webapps

SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion

# Title: SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion

Infinity Market Classified Ads Script 1.6.2 – Cross-Site Request Forgery

# Exploit Title: Infinity Market Classified Ads Script 1.6.2 - Cross-Site Request Forgery

Cisco SA520W Security Appliance – Path Traversal

# Title: Cisco SA520W Security Appliance - Path Traversal

SAP NetWeaver Web Dynpro 6.4 < 7.5 - Information Disclosure

# Application: SAP NetWeaver Web Dynpro 6.4 to 7.5 - Information disclosure

Monstra CMS < 3.0.4 - Cross-Site Scripting (2)

# Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting

Healwire Online Pharmacy 3.0 – Cross-Site Scripting / Cross-Site Request Forgery

# Exploit Title: Healwire Online Pharmacy 3.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery

Powerlogic/Schneider Electric IONXXXX Series – Cross-Site Request Forgery

# Exploit Title: Powerlogic Schneider Electric IONXXXX Series - Cross-Site Request Forgery

SuperCom Online Shopping Ecommerce Cart 1 – Persistent Cross-Site scripting / Cross site request forgery / Authentication bypass

# Exploit Title: SuperCom Online Shopping Ecommerce Cart 1 - Persistent Cross-Site scripting / Cross site request for...

Intelbras NCLOUD 300 1.0 – Authentication bypass

# coding: utf-8

NodAPS 4.0 – SQL injection / Cross-Site Request Forgery

# Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery

RSA Authentication Manager 8.2.1.4.0-build1394922 / < 8.3 P1 - XML External Entity Injection / Cross-Site Flashing / DOM Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory < 20180516-0 >

WordPress Plugin Metronet Tag Manager 1.2.7 – Cross-Site Request Forgery

Press submit on a page containing the following HTML snippet:

totemomail Encryption Gateway 6.0.0 Build 371 – Cross-Site Request Forgery

Horse Market Sell & Rent Portal Script 1.5.7 – Cross-Site Request Forgery

# Exploit Title: Horse Market Sell & Rent Portal Script 1.5.7 - Cross-Site Request Forgery

Multiplayer BlackJack Online Casino Game 2.5 – Cross-Site Scripting

# Exploit Title: Multiplayer BlackJack - Online Casino Game 2.5 - Persistent Cross-Site scripting

Rockwell Scada System 27.011 – Cross-Site Scripting

# Exploit Title: Rockwell Scada System - Cross-Site Scripting

VirtueMart 3.1.14 – Persistent Cross-Site Scripting

# Exploit Title: VirtueMart 3.1.14 - Persistent Cross-Site Scripting

MyBB Admin Notes Plugin 1.1 – Cross-Site Request Forgery

# Exploit Title: MyBB Admin Notes Plugin - CSRF

XATABoost 1.0.0 – SQL Injection

# Exploit Title: XATABoost CMS Sql Injection

WUZHI CMS 4.1.0 – ‘tag[pinyin]’ Cross-Site Scripting

# Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability

WUZHI CMS 4.1.0 – ‘form[qq_10]’ Cross-Site Scripting

# Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability

Open-AudIT Community 2.2.0 – Cross-Site Scripting

# Exploit Title: Open-AudIT Community - 2.2.0 – Cross-Site Scripting

Open-AudIT Professional – 2.1.1 – Cross-Site Scripting

# Exploit Title: Open-AudIT Professional 2.1.1 – Multiple Cross-Site Scripting

MyBB Latest Posts on Profile Plugin 1.1 – Cross-Site Scripting

# Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting

ModbusPal 1.6b – XML External Entity Injection

[+] Exploit Title: ModbusPal XXE Injection

Fastweb FASTGate 0.00.47 – Cross-Site Request Forgery

# Exploit Title: Fastweb FASTgate 0.00.47 CSRF

WordPress Plugin User Role Editor < 4.25 - Privilege Escalation

##

CSP MySQL User Manager 2.3.1 – Authentication Bypass

# Exploit Title: CSP MySQL User Manager 2.3.1 - Authentication Bypass

IceWarp Mail Server < 11.1.1 - Directory Traversal

Vendor: IceWarp (http://www.icewarp.com)

WordPress Plugin WF Cookie Consent 1.1.3 – Cross-Site Scripting

# Exploit Title: WF Cookie Consent - Authenticated Persistent Cross-Site Scripting

JasperReports – (Authenticated) File Read

TIBCO’s JasperReports ( file = new File(/home/rhino/jasperreports...mcat/webapps/jasperserver,"/WEB-INF/jsp/modules/a...

Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery

# SSRF（Server Side Request Forgery） in Cockpit 0.4.4-0.5.5 (CVE-2018-9302)

WordPress Plugin Responsive Cookie Consent 1.7 / 1.6 / 1.5 – (Authenticated) Persistent Cross-Site Scripting

# Exploit Title: Wordpress Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting

Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root

# Exploit Title: Nagios XI 5.2.[6-9], 5.3, 5.4 Chained Remote Root

WordPress Plugin Form Maker 1.12.20 – CSV Injection

# Exploit Title: Wordpress Plugin Form Maker version 1.12.20 vulnerable to to Formula Injection (CSV Injection)

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)

##

Frog CMS 0.9.5 – Persistent Cross-Site Scripting

# Exploit Title: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings

TP-Link Technologies TL-WA850RE Wi-Fi Range Extender – Remote Reboot

# Exploit Title: TP-Link Technologies TL-WA850RE Wi-Fi Range Extender | Unauthorized Remote Reboot

GitList 0.6 – Remote Code Execution

'''

MyBB Threads to Link Plugin 1.3 – Cross-Site Scripting

# Exploit Title: MyBB Threads to Link Plugin v1.3 - Persistent XSS

October CMS User Plugin 1.4.5 – Persistent Cross-Site Scripting

# Exploit Title: October CMS User Plugin v1.4.5 - Persistent Cross-Site Scripting

SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response

# Exploit Title: SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response

WordPress Plugin WP with Spritz 1.0 – Remote File Inclusion

# Exploit Title: WordPress Plugin WP with Spritz 1.0 - Remote File Inclusion

Jfrog Artifactory < 4.16 - Arbitrary File Upload / Remote Command Execution

# Exploit Title: Jfrog Artifactory < 4.16 - Unauthenticated Arbitrary File Upload / Remote Command Execution

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)

This is a sample of exploit for Drupal 7 new vulnerability SA-CORE-2018-004 / CVE-2018-7602.

HRSALE The Ultimate HRM 1.0.2 – Local File Inclusion

# Exploit Title: HRSALE The Ultimate HRM v1.0.2 - Local File Inclusion

HRSALE The Ultimate HRM 1.0.2 – (Authenticated) Cross-Site Scripting

# Exploit Title: HRSALE The Ultimate HRM 1.0.2 - Authenticated Cross Site Scripting

HRSALE The Ultimate HRM 1.0.2 – ‘award_id’ SQL Injection

# Exploit Title: HRSALE The Ultimate HRM v1.0.2 - 'award_id' SQL Injection

HRSALE The Ultimate HRM 1.0.2 – CSV Injection

# Exploit Title: HRSALE The Ultimate HRM 1.0.2 - CSV Injection

Blog Master Pro 1.0 – CSV Injection

# Exploit Title: Blog Master Pro v1.0 - CSV Injection