CVE-2021-29447

CVE-2021-29447 - WordPress XXE Vulnerability Exploit Description This repository contains an exploit for CVE-2021-29447, an XXE XML External Entity vulnerability present in WordPress 5.7.0 and earlier versions. The vulnerability exists in the media library that processes WAV files, allowing an...

CVE-2021-29447-POC

CVE-2021-29447-POC About This script automates the required steps to exploit CVE-2021-29447 in the media upload funnctionality in Wordpress and use it to extract files vi an XXE. Usage ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port LOCALPORT...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE in WordPress WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file With wavefile npm $ make make-wav Step4...

blind-xxe-controller-CVE-2021-29447

Blind XXE controller I make this controller on doing metatwo machine in HackTheBox to exploiting CVE-2021-29447 which Is a WordPress XXE Vulnerability in Media Library affected version 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. where an authenticated user with ability to upload media library can upload...

CVE-2021-29447

Installation and Execution Sequence 0. Run Docker $docker-compose up 1. Execute wordpress.sh Configure the wp-config.php file before installing WordPress. $docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh" 2. Install WordPress Access the WordPress site uploaded to the...

cve-2021-29447_auto-script

CVE-2021-29447: WordPress Media Library XXE Vulnerability This repository details the CVE-2021-29447 vulnerability, a critical security flaw in WordPress that allowed for authenticated XML External Entity XXE attacks through the Media Library. It also provides an automatic script that demonstrate...

CVE-2021-29447

WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file Without wavefile npm Recommend $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick; \x00'...

Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

Project Goal: To demonstrate a complete attack chain on a vulnerable WordPress installation, exploiting CVE-2021-29447 XXE in media library to achieve remote code execution and full system compromise. Phase 1: Reconnaissance & Enumeration Network Scanning with Nmap: bash Quick SYN scan to discove...

CVE-2021-29447

WAV iXML XXE Exploit Generator Generates malicious WAV files that exploit XXE vulnerabilities in WordPress plugins parsing iXML metadata chunks e.g., BookingPress │ Target │ └──────────┘ └──────────┘ ▲ │ │ │ 2. Parse XML │ │ │ 3. GET /xxe.dtd │ │─────────────────────────────┘ │ │ 4. GET...

CVE-2021-29447

CVE-2021-29447 Impact Arbitrary File Disclosure: the content of any file on the host’s file system could be retrieved, e.g. wp-config.php which contains sensitive data such as database credentials. Server-Side Request Forgery SSRF: HTTP requests could be made on behalf of the WordPress...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Bad Plugins vulnerability (USN-8855-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8855-1 advisory. It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio...

AlmaLinux 9.6 [TuxCare] Security Update: taglib / taglib-devel (ALMALINUX9.6:CLSA-2026:1777540469)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777540469 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is...

Rocky Linux 8 [CIQ] Security Update: libsndfile / libsndfile-debuginfo / libsndfile-debugsource / etc (crlsa-2021_3253)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213253 advisory. libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution CVE-2021-3246 Tenable has extracted the preceding description block directly...

Rocky Linux 9.6 [TuxCare] Security Update: taglib / taglib-devel (ALMALINUX9.6:CLSA-2026:1777540469)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777540469 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk i...

AlmaLinux 9.2 [TuxCare] Security Update: taglib / taglib-devel (ALMALINUX9.2:CLSA-2025:1754552791)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754552791 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is...

CentOS Linux 7 [TuxCare] Security Update: taglib / taglib-devel / taglib-doc (CENTOS7:CLSA-2026:1778161748)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778161748 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the...

Rocky Linux 9 [CIQ] Security Update: speex / speex-debuginfo / speex-debugsource / speex-devel (crlsa-2022_7979)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227979 advisory. speex: divide by zero in readsamples via crafted WAV file CVE-2020-23903 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

AlmaLinux 9.2 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.2:CLSA-2026:1780592196)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780592196 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

Rocky Linux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code...