WordPress File Manager Advanced Shortcode 2.3.2 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution through shortcode', 'Description' = %q The Wordpress plug...

CMSgrafia 7 SQL Injection

====================================================================================================================================== | Title : CMSgrafia v7 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 61.0.1 32-bit | |...

WordPress KAP Theme 2.0 Directory Traversal

==================================================================================================================================== | Title : Wordpress KAP-theme v2.0 Directory Traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

WordPress Oxygen-Theme 7.8 Directory Traversal

==================================================================================================================================== | Title : WordPress Oxygen-Theme v7.8 Directory Traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

WordPress Events Manager 5.61 SQL Injection

==================================================================================================================================== | Title : Wordpress Events Manager plugin 5.61 Blind SQL Injection | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

WordPress Tablesome Cross Site Scripting

Tittle: WordPress Plugin Tablesome alert/XSS/ https://example.com/wp-admin/edit.php?posttype=tablesomecpt&cantracktablesomeevents=1&alert/XSS/ Classification: Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/8ef64490-30cd-4e07-9b7c-64f551944f3d...

Cloud Base Multiple School Generate And Management System 4.6.0 Insecure Settings

==================================================================================================================================== | Title : Cloud Base Multiple school Generate & Management System v4.6.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français...

Joomla VirtueMart Shopping-Cart 4.0.12 Cross Site Scripting

Exploit Title: Joomla VirtueMart Shopping-Cart 4.0.12 - Reflected XSS Exploit Author: CraCkEr Date: 24/07/2023 Vendor: VirtueMart Team Vendor Homepage: https://www.virtuemart.net/ Software Link: https://demo.virtuemart.net/ Joomla Extension Link:...

WordPress Login Configurator 2.1 Cross Site Scripting

Tittle: WordPress Plugin Login Configurator = 2.1 - Reflected Cross-Site Scripting References: CVE-2023-1893 Author: Taurus Omar Description: The plugin does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting...

WordPress Page Builder KingComposer 2.9.6 Cross Site Scripting

==================================================================================================================================== | Title : WordPress Page Builder KingComposer 2.9.6 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

Joomla HikaShop 4.7.4 Cross Site Scripting

Exploit Title: Joomla HikaShop 4.7.4 - Reflected XSS Exploit Author: CraCkEr Date: 24/07/2023 Vendor: Hikari Software Team Vendor Homepage: https://www.hikashop.com/ Software Link: https://demo.hikashop.com/index.php/en/ Joomla Extension Link:...

BRSS CMS 2.1 SQL Injection

==================================================================================================================================== | Title : BRSS CMS 2.1 Auth BY Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vendor...

NiceCMS 2.0.8 Insecure Settings

==================================================================================================================================== | Title : NiceCMS V 2.0.8 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit ...

WordPress Page Builder KingComposer 2.8.1 Cross Site Scripting

==================================================================================================================================== | Title : WordPress Page Builder KingComposer 2.8.1 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

Google Chrome 115.0.5790.102 Memory Corruption

/ Google Chrome WebGPU Memory Corruption Author: Jean Pereira Released: 2023/06/25 Vendor: https://www.google.com Software: https://www.google.com/chrome/ Tested with version: 115.0.5790.102 latest version / navigator.gpu.requestAdapter.thena = a.requestDevice.thend = const b = d.createBuffer...

WordPress U Parts Themes 4.9.x Directory Traversal

==================================================================================================================================== | Title : WordPress U Parts Themes v4.9.x Directory Traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

WordPress WP Brutal AI Cross Site Scripting

Tittle: WordPress Plugin WP Brutal AI 2.0.1 - Admin + Reflected XSS References: CVE-2023-2605 Author: Taurus Omar Description: The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logge...

WordPress WP Brutal AI Cross Site Scripting

Tittle: WordPress Plugin WP Brutal AI " 3. Save the changes to trigger XSS. Classification: Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8f...

WordPress Seo By 10Web Cross Site Scripting

Tittle: WordPress Plugin Seo By 10Web 4. Save to trigger the XSS. Classification: Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/a76b6d22-1e00-428a-8a04-12162bd0d992...

Perch 3.2 Cross Site Scripting

Exploit Title: Perch v3.2 - Stored XSS Application: Perch Cms Version: v3.2 Bugs: XSS Technology: PHP Vendor URL: https://grabaperch.com/ Software Link: https://grabaperch.com/download Date of found: 21.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC...

CMSctweb Creative 1.0 Cross Site Scripting

==================================================================================================================================== | Title : CMSctweb creative v 1.0 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 68.032-bit | | Vend...

CMS Ultimate Solutions DreamSus 1.4 Cross Site Scripting

==================================================================================================================================== | Title : CMS Ultimate Solutions DreamSus v1.4 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3...

Perch 3.2 Remote Code Execution

Exploit Title: Perch v3.2 - Remote Code Execution RCE Application: Perch Cms Version: v3.2 Bugs: RCE Technology: PHP Vendor URL: https://grabaperch.com/ Software Link: https://grabaperch.com/download Date of found: 21.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC...

mooDating 1.2 Cross Site Scripting

Exploit Title: mooDating 1.2 - Reflected XSS Exploit Author: CraCkEr aka skalvin Date: 22/07/2023 Vendor: mooSocial Vendor Homepage: https://moodatingscript.com/ Software Link: https://demo.moodatingscript.com/home Tested on: Windows 10 Pro Impact: Manipulate the content of the site CVE:...

CMS Ultimate Solutions DreamSus 1.4 Shell Upload

==================================================================================================================================== | Title : CMS Ultimate Solutions DreamSus v1.4 unrestricted file upload Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...

WordPress Image Optimization 3.8.2 Open Redirection

==================================================================================================================================== | Title : WordPress Image Optimization 3.8.2 Open Redirect Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefo...

WordPress Page Builder KingComposer 2.9.6 Open Redirection

==================================================================================================================================== | Title : WordPress Page Builder KingComposer 2.9.6 Open Redirect Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

Wifi Soft Unibox Administration 3.0 / 3.1 SQL Injection

Exploit Title: Wifi Soft Unibox Administration 3.0 & 3.1 Login Page - Sql Injection Google Dork: intext:"Unibox Administration 3.1", intext:"Unibox 3.0" Date: 07/2023 Exploit Author: Ansh Jain @sudoark Author Contact : [email protected] Vendor Homepage: https://www.wifi-soft.com/ Software Link:...

Listplace Directory Listing Platform 3.0 File Upload / Cross Site Scripting

Exploit Title: Listplace Directory Listing Platform 3.0 - Arbitrary File Upload Exploit Author: CraCkEr Date: 12/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/listplace-a-complete-directory-listing-platform/22 Tested on: Windows 10...

Buzzy News Viral Lists Polls And Videos 2.0 Insecure Settings

====================================================================================================================================== | Title : Buzzy - News Viral Lists Polls and Videos V 2.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / brows...

CMS SAUDI SOFTECH 5.0.2 SQL Injection

========================================================================================= | Title : CMS SAUDI SOFTECH v5.0.2 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit | | Vendor :...

CMS-Bank Mellat Payment Manager 1.0.0 Cross Site Scripting

==================================================================================================================================== | Title : CMS-Bank Mellat Payment Manager v1.0.0 Xss Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

Foody Friend 1.0 Arbitrary File Upload / Cross Site Scripting

Exploit Title: Foody Friend 1.0 - Arbitrary File Upload Exploit Author: CraCkEr Date: 12/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/foody-friend-a-saas-based-web-app-food-ordering-bot-for-telegram-and-messenger/25 Tested on:...

CMS Contabil Bandeirantes 1.0.0 Cross Site Request Forgery

====================================================================================================================================== | Title : CMSContábil Bandeirantes V 1.0.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 61.0.1...

RaidenFTPD 2.4.4005 Buffer Overflow

Exploit Title: RaidenFTPD 2.4.4005 - Buffer Overflow SEH Date: 18/07/2023 Exploit Author: Andre Nogueira Vendor Homepage: https://www.raidenftpd.com/en/ Software Link: http://www.raidenmaild.com/download/raidenftpd2.exe Version: RaidenFTPD 2.4.4005 Tested on: Microsoft Windows 10 Build 19045 1.-...

WordPress ChurcHope Responsive Themes 4.7.x Directory Traversal

==================================================================================================================================== | Title : WordPress - ChurcHope Responsive Themes 4.7.x Directory Traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser...

WordPress Page Builder KingComposer 2.9.5 Open Redirection

==================================================================================================================================== | Title : WordPress Page Builder KingComposer 2.9.5 Open Redirect Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

CMS NEXIN 2.0 Insecure Settings

==================================================================================================================================== | Title : CMS NEXIN engine v2.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

CMS Emlak Scripti 2 Cross Site Scripting

==================================================================================================================================== | Title : CMS Emlak Scripti V2 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 68.032-bit | | Vendor ...

CMS Supported IRF-TH 2.0.6 Cross Site Scripting

==================================================================================================================================== | Title : CMS Supported IRF-TH v2.0.6 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit | ...

CMS TSS-EST 1.0.0 SQL Injection

==================================================================================================================================== | Title : CMS TSS-EST V1.0.0 auth by pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit | ...

Pluck 4.7.18 Remote Shell Upload

Title: pluck-4.7.18 - FI + RCE. Author: nu11secur1ty Date: 07.19.2023 Vendor: https://github.com/pluck-cms/pluck/wiki Software: https://github.com/pluck-cms/pluck Reference: https://portswigger.net/daily-swig/rce Reference: https://portswigger.net/web-security/file-upload Description: The attacke...

CMS D-Creations 1.0 SQL Injection

====================================================================================================================================== | Title : ِCMS D-Creations v1.0 auth by pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 64.0.2...

CMS NaiveScripters 3.0.1 Cross Site Scripting

==================================================================================================================================== | Title : CMS NaiveScripters v3.0.1 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 62.0.3 32-bit | |...

phpFM 1.7.9 Authentication Bypass / Shell Upload

Exploit Title: phpfm v1.7.9 - Authentication type juggling Date: 2023-07-10 Exploit Author: thoughtfault Vendor Homepage: https://www.dulldusk.com/phpfm/ Software Link: https://github.com/dulldusk/phpfm/ Version: 1.6.1-1.7.9 Tested on: Ubuntu 22.04 CVE : N/A """ An authentication bypass exists in...

CMS Made Simple 2.2.17 Server-Side Template Injection

Exploit Title: CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection SSTI Application: CmsMadeSimple Version: v2.2.17 Bugs: SSTI Technology: PHP Vendor URL: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Date of found: 13-07-2023...

ABB FlowX 4.00 Information Disclosure

Exploit Title: ABB FlowX v4.00 - Exposure of Sensitive Information Date: 2023-03-31 Exploit Author: Paul Smith Vendor Homepage: https://new.abb.com/products/measurement-products/flow-computers/spirit-it-flow-x-series Version: ABB Flow-X all versions before V4.00 Tested on: Kali Linux CVE:...

CMS Nexin Adminisztracios Kozpont 1.2 Insecure Settings

==================================================================================================================================== | Title : CMS Nexin Adminisztrációs Központ v1.2 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozill...

CMS Made Simple 2.2.17 Remote Code Execution

Exploit Title: CmsMadeSimple v2.2.17 - Remote Code Execution RCE Application: CmsMadeSimple Version: v2.2.17 Bugs: Remote Code ExecutionRCE Technology: PHP Vendor URL: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Date of found: 12-07-2023 Author:...

CMS EngePlus 2.0.1 Cross Site Scripting

==================================================================================================================================== | Title : CMS EngePlus v2.0.1 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.332-bit | | Vendor...