Joomla iProperty Real Estate 4.1.1 Cross Site Scripting

Exploit Title: Joomla iProperty Real Estate 4.1.1 - Reflected XSS Exploit Author: CraCkEr Date: 29/07/2023 Vendor: The Thinkery LLC Vendor Homepage: http://thethinkery.net Software Link: https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/ Demo:...

Zomplog 3.9 Remote Code Execution

Exploit Title: zomplog 3.9 - Remote Code Execution RCE Application: zomplog Version: v3.9 Bugs: RCE Technology: PHP Vendor URL: http://zomp.nl/zomplog/ Software Link: http://zomp.nl/zomplog/downloads/zomplog/zomplog3.9.zip Date of found: 22.07.2023 Author: Mirabbas Ağalarov Tested on: Linux impor...

Rudder Server SQL Injection / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rudder Server SQLI Remote Code Execution', 'Description' = %q This Metasploit module exploits a SQL injection vulnerability in RudderStack's...

Keeper Security Desktop 16.10.2 / Browser Extension 16.5.4 Password Dumper

Exploit Title: Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Google Dork: NA Date: 22-07-2023 Exploit Author: H4rk3nz0 Vendor Homepage: https://www.keepersecurity.com/enGB/ Software Link: https://www.keepersecurity.com/enGB/get-keeper.html Version: Desktop App...

WordPress AN_Gradebook 5.0.1 SQL Injection

!/usr/bin/python3 Exploit Title: WordPress Plugin ANGradebook = 5.0.1 - Subscriber+ SQLi Date: 2023-07-26 Exploit Author: Lukas Kinneberg Github: https://github.com/lukinneberg/CVE-2023-2636 Vendor Homepage: https://wordpress.org/plugins/an-gradebook/ Software Link:...

CMSninesol 1.0 Cross Site Scripting

==================================================================================================================================== | Title : CMSninesol v1.0 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bit | | Vendor :...

Western Digital MyCloud Unauthenticated Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Western Digital MyCloud unauthenticated command injection', 'Description' = %q This module exploits authentication bypass CVE-2018-17153 and...

Joomla Solidres 2.13.3 Cross Site Scripting

Exploit Title: Joomla Solidres 2.13.3 - Reflected XSS Exploit Author: CraCkEr Date: 28/07/2023 Vendor: Solidres Team Vendor Homepage: http://solidres.com/ Software Link: https://extensions.joomla.org/extension/vertical-markets/booking-a-reservations/solidres/ Demo: http://demo.solidres.com/joomla...

WonderCMS 0.6-Beta Password Disclosure

==================================================================================================================================== | Title : WonderCMS v0.6-Beta Password Disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

Aicte India LMS 3.0 SQL Injection

==================================================================================================================================== | Title : Aicte india LMS 3.0 SQL injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 115.0.264-bit...

AMSS++ 5.21.09 SQL Injection

==================================================================================================================================== | Title : AMSS++ V5.21.09 JT SQL injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 115.0.264-bit ...

B-OBEC V.092019 SQL Injection

==================================================================================================================================== | Title : B-OBEC V.092019 SQL injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | |...

AMS Logistics 2.2 SQL Injection

==================================================================================================================================== | Title : AMS LOGISTICS 2.2 SQL injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | |...

Ciuis CRM 1.0.7 Local File Inclusion

==================================================================================================================================== | Title : Ciuis™ CRM v1.0.7 LFI Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit | | Vendor :...

XLAgenda 4.4 Cross Site Request Forgery

==================================================================================================================================== | Title : XLAgenda v4.4 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 65.032-bit | | Vendor :...

Job Portal CMS 2.3.0.2 SQL Injection

==================================================================================================================================== | Title : Job Portal CMS V2.3.0.2 Sql Injection Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 Français V.Pro | | Vendor ...

Cloud Base Multiple School Generate And Management System 4.6.0 SQL Injection

==================================================================================================================================== | Title : Cloud Base Multiple school Generate & Management System v4.6.0 Sql Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pr...

BMIT BMS 2.1 SQL Injection

==================================================================================================================================== | Title : BMIT BMS 2.1 Auth BY Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vendor...

Buzzy News Viral Lists Polls And Videos 2.5.1 Insecure Settings

====================================================================================================================================== | Title : Buzzy - News Viral Lists Polls and Videos V 2.5.1 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro /...

xForUp Simple File Uploader 1.0 SQL Injection

==================================================================================================================================== | Title : xForUp simple file uploader V1.0 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro | | Vendor :...

Availability Booking Calendar PHP XSS / Arbitrary File Upload

Exploit Title: Availability Booking Calendar PHP - Multiple Issues Date: 07/2023 Exploit Author: Andrey Stoykov Tested on: Ubuntu 20.04 Blog: http://msecureltd.blogspot.com XSS 1: Steps to Reproduce: 1. Browse to Bookings 2. Select All Bookings 3. Edit booking and select Promo Code 4. Enter paylo...

Joomla Fireboard 1.3 SQL Injection

==================================================================================================================================== | Title : Joomla com fireboard v1.3 SQL Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3...

Journal Management Software 1.2.4 SQL Injection

==================================================================================================================================== | Title : Journal Management Software V1.2.4 Sql injection | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bi...

Joomla JSN Gruve Pro 2.1.0 Directory Traversal

==================================================================================================================================== | Title : joomla jsn gruve pro v2.1.0 Directory traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

Joomla Jomestate 4.0 SQL Injection

==================================================================================================================================== | Title : Joomla com jomestate v4.0 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3...

ETSI WEBstore 2023 Cross Site Scripting

Document Title: =============== ETSI WEBstore 2023 - Persistent Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2327 Release Date: ============= 2023-07-26 Vulnerability Laboratory ID VL-ID: ====================================...

VMWare Aria Operations For Networks Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Aria Operations for Networks vRealize Network Insight pre-authenticated RCE', 'Description' = %q VMWare Aria Operations for Networks...

Joomla VirtueMart 2.6.12.2 SQL Injection

==================================================================================================================================== | Title : Joomla VirtueMart v2.6.12.2 SQL Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

Joomla HotelGuide 1.0 Cross Site Scripting

==================================================================================================================================== | Title : Joomla HotelGuide Components v1.0 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 65.0 32-b...

WordPress Page Builder KingComposer 2.9.6 Cross Site Scripting

==================================================================================================================================== | Title : WordPress Page Builder KingComposer 2.9.6 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

BRSS CMS 2.1 SQL Injection

==================================================================================================================================== | Title : BRSS CMS 2.1 Auth BY Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vendor...

WordPress Page Builder KingComposer 2.8.1 Cross Site Scripting

==================================================================================================================================== | Title : WordPress Page Builder KingComposer 2.8.1 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

CMSgrafia 7 SQL Injection

====================================================================================================================================== | Title : CMSgrafia v7 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 61.0.1 32-bit | |...

WordPress Seo By 10Web Cross Site Scripting

Tittle: WordPress Plugin Seo By 10Web 4. Save to trigger the XSS. Classification: Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/a76b6d22-1e00-428a-8a04-12162bd0d992...

WordPress KAP Theme 2.0 Directory Traversal

==================================================================================================================================== | Title : Wordpress KAP-theme v2.0 Directory Traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

WordPress WP Brutal AI Cross Site Scripting

Tittle: WordPress Plugin WP Brutal AI 2.0.1 - Admin + Reflected XSS References: CVE-2023-2605 Author: Taurus Omar Description: The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logge...

WordPress Login Configurator 2.1 Cross Site Scripting

Tittle: WordPress Plugin Login Configurator = 2.1 - Reflected Cross-Site Scripting References: CVE-2023-1893 Author: Taurus Omar Description: The plugin does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting...

WordPress WP Brutal AI Cross Site Scripting

Tittle: WordPress Plugin WP Brutal AI " 3. Save the changes to trigger XSS. Classification: Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8f...

Google Chrome 115.0.5790.102 Memory Corruption

/ Google Chrome WebGPU Memory Corruption Author: Jean Pereira Released: 2023/06/25 Vendor: https://www.google.com Software: https://www.google.com/chrome/ Tested with version: 115.0.5790.102 latest version / navigator.gpu.requestAdapter.thena = a.requestDevice.thend = const b = d.createBuffer...

WordPress U Parts Themes 4.9.x Directory Traversal

==================================================================================================================================== | Title : WordPress U Parts Themes v4.9.x Directory Traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

Cloud Base Multiple School Generate And Management System 4.6.0 Insecure Settings

==================================================================================================================================== | Title : Cloud Base Multiple school Generate & Management System v4.6.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français...

WordPress Login Rebuilder Cross Site Scripting

Tittle: WordPress Plugin Login Rebuilder " 3. Save the changes to trigger XSS. Classification: Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/7b356b82-5d03-4f70-b4ce-f1405304bb52...

Joomla HikaShop 4.7.4 Cross Site Scripting

Exploit Title: Joomla HikaShop 4.7.4 - Reflected XSS Exploit Author: CraCkEr Date: 24/07/2023 Vendor: Hikari Software Team Vendor Homepage: https://www.hikashop.com/ Software Link: https://demo.hikashop.com/index.php/en/ Joomla Extension Link:...

WordPress Events Manager 5.61 SQL Injection

==================================================================================================================================== | Title : Wordpress Events Manager plugin 5.61 Blind SQL Injection | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

WordPress Oxygen-Theme 7.8 Directory Traversal

==================================================================================================================================== | Title : WordPress Oxygen-Theme v7.8 Directory Traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

WordPress WP Brutal AI Cross Site Request Forgery / SQL Injection

Tittle: WordPress Plugin WP Brutal AI 2.0.0 - SQL Injection via CSRF References: CVE-2023-2601 Author: Taurus Omar Description: The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF. Affects Plugin...

WordPress File Manager Advanced Shortcode 2.3.2 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution through shortcode', 'Description' = %q The Wordpress plug...

Joomla VirtueMart Shopping-Cart 4.0.12 Cross Site Scripting

Exploit Title: Joomla VirtueMart Shopping-Cart 4.0.12 - Reflected XSS Exploit Author: CraCkEr Date: 24/07/2023 Vendor: VirtueMart Team Vendor Homepage: https://www.virtuemart.net/ Software Link: https://demo.virtuemart.net/ Joomla Extension Link:...

WordPress PrePost SEO 3.0 Cross Site Scripting

Tittle: WordPress Plugin PrePost SEO " 2. Save and see XSS exploit. Classification: Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/4889ad5a-c8c4-4958-b176-64560490497b...

NiceCMS 2.0.8 Insecure Settings

==================================================================================================================================== | Title : NiceCMS V 2.0.8 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit ...