iScripts SonicBB 1.0 - Reflected Cross-Site Scripting (PoC)

Exploit Title: iScripts SonicBB 1.0 - Reflected Cross-Site Scripting Date: 02/04/2018 Exploit Author: ManhNho Vendor Homepage: https://www.iscripts.com Demo Page: https://www.demo.iscripts.com/sonicbb/demo/ Version: 1.0 Tested on: Windows 10 Category: Webapps CVE: CVE-2018-9235 1. Description...

WooCommerce CSV-Importer-Plugin 3.3.6 - Remote Code Execution

Exploit Title: Plugin Woocommerce CSV importer 3.3.6 – RCE – Unlink Date: 08/04/2018 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/woocommerce-csvimport/ Software Link: https://wordpress.org/plugins/woocommerce-csvimport/ Contact: http://twitter.com/lenonleite Website...

Yahei PHP Prober 0.4.7 - Cross-Site Scripting

Exploit title: Yahei-PHP Proberv0.4.7 - Cross-Site Scripting Google Dork: intitle:"Proberv0." | inurl:/proberv.php Date: 23/03/2018 Exploit Author: ManhNho Vendor Homepage: http://www.yahei.net/ Software Link: www.yahei.net/tz/tze.zip Version: 0.4.7 CVE: CVE-2018-9238 Tested on: Windows 10 / Kali...

Buddypress Xprofile Custom Fields Type 2.6.3 - Remote Code Execution

Exploit Title: Plugin Buddypress Xprofile Custom Fields Type 2.6.3 RCE – Unlink Date: 08/04/2018 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/ Software Link: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/...

GetSimple CMS 3.3.13 - Cross-Site Scripting

GetSimple CMS 3.3.13 - Cross-Site Scripting Exploit Title: GetSimple CMS 3.3.13 - Cross Site Scripting Vulnerability Google Dork: N/A Date: 03-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://get-simple.info/ Software Link:...

Joomla! Component JS Jobs 1.2.0 - Cross-Site Scripting

Joomla! Component JS Jobs 1.2.0 - Cross-Site Scripting Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting Google Dork: N/A Date: 03-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: https://www.joomsky.com/products/js-jobs.html...

Joomla JS Jobs 1.2.0 Component - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: https://www.joomsky.com/products/js-jobs.html Software Link:...

GetSimple CMS 3.3.13 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: GetSimple CMS 3.3.13 - Cross Site Scripting Vulnerability Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://get-simple.info/ Software Link: http://get-simple.info/download/ Affected...

Joomla JS Jobs 1.2.0 Cross Site Scripting

Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting Google Dork: N/A Date: 03-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: https://www.joomsky.com/products/js-jobs.html Software Link: https://www.joomsky.com/5/download/1.html...

Joomla! Component JS Jobs 1.2.0 - Cross-Site Scripting

Exploit Title: Joomla! Component JS Jobs 1.2.0 - Cross Site Scripting Google Dork: N/A Date: 03-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: https://www.joomsky.com/products/js-jobs.html Software Link: https://www.joomsky.com/5/download/1.html...

GetSimple CMS 3.3.13 - Cross-Site Scripting

Exploit Title: GetSimple CMS 3.3.13 - Cross Site Scripting Vulnerability Google Dork: N/A Date: 03-04-2018 Exploit Author: Sureshbabu Narvaneni Author Blog : http://nullnews.in Vendor Homepage: http://get-simple.info/ Software Link: http://get-simple.info/download/ Affected Version: 3.3.13...

IBM Virtual Security Operations Center (VSOC) Cross Site Scripting Vulnerability

Exploit for windows platform in category web applications Exploit Title: IBM Virtual Security Operations Center VSOC - Cross Site Scripting XSS Date: August 2, 2018 Portal Link: https://portal.sec.ibm.com Exploit Author: Kushal Jaisingh Contact: https://ca.linkedin.com/in/kushaljaisingh Category:...

WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting

WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting Exploit Title : Relevanssi Wordpress Search Plugin Reflected Cross Site Scripting XSS Date: 23-03-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://www.relevanssi.com Softwar...

TwonkyMedia Server 7.0.11-8.5 Cross Site Scripting

--------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS Date: 2018-03-27 Exploit Author: Sven Fassbender Contact: https://twitter.com/mezdanak...

TwonkyMedia Server 7.0.11-8.5 - Directory Traversal

''' --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Directory Traversal Date: 2018-03-27 Exploit Author: Sven Fassbender Contact:...

TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting

--------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS Date: 2018-03-27 Exploit Author: Sven Fassbender Contact: https://twitter.com/mezdanak...

WordPress Duplicator 1.2.32 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting XSS Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://snapcreek.com/ Software Link:...

Spring Data REST 2.6.9 (Ingalls SR9) 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 Ingalls SR9 3.0.1 Kay SR1 - PATCH Request Remote Code Execution // Exploit Title: RCE in PATCH requests in Spring Data REST // Date: 2018-03-10 // Exploit Author: Antonio Francesco Sardella // Vendor Homepage: https://pivotal.io/ // Software Link:...

WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting

WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://snapcreek.com/ Software Link:...

Bravo Tejari Web Portal - Cross-Site Request Forgery

Exploit Title: Bravo Tejari Web Portal-CSRF CVE-ID: CVE-2018-7216 Vulnerability Type: Cross Site Request Forgery CSRF Vendor of Product: Tejari Affected Product Code Base: Bravo Solution Affected Component: Web Interface Management. Attack Type: Local - Authenticated Impact: Unauthorised Access...