Hikvision IP Camera versions 5.2.0 – 5.3.9 (Builds 140721 < 170109) - Access Control Bypass
# Exploit Title: Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds: 140721 - 170109) Backdoor
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Cisco node-jos < 0.11.0 - Re-sign Tokens
#!/usr/bin/env python3
Coship RT3052 Wireless Router – Persistent Cross-Site Scripting
######################################################################################
Vehicle Sales Management System – Multiple Vulnerabilities
# Exploit Title: VSMS Multiple Vulnerabilities
Intelbras Telefone IP TIP200 LITE – Local File Disclosure
# Exploit Title: [INTELBRAS TELEFONE IP TIP200/200 LITE Local File Include]
Contec Smart Home 4.15 – Unauthorized Password Reset
# Title : Contec smart home 4.15 Unauthorized Password Reset
Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution
// Exploit Title: RCE in PATCH requests in Spring Data REST
WordPress Plugin Duplicator 1.2.32 – Cross-Site Scripting
# Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting (XSS)
Tuleap 9.17.99.189 – Blind SQL Injection
===============================================================================
SecurEnvoy SecurMail 9.1.501 – Multiple Vulnerabilities
SEC Consult Vulnerability Lab Security Advisory < 20180312-0 >
ACL Analytics 11.X – 13.0.0.579 – Arbitrary Code Execution
# Exploit Title: Arbitrary Code Execution
Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution
#!/usr/bin/python2.7
TextPattern 4.6.2 – ‘qty’ SQL Injection
=============================================
Prisma Industriale Checkweigher PrismaWEB 1.21 – Hard-Coded Credentials
Prisma Industriale Checkweigher PrismaWEB 1.21 Authentication Bypass
Bacula-Web < 8.0.0-rc2 - SQL Injection
# Exploit Title: Multiple SQL injection vulnerabilities in Bacula-Web
antMan 0.9.0c – Authentication Bypass
# Exploit Title: antMan
Redaxo CMS Addon MyEvents 2.2.1 – SQL Injection
# Exploit Title: Redaxo CMS Addon MyEvents SQL Injection [ Backend ]
Bravo Tejari Web Portal – Cross-Site Request Forgery
Exploit Title: Bravo Tejari Web Portal-CSRF
ClipBucket < 4.0.0 - Release 4902 - Command Injection / File Upload / SQL Injection
SEC Consult Vulnerability Lab Security Advisory < 20180227-0 >
uWSGI < 2.0.17 - Directory Traversal
# Exploit Title: uWSGI PHP Plugin Directory Traversal
antMan < 0.9.1a - Authentication Bypass
# Exploit Title: antMan
D-Link DIR-600M Wireless – Cross-Site Scripting
########################################################################
Routers2 2.24 – Cross-Site Scripting
# Exploit Title: Routers2 2.24 - Reflected Cross-Site Scripting
Concrete5 CMS < 8.3.0 - Username / Comments Enumeration
#!/usr/bin/env python3
CMS Made Simple 2.1.6 – Remote Code Execution
# Exploit Title: CMS Made Simple 2.1.6 - Remote Code Execution
School Management Script 3.0.4 – Authentication Bypass
# Exploit Title: SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4.
MyBB My Arcade Plugin 1.3 – Cross-Site Scripting
# Exploit Title: MyBB My Arcade Plugin v1.3 - Persistent XSS
Parallels Remote Application Server 15.5 – Path Traversal
# Exploit Title: Parallels Remote Application Server (RAS) 15.5 Path Traversal
Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) – Multiple Vulnerabilities
Core Security - Corelabs Advisory
October CMS < 1.0.431 - Cross-Site Scripting
# Exploit Title: October CMS Stored Code Injection
Oracle Primavera P6 Enterprise Project Portfolio Management – HTTP Response Splitting
# Exploit Title: Oracle Primavera P6 Enterprise Project Portfolio Management HTTP Response Splitting
PSNews Website 1.0.0 – ‘Keywords’ SQL Injection
# Exploit Title: PSNews Website (Same Backend with Mobile Apps) 1.0.0 - 'Keywords' SQL Injection
PHIMS – Hospital Management Information System – ‘Password’ SQL Injection
# Exploit Title: PHIMS - Hospital Management Information System - 'Password' SQL Injection