webapps

Dolibarr ERP/CRM 7.0.0 – (Authenticated) SQL Injection

# [CVE-2018-10094] Dolibarr SQL Injection vulnerability

MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass

Vendor: Appnitro

Yosoro 1.0.4 – Remote Code Execution

# Exploit title: Yosoro 1.0.4 - Remote Code Execution

SearchBlox 8.6.6 – Cross-Site Request Forgery

# Exploit Title: CSRF Privilege Escalation (Creation of an administrator

Facebook Clone Script 1.0.5 – Cross-Site Request Forgery

# Exploit Title: Facebook Clone Script 1.0.5 - Cross-Site Request Forgery

Facebook Clone Script 1.0.5 – ‘search’ SQL Injection

# Exploit Title: Facebook Clone Script 1.0.5 - 'search' SQL Injection

MyBB ChangUonDyU Plugin 1.0.2 – Cross-Site Scripting

# Exploit Title: MyBB ChangUonDyU Advanced Statistics Plugin v1.0.2 - Cross-Site Scripting

NUUO NVRmini2 / NVRsolo – Arbitrary File Upload

# Exploit Title: NUUO NVRmini2 / NVRsolo Arbitrary File Upload Vulnerability

Sitemakin SLAC 1.0 – ‘my_item_search’ SQL Injection

# # # # #

IssueTrak 7.0 – SQL Injection

================

wityCMS 0.6.1 – Cross-Site Scripting

# Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field

Joomla! Component JoomOCShop 1.0 – Cross-Site Request Forgery

# Exploit Title: Joomla! extension JoomOCShop 1.0 - Cross site request forgery

Joomla! Component jCart for OpenCart 2.3.0.2 – Cross-Site Request Forgery

# Exploit Title: Joomla! extension jCart for OpenCart 2.3.0.2 - Cross site request forgery

Joomla! Component Full Social 1.1.0 – ‘search_query’ SQL Injection

# Exploit Title: Joomla! extension Full Social 1.1.0 - 'search_query' SQL

WordPress Plugin Events Calendar – SQL Injection

# Exploit Title: Wordpress Plugin Events Calendar - SQL Injection

DomainMod 4.09.03 – ‘sslpaid’ Cross-Site Scripting

# Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter

DomainMod 4.09.03 – ‘oid’ Cross-Site Scripting

# Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter

TP-Link TL-WR840N/TL-WR841N – Authenticaton Bypass

Title: TP-Link Multiple Router(TL-WR840N and TL-WR841N) Unauthenticated

Baby Names Search Engine 1.0 – ‘a’ SQL Injection

# Exploit Title: Baby Names Search Engine v1.0 - 'a' SQL Injection

My Directory 2.0 – SQL Injection / Cross-Site Scripting

# Exploit Title: My Directory 2.0 - SQL Injection / Cross-Site Scripting

ClipperCMS 1.3.3 – Cross-Site Scripting

# Exploit Title: ClipperCMS 1.3.3 Persistent XSS on 'Site name' field

Listing Hub CMS 1.0 – SQL Injection

# Exploit Title: Listing Hub CMS 1.0 - Multiple SQL Injection

BookingWizz Booking System 5.5 – ‘id’ SQL Injection

# Exploit Title: BookingWizz Booking System 5.5 - 'bs-services-add.php' SQL Injection

Lyrist – ‘id’ SQL Injection

# Exploit Title: Lyrist - Music Lyrics Script - SQL Injection

Sharetronix CMS 3.6.2 – Cross-Site Request Forgery / Cross-Site Scripting

# Exploit Title: Sharetronix CMS XSRF Vulnerability

Ingenious School Management System – ‘id’ SQL Injection

# Exploit Title: Ingenious School Management System - SQL Injection

WordPress Plugin Booking Calendar 3.0.0 – SQL Injection / Cross-Site Scripting

# Exploit Title: Wordpress Plugin Booking Calendar 3.0.0 - SQL Injection / Cross-Site Scripting

easyLetters 1.0 – ‘id’ SQL Injection

# Exploit Title: easyLetters 1.0 - 'id' SQL Injection

mySurvey 1.0 – ‘id’ SQL Injection

# Exploit Title: mySurvey 1.0 - 'statistic.php' SQL Injection

EasyService Billing 1.0 – ‘q’ SQL Injection

EasyService Billing 1.0 – Cross-Site Scripting

EasyService Billing 1.0 – Cross-Site Request Forgery

Ajax Full Featured Calendar 2.0 – ‘search’ SQL Injection

# Exploit Title: Ajax Full Featured Calendar 2.0 - 'search' SQL Injection

Employee Work Schedule 5.9 – ‘cal_id’ SQL Injection

# Exploit Title: EWS 5.9 - 'search' SQL Injection

Oracle WebCenter FatWire Content Server < 7 - Improper Access Control

# Exploit Title: Oracle WebCenter FatWire Content Server < 7 - Improper Access Control

SAP Internet Transaction Server 6200.x – Session Fixation / Cross-Site Scripting

# Exploit Title: SAP Internet Transaction Server (ITS) 6200.X.X - Session Fixation/ Cross-Site Scripting

MyBB Moderator Log Notes Plugin 1.1 – Cross-Site Scripting

# Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting

KomSeo Cart 1.3 – ‘my_item_search’ SQL Injection

# Exploit Title: KomSeo Cart 1.3 - 'edit.php' SQL Injection

Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x – Cross-Site Scripting

# Exploit Title: Multiple XSS Oracle WebCenter Sites (FatWire Content

EU MRV Regulatory Complete Solution 1 – Authentication Bypass

# Exploit Title: EU MRV Regulatory Complete Solution 1 - Authentication Bypass

Honeywell XL Web Controller – Cross-Site Scripting

# Exploit Title: Honeywell XL Web Controller - Cross-Site Scripting

Timber 1.1 – Cross-Site Request Forgery

# Exploit Title: Timber - Ultimate Freelancer Platform 1.1 - Cross site request forgery

PaulNews 1.0 – ‘keyword’ SQL Injection / Cross-Site Scripting

# Exploit Title: PaulNews 1.0 - 'keyword' SQL Injection / Cross-Site Scripting

ASP.NET jVideo Kit – ‘query’ SQL Injection

# Exploit Title: ASP.NET jVideo Kit - 'query' SQL Injection

WordPress Plugin Peugeot Music – Arbitrary File Upload

# Exploit Title: Wordpress Plugin Peugeot Music - Arbitrary File Upload

SKT LTE Wi-Fi SDT-CW3B1 – Unauthorized Admin Credential Change

# Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change

Honeywell Scada System – Information Disclosure

# Exploit Title: Honeywell Scada System - Information Disclosure

Mcard Mobile Card Selling Platform 1 – SQL Injection

# Exploit Title: # Exploit Title: Mcard Mobile Card Selling Platform 1 - SQL Injection

eWallet Online Payment Gateway 2 – Cross-Site Request Forgery

# Exploit Title: eWallet - Online Payment Gateway 2 - Cross-Site Request Forgery

Wecodex Restaurant CMS 1.0 – ‘Login’ SQL Injection

# Exploit Title: Wecodex Restaurant CMS 1.0 - 'Login' SQL Injection