Skip to content

Archives: Exploits

Joomla! Component J2Store < 3.3.7 - SQL Injection

Drupal < 8.6.9 - REST Module Remote Code Execution

Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution

Joomla! Component JHotelReservation 6.0.7 – SQL Injection

Joomla! Component J-CruisePortal 6.0.4 – SQL Injection

Joomla! Component vBizz 1.0.7 – Remote Code Execution

Joomla! Component VMap 1.9.6 – SQL Injection

Joomla! Component vRestaurant 1.9.4 – SQL Injection

Joomla! Component vBizz 1.0.7 – SQL Injection

Joomla! Component J-BusinessDirectory 4.9.7 – ‘type’ SQL Injection

Joomla! Component vReview 1.9.11 – SQL Injection

Joomla! Component J-ClassifiedsManager 3.0.5 – SQL Injection

Joomla! Component vWishlist 1.0.1 – SQL Injection

Joomla! Component JMultipleHotelReservation 6.0.7 – SQL Injection

Joomla! Component vAccount 2.0.2 – ‘vid’ SQL Injection

Joomla! Component Easy Shop 1.2.3 – Local File Inclusion

Joomla! Core 3.9.1 – Persistent Cross-Site Scripting in Global Configuration Textfilter Settings

Joomla! Component JoomProject 1.1.3.2 – Information Disclosure

Joomla! Component JoomCRM 1.1.1 – SQL Injection

PrestaShop 1.6.x/1.7.x – Remote Code Execution

Joomla! Component Jimtawl 2.2.7 – ‘id’ SQL Injection

Joomla! Component Dutch Auction Factory 2.0.2 – ‘filter_order_Dir’ SQL Injection

Joomla! Component Article Factory Manager 4.3.9 – SQL Injection

Joomla! Component AlphaIndex Dictionaries 1.0 – SQL Injection

Joomla! Component Collection Factory 4.1.9 – SQL Injection

Joomla! Component eXtroForms 2.1.5 – ‘filter_type_id’ SQL Injection

Joomla! Component Jobs Factory 2.0.4 – SQL Injection

Joomla! Component Auction Factory 4.5.5 – ‘filter_order’ SQL Injection

Joomla! Component CW Article Attachments 1.0.6 – ‘id’ SQL Injection

Joomla! Component JCK Editor 6.4.4 – ‘parent’ SQL Injection

PrestaShop < 1.6.1.19 - 'AES CBC' Privilege Escalation

PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation

Joomla! Component Jomres 9.11.2 – Cross-Site Request Forgery (Add User)

Joomla! Component Ek Rishta 2.10 – SQL Injection

Joomla! Component EkRishta 2.10 – ‘username’ SQL Injection

Joomla! Component EkRishta 2.10 – ‘cid’ SQL Injection

Joomla! Component JoomOCShop 1.0 – Cross-Site Request Forgery

Joomla! Component Full Social 1.1.0 – ‘search_query’ SQL Injection

Joomla! Component jCart for OpenCart 2.3.0.2 – Cross-Site Request Forgery

Joomla! Component EkRishta 2.10 – Cross-Site Scripting / SQL Injection

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)

Drupal avatar_uploader v7.x-1.0-beta8 – Arbitrary File Disclosure

Joomla! Component JS Jobs 1.2.0 – Cross-Site Request Forgery

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)

Joomla! Component jDownloads 3.2.58 – Cross Site Scripting

Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)

Joomla! Component AcySMS 3.5.0 – CSV Macro Injection

Joomla! Component Acymailing Starter 5.9.5 – CSV Macro Injection