webapps

Argus Surveillance DVR 4.0.0.0 – Directory Traversal

# Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal

Episerver 7 patch 4 – XML External Entity Injection

# Exploit Title: Episerver 7 patch 4 - XML External Entity Injection

phpMyAdmin 4.7.x – Cross-Site Request Forgery

# Exploit Title: phpMyAdmin 4.7.x - Cross-Site Request Forgery

WordPress Plugin Plainview Activity Monitor 20161228 – (Authenticated) Command Injection

Responsive FileManager < 9.13.4 - Directory Traversal

The following vulnerabilities were fixed in the version 9.13.4.

Seagate Personal Cloud SRN21C 4.3.16.0 / 4.3.18.0 – SQL Injection

------------------------------------------------------------------------

LiteCart 2.1.2 – Arbitrary File Upload

# Exploit Title: LiteCart 2.1.2 - Arbitrary File Upload

Sentrifugo HRMS 3.2 – ‘deptid’ SQL Injection

# Exploit Title: Sentrifugo HRMS 3.2 - 'deptid' SQL Injection

RICOH MP C4504ex Printer – Cross-Site Request Forgery (Add Admin)

# Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)

Gleez CMS 1.2.0 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin)

ManageEngine ADManager Plus 6.5.7 – Cross-Site Scripting

# Exploit Title: ManageEngine ADManager Plus 6.5.7 - Cross-Site Scripting

WordPress Plugin Gift Voucher 1.0.5 – (Authenticated) ‘template_id’ SQL Injection

# Exploit Title: WordPress Plugin Gift Voucher 1.0.5 - 'template_id' SQL Injection

ManageEngine ADManager Plus 6.5.7 – HTML Injection

# Exploit Title: ManageEngine ADManager Plus 6.5.7 - HTML Injection

UltimatePOS 2.5 – Remote Code Execution

# Exploit Title: UltimatePOS 2.5 - Remote Code Execution

Vox TG790 ADSL Router – Cross-Site Request Forgery (Add Admin)

# Title: Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)

PCViewer vt1000 – Directory Traversal

# Exploit Title: PCViewer vt1000 - Directory Traversal

Twitter-Clone 1 – ‘code’ SQL Injection

# Exploit Title: Twitter-Clone 1 - 'code' SQL Injection

Geutebrueck re_porter 16 – Cross-Site Scripting

# Exploit Title: Geutebrueck re_porter 16 - Cross-Site Scripting

Geutebrueck re_porter 7.8.974.20 – Credential Disclosure

# Exploit Title: Geutebrueck re_porter 7.8.974.20 - Credential Disclosure

KingMedia 4.1 – File Upload

# Exploit Title: KingMedia 4.1 - Remote Code Execution

ZyXEL VMG3312-B10B – Cross-Site Scripting

# Exploit Title: ZyXEL VMG3312-B10B - Cross-Site Scripting

WordPress Plugin Ninja Forms 3.3.13 – CSV Injection

# Exploit Title: Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection

Twitter-Clone 1 – Cross-Site Request Forgery (Delete Post)

# Exploit Title: Twitter-Clone 1 - Cross-Site Request Forgery (Delete Post)

Hikvision IP Camera 5.4.0 – User Enumeration (Metasploit)

# Exploit title: Hikvision IP Camera 5.4.0 - User Enumeration (Metasploit)

Twitter-Clone 1 – ‘userid’ SQL Injection

# Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection

Countly – Cross-Site Scripting

############################################################################

WordPress Plugin Tagregator 0.6 – Cross-Site Scripting

# Exploit Title: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting

MyBB Moderator Log Notes Plugin 1.1 – Cross-Site Request Forgery

# Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery

WordPress Plugin Chained Quiz 1.0.8 – ‘answer’ SQL Injection

# Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection

ADM 3.1.2RHG1 – Remote Code Execution

# Title: Asustor ADM 3.1.2RHG1 - Remote Code Execution

Mikrotik WinBox 6.42 – Credential Disclosure (golang)

# Title: Mikrotik WinBox 6.42 - Credential Disclosure ( golang edition )

Pimcore 5.2.3 – SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery

SEC Consult Vulnerability Lab Security Advisory < 20180813-0 >

WordPress Plugin Export Users to CSV 1.1.1 – CSV Injection

# Exploit Title: Wordpress Plugin Export Users to CSV 1.1.1 - CSV Injection

OpenEMR 5.0.1.3 – (Authenticated) Arbitrary File Actions

# Exploit Title: OpenEMR 5.0.1.3 - Arbitrary File Actions

ASUS-DSL N10 1.1.2.2_17 – Authentication Bypass

# Title: ASUS-DSL N10 1.1.2.2_17 - Authentication Bypass

ASUSTOR ADM 3.1.0.RFQ3 – Remote Command Execution / SQL Injection

Product - ASUSTOR ADM - 3.1.0.RFQ3 and all previous builds

Oracle Glassfish OSE 4.1 – Path Traversal (Metasploit)

# Exploit title: Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)

Oracle GlassFish Server Open Source Edition 4.1 – Path Traversal (Metasploit)

##

cgit 1.2.1 – Directory Traversal (Metasploit)

# Title: cgit 1.2.1 - Directory Traversal (Metasploit)

IBM Sterling B2B Integrator 5.2.0.1/5.2.6.3 – Cross-Site Scripting

# Exploit Title: [IBM Sterling B2B Integrator persistent cross-site scripting]

MyBB Like Plugin 3.0.0 – Cross-Site Scripting

# Exploit Title: MyBB Like Plugin 3.0.0 - Cross-Site Scripting

MyBB Thank You/Like Plugin 3.0.0 – Cross-Site Scripting

# Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting

Zimbra 8.6.0_GA_1153 – Cross-Site Scripting

# Exploit Title: Xss Zimbra Mail server

TP-Link C50 Wireless Router 3 – Cross-Site Request Forgery (Information Disclosure)

# Exploit Title: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Information Disclosure)

TP-Link C50 Wireless Router 3 – Cross-Site Request Forgery (Remote Reboot)

# Exploit Title: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Remote Reboot)

osTicket 1.10.1 – Arbitrary File Upload

# Exploit Title: osTicket 1.10.1 - Arbitrary File Upload

LG-Ericsson iPECS NMS 30M – Directory Traversal

# Exploit Title: LG-Ericsson iPECS NMS 30M - Directory Traversal

Monstra-Dev 3.0.4 – Cross-Site Request Forgery (Account Hijacking)

# Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request Forgery(Account Hijacking)

OpenEMR 5.0.1.3 – Remote Code Execution (Authenticated)

# Title: OpenEMR 5.0.1.3 - Remote Code Execution (Authenticated)

Open-AudIT Community 2.2.6 – Cross-Site Scripting

# Exploit Title: Open-AudIT Community 2.2.6 - Cross-Site Scripting