Skip to content

Archives: Exploits

Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection

NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi

Prestashop blockwishlist module 2.1.0 – SQLi

OpenCart v3.x Newsletter Module – Blind SQLi

Joomla Plugin SexyPolling 2.1.7 – SQLi

Drupal avatar_uploader v7.x-1.0-beta8 – Cross Site Scripting (XSS)

opencart 3.0.3.8 – Sessjion Injection

Opencart 3 Extension TMD Vendor System – Blind SQL Injection

Balbooa Joomla Forms Builder 2.0.6 – SQL Injection (Unauthenticated)

Drupal Module MiniorangeSAML 8.x-2.22 – Privilege escalation

OpenCart 3.0.3.7 – ‘Change Password’ Cross-Site Request Forgery (CSRF)

PrestaShop 1.7.6.7 – ‘location’ Blind Sql Injection

Joomla JCK Editor 6.4.4 – ‘parent’ SQL Injection (2)

Prestashop 1.7.7.0 – ‘id_product’ Time Based Blind SQL Injection

OpenCart 3.0.36 – ATO via Cross Site Request Forgery

PrestaShop ProductComments 4.2.0 – ‘id_products’ Time Based Blind SQL Injection

OpenCart 3.0.3.6 – Cross Site Request Forgery

Joomla! Component GMapFP 3.5 – Unauthenticated Arbitrary File Upload

OpenCart 3.0.3.6 – ‘subject’ Stored Cross-Site Scripting

OpenCart 3.0.3.6 – ‘Profile Image’ Stored Cross-Site Scripting (Authenticated)

Joomla Plugin Simple Image Gallery Extended (SIGE) 3.5.3 – Multiple Vulnerabilities

OpenCart Theme Journal 3.1.0 – Sensitive Data Exposure

Joomla! paGO Commerce 2.5.9.0 – SQL Injection (Authenticated)

Joomla! J2 JOBS 1.3.0 – ‘sortby’ Authenticated SQL Injection

Joomla! J2 Store 3.3.11 – ‘filter_order_Dir’ Authenticated SQL Injection

OpenCart 3.0.3.2 – Stored Cross Site Scripting (Authenticated)

Joomla! Plugin XCloner Backup 3.5.3 – Local File Inclusion (Authenticated)

Prestashop 1.7.6.4 – Cross-Site Request Forgery

Joomla! com_fabrik 3.9.11 – Directory Traversal

Joomla! Component GMapFP 3.30 – Arbitrary File Upload

Joomla! com_hdwplayer 4.2 – ‘search.php’ SQL Injection

Joomla! Component ACYMAILING 3.9.0 – Unauthenticated Arbitrary File Upload

Joomla! Component com_newsfeeds 1.0 – ‘feedid’ SQL Injection

Joomla! 3.9.0 < 3.9.7 - CSV Injection

Joomla! 3.4.6 – Remote Code Execution (Metasploit)

Joomla! 3.4.6 – Remote Code Execution

Joomla! 3.4.6 – ‘configuration.php’ Remote Code Execution

Opencart 3.x – Cross-Site Scripting

Joomla! component com_jsjobs 1.2.6 – Arbitrary File Deletion

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 – ‘customfields.php’ SQL Injection

Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 – ‘ticketreply.php’ SQL Injection

Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 – ‘ticket.php’ Arbitrary File Deletion

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 – ‘cities.php’ SQL Injection

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – SQL Injection

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – Arbitrary File Download

Opencart 3.0.3.2 – ‘extension/feed/google_base’ Denial of Service (PoC)

Joomla! Component JiFile 2.3.1 – Arbitrary File Download

Joomla! Component ARI Quiz 3.7.4 – SQL Injection

Joomla! Core 1.5.0 – 3.9.4 – Directory Traversal / Authenticated Arbitrary File Deletion

Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)