR Brickstream 3D+ 2.1.742.1842 – Config File Disclosure

# Exploit Title: FLIR Brickstream 3D+ 2.1.742.1842 - Config File Disclosure

FLIR AX8 Thermal Camera 1.32.16 – Arbitrary File Disclosure

# Exploit Title: FLIR AX8 Thermal Camera 1.32.16 - Arbitrary File Disclosure

Academic Timetable Final Build 7.0a-7.0b – ‘id’ SQL Injection

# Exploit Title: Academic Timetable Final Build 7.0a-7.0b - 'id' SQL Injection

D-Link Routers – Directory Traversal

Directory Traversal

D-Link Routers – Plaintext Password

## Password stored in plaintext

D-Link Routers – Command Injection

## Shell command injection

SugarCRM 6.5.26 – Cross-Site Scripting

# Exploit Title: SugarCRM 6.5.26 - Cross-Site Scripting

HaPe PKH 1.1 – Arbitrary File Upload

# Exploit Title: HaPe PKH 1.1 - Arbitrary File Upload

CAMALEON CMS 2.4 – Cross-Site Scripting

# Exploit Title: CAMALEON CMS 2.4 - Cross-Site Scripting

HaPe PKH 1.1 – Cross-Site Request Forgery (Update Admin)

# Exploit Title: HaPe PKH 1.1 - Cross-Site Request Forgery (Update Admin)

Phoenix Contact WebVisit 2985725 – Authentication Bypass

# Exploit Title: Phoenix Contact WebVisit 2985725 - Authentication Bypass

LUYA CMS 1.0.12 – Cross-Site Scripting

# Exploit Title: LUYA CMS 1.0.12 - Cross-Site Scripting

HaPe PKH 1.1 – ‘id’ SQL Injection

# Exploit Title: HaPe PKH 1.1 - 'id' SQL Injection

Phoenix Contact WebVisit 6.40.00 – Password Disclosure

# Exploit Title: Phoenix Contact WebVisit 6.40.00 - Password Disclosure

jQuery-File-Upload 9.22.0 – Arbitrary File Upload

# Title: jQuery-File-Upload 9.22.0 - Arbitrary File Upload

E-Registrasi Pencak Silat 18.10 – ‘id_partai’ SQL Injection

# Exploit Title: E-Registrasi Pencak Silat 18.10 - 'id_partai' SQL Injection

WAGO 750-881 01.09.18 – Cross-Site Scripting

# Exploit Title: WAGO 750-881 01.09.18 - Cross-Site Scripting

Wikidforum 2.20 – Cross-Site Scripting

# Exploit Title: Wikidforum 2.20 - Cross-Site Scripting

Ektron CMS 9.20 SP2 – Improper Access Restrictions

Details

Wikidforum 2.20 – ‘message_id’ SQL Injection

# Exploit Title: Wikidforum 2.20 - 'message_id' SQL Injection

Wikidforum 2.20 – ‘select_sort’ SQL Injection

# Exploit Title: Wikidforum 2.20 - 'select_sort' SQL Injection

Imperva SecureSphere 13 – Remote Command Execution

# Title: Imperva SecureSphere 13 - Remote Command Execution

FLIR Thermal Traffic Cameras 1.01-0bb5b27 – Information Disclosure

# Title: FLIR Thermal Traffic Cameras 1.01-0bb5b27 - Information Disclosure

FLIR Thermal Traffic Cameras 1.01-0bb5b27 – RTSP Stream Disclosure

# Exploit Title: FLIR Thermal Traffic Cameras 1.01-0bb5b27 - RTSP Stream Disclosure

Chamilo LMS 1.11.8 – ‘firstname’ Cross-Site Scripting

# Exploit Title: Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting