Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting

Exploit Title: Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting Date: 2020-04-16 Exploit Author: Dylan Garnaud & Benoit Malaboeuf - Pentesters from Orange Cyberdefense France Vendor Homepage:...

Car Park Management System 1.0 - Authentication Bypass

Exploit Title: Car Park Management System 1.0 - Authentication Bypass Date: 2020-05-07 Exploit Author: Tarun Sehgal Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/car-park-management-system.zip Version: 1.0...

DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting Vendor Link: http://www.dedecms.com Software Link: http://www.dedecms.com/products/dedecms/downloads/ CVE: N/A Document Title: =============== DedeCMS v7.5 SP2 - Multiple Persistent Web...

See-SURF - Python Based Scanner To Find Potential SSRF Parameters

A Python based scanner to find potential SSRF parameters in a web application. Motivation SSRF being one of the critical vulnerabilities out there in web, I see there was no tool which would automate finding potential vulnerable parameters. See-SURF can be added to your arsenal for recon while...

ECTouch ECShop 2.7.3 SQL Injection

Exploit Title : ECTouch ECShop v2.7.3 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 22/01/2020 Vendor Homepage : ecshop.com - ectouch.cn Software Download Link : ecshop.com/download Software Affected Versions : 1.0 and 2.7.3 Tested On : Windows a...

PT-2020-18396 · Phpgurukul · Phpgurukul Dairy Farm Shop Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Dairy Farm Shop Management System version 1.0 Description: The issue affects the PHPGurukul Dairy Farm Shop Management System, where SQL injection is possible. This is demonstrated through various parameters in different PHP files,...

Karakuzu ERP Management Web 5.7.0 SQL Injection

Exploit Title: Karakuzu ERP Management Web 5.7.0 - 'kadiduz' SQL Injection Discovery Date: 2019-09-20 Exploit Author: Hakan TAŞKÖPRÜ Vendor Homepage: http://karakuzu.info/ Effected Version = 5.7.0 Vulnerability 1: Unauthenticated SQL Injection ==================================================...

CVE-2018-8879

Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...

Stack overflow

Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...

DIGIT CENTRIS 4 ERP - datum1 SQL Injection

DIGIT CENTRIS 4 ERP - datum1 SQL Injection Exploit Title: DIGIT CENTRIS 4 ERP - 'datum1' SQL Injection Date: 2019-09-19 Exploit Author: n1x MS-WEB Vendor Homepage: http://www.digit-rs.com/ Product Homepage: http://digit-rs.com/centris.html Version: Every version CVE : N/A Vulnerable parameters:...

Web Ofisi Firma 13 - oz SQL Injection

Web Ofisi Firma 13 - oz SQL Injection Exploit Title: Web Ofisi Firma 13 - 'oz' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/kurumsal-firma-v13-sinirsiz-dil.html Demo Site: http://demobul.net/firmav13/ Version: v13 Tested on: Kali Linux...

Web Ofisi Firma Rehberi 1 SQL Injection

Exploit Title: Web Ofisi Firma Rehberi 1 - 'il' SQL Injection Date: 2019-07-19 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html Demo Site: http://demobul.net/firma-rehberi-v1/ Version: v1 Tested on: Kali Linux CVE: N/A ----- PoC: SQLi -----...

WordPress WPAds 1.0 Open Redirection

Exploit Title : WordPress WPAds Plugins 1.0 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 29/05/2019 Vendor Homepage : montages.no Information Link : montages.no/martin/ thesandbox.wordpress.com/wpads/ WordPress Affected Version : N/A Plugin...

WordPress Jingke 1.0 Open Redirection

Exploit Title : WordPress Jingke Themes 1.0 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 24/05/2019 Vendor Homepage : hwaq.cc - zmingcx.com WordPress Affected Version : 4.9.x Theme Affected Version : 1.0 Information Link :...

Jettweb PHP Hazir Haber Sitesi Scripti 1 SQL Injection

Exploit Title: Jettweb PHP Hazır Haber Sitesi Scripti V1 - Multiple Vulnerabilities Date: 23.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://jettweb.net/u-5-php-hazir-haber-sitesi-scripti-v1.html Demo Site: http://haberv1.proemlaksitesi.net Version: V1 Tested on: Kali Linux CVE...

Matri4Web Matrimony Web Script SQL Injection

Exploit Title: Matrimony Website Script - Multiple SQL Injection Date: 22.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.matri4web.com Demo Site: https://www.matrimonydemo.com Version: M-Plus Tested on: Kali Linux CVE: N/A ----- PoC 1: SQLi ----- Request:...

Care2x 2.7 (HIS) Hospital Information System SQL Injection

Exploit Title: Care2x 2.7 HIS Hospital Information system - Multiples SQL Injection Date: 01/17/2019 Software Links/Project: https://github.com/care2x/care2x | http://www.care2x.org/ Version: Care2x 2.7 Exploit Author: Carlos Avila Category: webapps Tested on: Windows 8.1 / Ubuntu Linux Contact:...

Ticketly 1.0 - 'name' SQL Injection

Exploit Title: Ticketly 1.0 – 'name' SQL Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-11-19 Google Dork: N/A Vendor: Abisoft https://abisoftgt.net Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql Affected Version: 1...

CVE-2018-14691

An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0-param2, c0-param3, and c0-param4 parameters to dwr/call/plaincall/tagService.setTags.dwr that could be used to steal session information of a victim...

Twitter-Clone 1 - 'code' SQL Injection

Exploit Title: Twitter-Clone 1 - 'code' SQL Injection Date: 2018-08-22 Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 vulnerable files : mailactivation.php , stalkers.php , search.php vulnerable parameters : name , code , id...