Eco Search 1.0.2.0 - Denial of Service (PoC)

Eco Search 1.0.2.0 - Denial of Service PoC Exploit Title: Eco Search 1.0.2.0 - Denial of Service PoC Date: 1/18/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://www.microsoft.com/store/productId/9N05DCQP5C3W Version: 1.0.2.0 Tested on: Windows 10 Proof of Concept: R...

FastTube 1.0.1.0 - Denial of Service (PoC)

Exploit Title: FastTube 1.0.1.0 - Denial of Service PoC Date: 1/18/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://www.microsoft.com/store/productId/9MXS9JVDP25V Version: 1.0.1.0 Tested on: Windows 10 Proof of Concept: Run the python script, it will create a new fi...

Live Call Support Widget 1.5 - Remote Code Execution / SQL Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Live Call Support 1.5 - Remote Code Execution / SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://ranksol.com/ Software Link:...

Modern POS 1.3 - Arbitrary File Download

Modern POS 1.3 - Arbitrary File Download Exploit Title: Modern POS 1.3 - Arbitrary File Download Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://itsolution24.com/ Software Link:...

ThinkPHP 5.X - Remote Command Execution

Exploit Title: thinkphp 5.X RCE Date: 2019-1-14 Exploit Author: vrsystem Vendor Homepage: http://www.thinkphp.cn/ Software Link: http://www.thinkphp.cn/down.html Version: 5.x Tested on: windows 7/10 CVE : None https://github.com/SkyBlueEternal/thinkphp-RCE-POC-Collection...

PYSEC-2019-150

Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles...

PT-2019-7859 · Fedora · Bodhi

Name of the Vulnerable Software and Affected Versions: Bodhi versions 2.9.0 and lower Description: The issue is related to cross-site scripting, which can result in code injection due to incorrect validation of bug titles. Recommendations: For Bodhi versions 2.9.0 and lower, update to a version...

Event Calendar 3.7.4 - id SQL Injection

Event Calendar 3.7.4 - id SQL Injection Exploit Title: Event Calendar 3.7.4 - SQL Injection Dork: N/A Date: 2019-01-10 Exploit Author: Ihsan Sencan Vendor Homepage: http://ezcode.pt/ Software Link: https://codecanyon.net/item/event-calendar-phpmysql-plugin/19246267 Version: 3.7.4 Category: Webapp...

Heatmiser Wifi Thermostat 1.7 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Heatmiser Wifi Thermostat 1.7 - Cross-Site Request Forgery Dork: intitle:"Heatmiser Wifi Thermostat" & you can use shodan Exploit Author: sajjadbnd Vendor Lnk: https://www.heatmiser.com/en/ Product Link:...

Embed Video Scripts - Persistent Cross-Site Scripting

Exploit Title: Embed Video Scripts - Cross-site Script stored Google Dork: N/A Date: 1 Jan 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me POC Video: https://youtu.be/2CFJLwkxpT8 Vendor Homepage: https://codeawesome.in/embed/ Software Link:...

phpMoAdmin MongoDB GUI 1.1.5 - Cross-Site Request Forgery / Cross-Site Scripting

Exploit Title: phpMoAdmin 1.1.5 - MongoDB GUI | Multiple Vulnerabilities Date: 03.01.2019 Exploit Author: Ozer Goker Vendor Homepage: http://www.phpmoadmin.com Software Link: http://www.phpmoadmin.com/file/phpmoadmin.zip Version: 1.1.5 Introduction phpMoAdmin - MongoDB GUI MongoDB administration...

LayerBB 1.1.1 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: LayerBB 1.1.1 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com/downloads.php?view=file&id=26 Version: 1.1.1 Tested on: Ubuntu 18.04 CVE: CVE-2018-17997 1...

CVE-2018-19903

Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field...

CVE-2018-19903

This CVE concerns XSLT CMS, a PHP/XML/XSLT-based content management system. The vulnerability is a Persistent XSS flaw exploited through the title field in the create/?action=items.edit&type=Page endpoint, enabling injection of script/HTML. Root cause, per the description, is improper handling/es...

Evolution CMS Cross-Site Scripting Vulnerability (CNVD-2019-03273)

Evolution CMS is a content management system CMS. A cross-site scripting vulnerability exists in Evolution CMS version 1.4.x, which can be exploited by remote attackers to inject arbitrary web script or HTML by sending the 'page weblink title' parameter to the manager/ URI...

DouCo DouPHP Cross-Site Scripting Vulnerability (CNVD-2019-00999)

DouCo DouPHP is a lightweight open source CMS Content Management System based on PHP and MySQL. A cross-site scripting vulnerability exists in admin/article.php?rec=update in DouCo DouPHP version 1.5 20181221. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Design/Logic Flaw

Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?tofield=id&popup=1 title parameter at admin/blog/blogpost/add/...

CVE-2018-16637

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI...

CVE-2018-16632

Mezzanine CMS v4.3.1 is affected by CVE-2018-16632. The vulnerability is a Cross Site Scripting (XSS) flaw triggered via the title parameter in the admin/blog/blogcategory/add/ flow, specifically through the URL /admin/blog/blogcategory/add/?_to_field=id&_popup=1 on the related admin/blog/blogpos...

MAGIX Music Editor 3.1 Buffer Overflow

Exploit Title: MAGIX Music Editor 3.1 - Buffer Overflow SEH Exploit Author: bzyo Twitter: @bzyo Date: 2018-12-24 Vulnerable Software: MAGIX Music Editor 3.1 Vendor Homepage: https://www.magix.com/us/ Version: 3.1 Software Link: https://www.magix.com/us/music/mp3-deluxe/ Music Editor Software is...