webapps

Shopy Point of Sale 1.0 – CSV Injection

# Exploit Title: Shopy Point of Sale v1.0 - CSV Injection

WSO2 Carbon / WSO2 Dashboard Server 5.3.0 – Persistent Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory < 20180423-0 >

WordPress Plugin Woo Import Export 1.0 – Arbitrary File Deletion

Ericsson-LG iPECS NMS A.1Ac – Cleartext Credential Disclosure

# -*- coding: utf-8 -*-

Interspire Email Marketer < 6.1.6 - Remote Admin Authentication Bypass

'''

Monstra CMS 3.0.4 – Arbitrary Folder Deletion

# Exploit Title: Monstra CMS 3.0.4 allows remote attackers to delete folder via an get request

Open-AudIT 2.1 – CSV Macro Injection

Hi Guys,

WUZHI CMS 4.1.0 – Cross-Site Request Forgery

# Exploit Title: WUZHI CMS 4.1.0 - Cross-Site Request Forgery

UK Cookie Consent – Persistent Cross-Site Scripting

# Exploit Title: UK Cookie Consent v2.3.9 - Persistent Cross-Site Scripting

Monstra cms 3.0.4 – Persitent Cross-Site Scripting

# Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting

Drupal avatar_uploader v7.x-1.0-beta8 – Arbitrary File Disclosure

#Title: Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure

Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

#!/usr/bin/env python

Ncomputing vSpace Pro 10/11 – Directory Traversal

# Exploit Title: Ncomputing vSpace Pro v10 and v11 - Directory Traversal Vulnerability

phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery

# Exploit Title: phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery

Cobub Razor 0.8.0 – Physical Path Leakage

# Exploit Title: Cobub Razor 0.8.0 Physical path Leakage Vulnerability

Geist WatchDog Console 3.2.2 – Multiple Vulnerabilities

# Exploit Author: bzyo

Joomla! Component JS Jobs 1.2.0 – Cross-Site Request Forgery

#######################################

WordPress Plugin Caldera Forms 1.5.9.1 – Cross-Site Scripting

# Exploit Title: CalderaForms 1.5.9.1 - multiple XSS

Lutron Quantum 2.0 – 3.2.243 – Information Disclosure

'''

Kodi 17.6 – Persistent Cross-Site Scripting

=============================================

Match Clone Script 1.0.4 – Cross-Site Scripting

########################################################################

Rvsitebuilder CMS – Database Backup Download

# Exploit Title: Rvsitebuilder CMS Database Backup Download

MySQL Squid Access Report 2.1.4 – SQL Injection / Cross-Site Scripting

# Exploit Title: MySQL Squid Access Report 2.1.4 Multiple Vulnerabilities

Joomla! Component jDownloads 3.2.58 – Cross Site Scripting

#######################################

Sophos Cyberoam UTM CR25iNG – 10.6.3 MR-5 – Direct Object Reference

# Exploit Title: Sophos Cyberoam UTM - Privilege Escalation

Cobub Razor 0.8.0 – SQL injection

# Exploit Title: Cobub Razor 0.8.0 SQL injection Vulnerability

Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution

#!/usr/bin/env ruby

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)

#!/usr/bin/env

Joomla! Convert Forms version 2.0.3 – Formula Injection (CSV Injection)

# Exploit Title: Joomla Extension Convert Forms version 2.0.3 is vulnerable to Formula Injection (CSV Injection)

WordPress Plugin File Upload 4.3.3 – Stored Cross-Site Scripting (PoC)

# Exploit Title: WordPress Plugin WordPress File Upload 4.3.3 - Stored XSS

WordPress Plugin File Upload 4.3.2 – Stored Cross-Site Scripting

# Exploit Title: WordPress Plugin WordPress File Upload 4.3.2 - Stored XSS

Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager – Invalid Access Control

# Exploit Title: [Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager Missing Access Contro...

WUZHI CMS 4.1.0 – Cross-Site Request Forgery (Add User)

# Exploit Title: WUZHI CMS 4.1.0 CSRF vulnerability add user account

WUZHI CMS 4.1.0 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: WUZHI CMS 4.1.0 CSRF vulnerability add admin account

WordPress Plugin Activity Log 2.4.0 – Stored Cross-Site Scripting

# Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting (XSS)

iScripts Easycreate 3.2.1 – Stored Cross-Site Scripting

# Exploit Title: iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting

WordPress Plugin Google Drive 2.2 – Remote Code Execution

# Exploit Title: Plugin Google Drive for WordPress 2.2 – RCE – Unlik

iScripts SonicBB 1.0 – Reflected Cross-Site Scripting (PoC)

# Exploit Title: iScripts SonicBB 1.0 - Reflected Cross-Site Scripting

WooCommerce CSV-Importer-Plugin 3.3.6 – Remote Code Execution

# Exploit Title: Plugin Woocommerce CSV importer 3.3.6 – RCE – Unlink

Buddypress Xprofile Custom Fields Type 2.6.3 – Remote Code Execution

# Exploit Title: Plugin Buddypress Xprofile Custom Fields Type 2.6.3 RCE – Unlink

KYOCERA Net Admin 3.4 – Cross-Site Request Forgery (Add Admin)

#Vendor: KYOCERA Corporation

KYOCERA Multi-Set Template Editor 3.4 – Out-Of-Band XML External Entity Injection

#Vendor: KYOCERA Corporation

CyberArk Password Vault Web Access < 9.9.5 / < 9.10 / 10.1 - Remote Code Execution

Advisory: CyberArk Password Vault Web Access Remote Code Execution

WordPress Plugin Simple Fields 0.2 – 0.3.5 – Local/Remote File Inclusion / Remote Code Execution

# Exploit Title: Simple Fields 0.2 - 0.3.5 LFI/RFI/RCE

Yahei PHP Prober 0.4.7 – Cross-Site Scripting

# Exploit title: Yahei-PHP Proberv0.4.7 - Cross-Site Scripting

WolfCMS 0.8.3.1 – Open Redirection

#######################################

MyBB Plugin Recent Threads On Index – Cross-Site Scripting

# Exploit Title: MyBB Recent threads

Cobub Razor 0.7.2 – Add New Superuser Account

# Exploit Title: [Cobub Razor 0.7.2 Add New Superuser User]

WolfCMS 0.8.3.1 – Cross-Site Request Forgery

#######################################

WordPress Plugin Background Takeover < 4.1.4 - Directory Traversal

# Exploit Title: WP Background Takeover, Directory Traversal