Forced Browsing in slackero/phpwcms

✍️ Description Image cache can be flushed by any authenticated, low privileged user. 🕵️‍♂️ Proof of Concept - Register a low privileged user without any administrator access. - Log in with the low privileged user - Open the following URL:...

Forced Browsing in slackero/phpwcms

✍️ Description A malicious actor is able to reveal the list and details of newsletter subscribers. 🕵️‍♂️ Proof of Concept - Method 1; This method requires a proxy utility, like BurpSuite. - With an administrator user, create some subscribers on the newsletters under CommunicationNewsletter...

WordPress Video Embed plugin SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress Vide...

CVE-2021-24337

The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page available via forced browsing is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection...

Video Embed <= 1.0 - Authenticated (subscriber+) SQL Injection

The id GET parameter of one of the plugin's page available via forced browsing is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection. PoC Note: The URL /wp-admin/admin.php?page=edit-video-embed=1 is...

Video Embed <= 1.0 - Authenticated (subscriber+) SQL Injection

The id GET parameter of one of the plugin's page available via forced browsing is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection. Note: The URL /wp-admin/admin.php?page=edit-video-embed&id=1 is...

CVE-2020-7541

A CWE-425: Direct Request 'Forced Browsing' vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions, that could cause disclosure of sensitive data when sending a...

CVE-2020-7541

A CWE-425: Direct Request 'Forced Browsing' vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions, that could cause disclosure of sensitive data when sending a...

CVE-2020-7541

The CVE-2020-7541 issue affects Schneider Electric Modicon devices: Modicon M340 Web Server, Legacy Modicon Quantum and Modicon Premium, and related Communication Modules. It is a CWE-425 Direct Request (Forced Browsing) flaw that could disclose sensitive data when a specially crafted HTTP reques...

Feroxbuster - A Fast, Simple, Recursive Content Discovery Tool Written In Rust

What the heck is a ferox anyway? Ferox is short for Ferric Oxide. Ferric Oxide, simply put, is rust. The name rustbuster was taken, so I decided on a variation. What's it do tho? feroxbuster is a tool designed to perform Forced Browsing. Forced browsing is an attack where the aim is to enumerate...

U.S. Dept Of Defense: Stored XSS via Comment Form at ████████

Summary: An attacker can submit a comment form with injected HTML, leading to a number of malicious effects Step-by-step Reproduction Instructions 1. Browse to https://████ 2. Complete the form. I placed " in the Name field. Some example payloads for the Comments field are as follows: For...

CTFd 2.1.5 Administrator Account Takeover

Exploit Title: CTFd Administrator Account Takeover Date: 2/1/20 Exploit Author: Social Engineering Neo - @EngineeringNeo Vendor Homepage: https://ctfd.io Software Link: https://github.com/CTFd/CTFd/releases/tag/2.1.5 Version: CTFd Local/Remote Hosting 2.1.5 and below Tested on: CTFd 2.1.5 CTFd...

Microsoft Lync for Mac 2011 - Injection Forced BrowsingDownload

Microsoft Lync for Mac 2011 - Injection Forced BrowsingDownload Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download Author: @nyxgeek - TrustedSec Date: 2018-03-20 Vendor Homepage: microsoft.com Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=36517...

Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download

Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download Author: @nyxgeek - TrustedSec Date: 2018-03-20 Vendor Homepage: microsoft.com Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=36517 CVE: CVE-2018-8474 Version: Lync:Mac 2011 14.4.3, likely earlie...

Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download Exploit

Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download Author: @nyxgeek - TrustedSec Vendor Homepage: microsoft.com Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=36517 CVE: CVE-2018-8474 Version: Lync:Mac 2011 14.4.3, likely earlier versions Tested...

Authentication flaw

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561...

CVE-2017-14993

OXID eShop Community Edition before 6.0.0 RC3 development, 4.10.x before 4.10.6 maintenance, and 4.9.x before 4.9.11 legacy, Enterprise Edition before 6.0.0 RC3 development, 5.2.x before 5.2.11 legacy, and 5.3.x before 5.3.6 maintenance, and Professional Edition before 6.0.0 RC3 development, 4.9....

Buffer overflow

OXID eShop Community Edition before 6.0.0 RC3 development, 4.10.x before 4.10.6 maintenance, and 4.9.x before 4.9.11 legacy, Enterprise Edition before 6.0.0 RC3 development, 5.2.x before 5.2.11 legacy, and 5.3.x before 5.3.6 maintenance, and Professional Edition before 6.0.0 RC3 development, 4.9....

CVE-2017-14993

OXID eShop (Community Edition) affected: versions prior to 6.0.0 RC3 (development), 4.10.x prior to 4.10.6 (maintenance), 4.9.x prior to 4.9.11 (legacy); Enterprise Edition prior to 6.0.0 RC3 (development), 5.2.x prior to 5.2.11 (legacy), 5.3.x prior to 5.3.6 (maintenance); Professional Edition p...

CVE-2017-14993

OXID eShop Community Edition before 6.0.0 RC3 development, 4.10.x before 4.10.6 maintenance, and 4.9.x before 4.9.11 legacy, Enterprise Edition before 6.0.0 RC3 development, 5.2.x before 5.2.11 legacy, and 5.3.x before 5.3.6 maintenance, and Professional Edition before 6.0.0 RC3 development, 4.9....