GUnet OpenEclass 1.7.3 E-learning platform - month SQL Injection

GUnet OpenEclass 1.7.3 E-learning platform - month SQL Injection Exploit Title: GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection Google Dork: intext:"© GUnet 2003-2007" Date: 2020-03-02 Exploit Author: emaragkos Vendor Homepage: https://www.openeclass.org/ Software Link:...

EyesOfNetwork 5.3 Remote Code Execution

Exploit Title: EyesOfNetwork 5.3 - Remote Code Execution Date: 2020-02-01 Exploit Author: Clément Billac Vendor Homepage: https://www.eyesofnetwork.com/ Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x8664-bin.iso Version: 5.3 CVE : CVE-2020-8654, CVE-2020-8655, CVE-2020-8656...

crestmontcountryclub.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1079146 Security Researcher sardharabadal Helped patch 254 vulnerabilities Received 3 Coordinated Disclosure badges Received 3 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting crestmontcountryclub.c...

CVE-2019-20361

There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. Recent assessments: h00die at January 20, 2021 1:48am UTC reported: A blind, time based SQL...

CVE-2020-5307

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in...

CVE-2018-7282

The CVE-2018-7282 issue affects TITool PrintMonitor. The Nuclei template confirms a vulnerability in the username parameter during login, enabling time-based blind SQL injection. Impact: unauthenticated attackers could extract database contents and potentially access sensitive printing data. Reme...

CVE-2018-7282

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi...

Detrix EDMS 1.2.3.1505 - SQL Injection Vulnerability

Exploit for php platform in category web applications !/usr/bin/php / Exploit Title: Detrix EDMS cleartext user password remote SQLI exploit Google Dork: Date: Jul 2019 Exploit Author: Burov Konstantin Vendor Homepage: forum.detrix.kz Software Link:...

ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution Exploit

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution", 'Description' = %q This module exploits sqli and command injectio...

ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Application Manager v14.2 - Privilege Escalation / Remote Command Execution", 'Description' = %q This module exploits sqli and comman...

ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution", 'Description' = %q This module exploits sqli and command injectio...

ManageEngine OpManager 12.4x - Privilege Escalation Remote Command Execution (Metasploit)

ManageEngine OpManager 12.4x - Privilege Escalation Remote Command Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine OpManager 12.4x - Privilege Escalation / Remo...

Karenderia Multiple Restaurant System 5.3 - SQL Injection

Karenderia Multiple Restaurant System 5.3 - SQL Injection =========================================================================================== Exploit Title: Karenderia CMS 5.3 - Multiple SQL Vuln. Dork: N/A Date: 05-07-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...

WordPress Visitors Traffic Real Time Statistics plugin <= 1.12 - Cross-Site Request Forgery (CSRF) leading to Stored XSS/SQLi vulnerabilities

Cross-Site Request Forgery CSRF vulnerability leading to Stored XSS/SQLi vulnerabilities found by Paul Dannewitz in WordPress Visitors Traffic Real Time Statistics plugin versions = 1.12. Solution Update the WordPress Visitors Traffic Real Time Statistics plugin to the latest available version at...

CiuisCRM 1.6 - 'eventType' SQL Injection

=========================================================================================== Exploit Title: CiuisCRM 1.6 - 'eventType' SQL Inj. Dork: N/A Date: 27-05-2019 Exploit Author: Mehmet EMİROĞLU Vendor Homepage: https://codecanyon.net/item/ciuis-crm/20473489 Software Link:...

WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection

An endpoint of the API, which is exposed when the 'use cache plugin' setting is enabled by default disabled, is vulnerable to an unauthenticated blind SQLi issue. PoC time curl -X POST 'http://host/wp-json/wpstatistics/v1/hit' --data...

Starbucks: Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice

@geekjeremy, at the same time as other hackers who submitted their own reports, discovered a browsable WSDL service on an API endpoint under the starbucks.com.cn domain, running on a non-standard port. @geekjeremy demonstrated that the service had several functions that executed without any...

Horde Webmail 5.2.22 - Multiple Vulnerabilities

Title: Horde Webmail - XSS + CSRF to SQLi, RCE, Stealing Emails var url = "http://webmail.victimserver.com/trean/"; var params =...

Freelance Cockpit CRM 3.3.1 SQL Injection Vulnerability

Exploit for php platform in category web applications =========================================================================================== Exploit Title: Freelance Cockpit CRM - SQL Inj. Dork: N/A Date: 17-05-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...

Joomla! Component ARI Quiz 3.7.4 - SQL Injection

Joomla! Component ARI Quiz 3.7.4 - SQL Injection Exploit Title: Joomla! Component ARI Quiz 3.7.4 - SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: April 27, 2019 Vendor Homepage: http://www.ari-soft.com Software Link :...