webapps

Grundig Smart Inter@ctive 3.0 – Cross-Site Request Forgery

# Exploit Title: Grundig Smart Inter@ctive 3.0 - Cross-Site Request Forgery

Cela Link CLR-M20 2.7.1.6 – Arbitrary File Upload

# Exploit Title: Cela Link CLR-M20 2.7.1.6 - Arbitrary File Upload

Zeta Producer Desktop CMS 14.2.0 – Remote Code Execution / Local File Disclosure

SEC Consult Vulnerability Lab Security Advisory < 20180712-0 >

QNAP Qcenter Virtual Appliance – Multiple Vulnerabilities

Core Security - Corelabs Advisory

WAGO e!DISPLAY 7300T – Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory < 20180711-0 >

Dicoogle PACS 2.5.0 – Directory Traversal

# Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal

Instagram-Clone Script 2.0 – Cross-Site Scripting

# Exploit Title: Instagram-clone Script 2.0 - Cross-Site Scripting

D-Link DIR601 2.02 – Credential Disclosure

# Exploit title: D-Link DIR601 2.02NA - Credential disclosure

Elektronischer Leitz-Ordner 10 – SQL Injection

# Title: Elektronischer Leitz-Ordner 10 - SQL Injection

WolfSight CMS 3.2 – SQL Injection

# Exploit Title: WolfSight CMS 3.2 - SQL Injection

Umbraco CMS SeoChecker Plugin 1.9.2 – Cross-Site Scripting

######################

Oracle WebLogic 12.1.2.0 – RMI Registry UnicastRef Object Java Deserialization Remote Code Execution

#!/usr/bin/python

Airties AIR5444TT – Cross-Site Scripting

# Exploit Title: Airties AIR5444TT - Cross-Site Scripting

ADB Broadband Gateways / Routers – Authorization Bypass

SEC Consult Vulnerability Lab Security Advisory < 20180704-1 >

SoftExpert Excellence Suite 2.0 – ‘cddocument’ SQL Injection

# Exploit Title: SoftExpert Excellence Suite 2.0 - 'cddocument' SQL Injection

Gitea 1.4.0 – Remote Code Execution

# pip install PyJWT requests

ShopNx – Arbitrary File Upload

# Exploit Title: ShopNx - Angular5 Single Page Shopping Cart Application 1 - Arbitrary File Upload

Online Trade – Information Disclosure

# Exploit Title: Online Trade 1 - Information Disclosure

CMS Made Simple 2.2.5 – (Authenticated) Remote Code Execution

# Exploit Title: CMS Made Simple 2.2.5 authenticated Remote Code Execution

ManageEngine Exchange Reporter Plus < Build 5311 - Remote Code Execution

# Exploit Title: ManageEngine Exchange Reporter Plus

ntop-ng < 3.4.180617 - Authentication Bypass

'''

Dolibarr ERP/CRM < 7.0.3 - PHP Code Injection

# Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =

DAMICMS 6.0.0 – Cross-Site Request Forgery (Add Admin)

VMware NSX SD-WAN Edge < 3.1.2 - Command Injection

#!/usr/bin/env python

Geutebruck 5.02024 G-Cam/EFD-2250 – ‘simple_loglistjs.cgi’ Remote Command Execution (Metasploit)

##

Cisco Adaptive Security Appliance – Path Traversal

'''

DIGISOL DG-HR3400 Wireless Router – Cross-Site Scripting

# Exploit Title: DIGISOL DG-HR3400 Wireless Router - Cross-Site Scripting

hycus CMS 1.0.4 – Authentication Bypass

# Exploit Title: hycus Content Management System v1.0.4 Login Page Bypass

HongCMS 3.0.0 – (Authenticated) SQL Injection

# Exploit Title: HongCMS 3.0.0 - SQL Injection

BEESCMS 4.0 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: A CSRF vulnerability exists in BEESCMS_V4.0: The administrator can be added arbitrarily.

HPE VAN SDN 2.7.18.0503 – Remote Root

'''

WordPress Core < 4.9.6 - (Authenticated) Arbitrary File Deletion

# Exploit Title: Wordpress

Liferay Portal < 7.0.4 - Server-Side Request Forgery

1. ADVISORY INFORMATION

WordPress Plugin iThemes Security < 7.0.3 - SQL Injection

# Exploit Title: WordPress Plugin iThemes Security(better-wp-security)

WordPress Plugin Comments Import & Export < 2.0.4 - CSV Injection

# Exploit Title: Wordpress Plugin Comments Import & Export < 2.0.4 - CSV Injection

Intex Router N-150 – Arbitrary File Upload

# Exploit Title:​​ Intex Router N-150 - Arbitrary File Upload

Ecessa ShieldLink SL175EHQ < 10.7.4 - Cross-Site Request Forgery (Add Superuser)

# Exploit Title: Ecessa ShieldLink SL175EHQ 10.7.4 - Cross-Site Request Forgery (Add Superuser)

AsusWRT RT-AC750GF – Cross-Site Request Forgery (Change Admin Password)

# Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password)

Ecessa WANWorx WVR-30 < 10.7.4 - Cross-Site Request Forgery (Add Superuser)

# Exploit title: Ecessa WANWorx WVR-30 < 10.7.4 - Cross-Site Request Forgery (Add Superuser)

DIGISOL DG-BR4000NG – Cross-Site Scripting

# Exploit Title: DIGISOL DG-BR4000NG - Cross-Site Scripting

Intex Router N-150 – Cross-Site Request Forgery (Add Admin)

# Exploit Title:​​ Intex Router N-150 - Cross-Site Request Forgery (Add Admin)

Ecessa Edge EV150 10.7.4 – Cross-Site Request Forgery (Add Superuser)

# Exploit Title: Ecessa Edge EV150 10.7.4 - Cross-Site Request Forgery (Add Superuser)

WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection

# Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection

phpMyAdmin 4.8.1 – (Authenticated) Local File Inclusion (2)

# Exploit Title: phpMyAdmin 4.8.1 - Local File Inclusion to Remote Code Execution

phpLDAPadmin 1.2.2 – ‘server_id’ LDAP Injection (Username)

# Exploit Title: phpLDAPadmin 1.2.2 - 'server_id' LDAP Injection (Username)

GreenCMS 2.3.0603 – Information Disclosure

# Exploit Title: GreenCMS 2.3.0603 - remote obtain sensitive information

phpMyAdmin 4.8.1 – (Authenticated) Local File Inclusion (1)

The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip

LFCMS 3.7.0 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: administrator account can be added arbitrarily.

LFCMS 3.7.0 – Cross-Site Request Forgery (Add User)

# Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: users can be added arbitrarily.

VideoInsight WebClient 5 – SQL Injection

# Title: VideoInsight WebClient 5 - SQL Injection