11805 matches found
Exploit for Use After Free in Microsoft
Home-Demolisher PoC for CVE-2021-31166 and CVE-2022-21907...
Checkout for PayPal < 1.0.14 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the following shortcode in a page/post...
Unauthorized access to settings update, logs , history, delete etc of repositories
Hey, Attack Scenario: Admin setups new user with User privileges and gives access to repos "/" root directory, after a time due to some reason he revoke the privileges of the directory access but user privileged attacker can still edit settings , check logs and view history without having...
AlmaLinux 9 : poppler (ALSA-2022:8151)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:8151 advisory. - A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service DoS via a crafted PDF file. CVE-2022-27337 Note that...
Backdoor.Win32.Quux MVID-2022-0656 Hardcoded Credential
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/13ce53de9ca4c4e6c58f990b442cb419.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Quux Vulnerability: Weak Hardcoded Credentials Family: Quux Type: PE32 MD5:...
Exploit for SQL Injection in Glpi-Project Glpi
CVE-2022-31061 PoC for GLPI CVE-2022-31061 A Proof of Concept...
Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF
The plugin does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks PoC Make a logged in admin open a page containing the HTML cod...
Reentrancy attack can be used to externally call the _execute function in the Exchange contract
Lines of code Vulnerability details Reentrancy attack can be used to externally call the execute function in the Exchange contract The execute function present in the Exchange contract is intended to be called only internally using delegatecall by the execute and bulkExecute functions. This is...
MSNSwitch Firmware MNT.2408 - Remote Code Exectuion Exploit
Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion RCE Exploit Author: Eli Fulkerson Vendor Homepage: https://www.msnswitch.com/ Version: MNT.2408 Tested on: MNT.2408 firmware CVE: CVE-2022-32429 !/usr/bin/python3 """ POC for unauthenticated configuration dump, authenticated RCE o...
MSNSwitch Firmware MNT.2408 Remote Code Execution
Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion RCE Google Dork: n/a Date:9/1/2022 Exploit Author: Eli Fulkerson Vendor Homepage: https://www.msnswitch.com/ Version: MNT.2408 Tested on: MNT.2408 firmware CVE: CVE-2022-32429 !/usr/bin/python3 """ POC for unauthenticated...
Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure
The plugin is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options. PoC - Install the plugin and set the API creds to: - Key:...
Unintended API key generation
Description The API keys sections are vulnerable to CSRF. The aggressor can generate the key on the admin's account without prior knowledge of admin credentials. The successful CSRF will generate new keys on the admin's account. Proof of Concept history.pushState'', '', '/' document.forms0.submit...
Governor ownership can be lost because of not sanity check
Lines of code Vulnerability details Governor ownership can be lost because of no checks Impact Sanity checks are important to not affect reputation / flows and users of the protocol when a mistake is done. 0 address should be checked for important address assignments in this case, only done in th...
Seed Social < 2.0.4 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Put the following payload in any of the...
Exploit for Improper Access Control in Webmin
WebminRCE-exploit CVE-2022-0824, CVE-2022-0829 - File Manger p...
WebKit HTMLSelectElement Use-After-Free Exploit
WebKit use-after-free in HTMLSelectElement There is a use-after-free in HTMLSelectElement. If the length of the HTMLSelectElement is set to a value greater than the existing options length then dummy HTMLOptionElements elements are created. These HTMLOptionsElements are stored as raw pointers in...
Exploit for Improper Restriction of XML External Entity Reference in Wordpress
CVE-2021-29447 Proof of Concept Proof of Concept for CVE-2021...
Unauthenticated stored XSS via username & name parameters
There is a stored XSS vulnerability due to improper sanitization of usernames. Vulnerable code User.php line 532: php public function isValidLoginstring $login: bool $login = string$login; if strlen$login loginMinLength || !pregmatch$this-validUsername, $login $this-errors =...
Exploit for Server-Side Request Forgery in Apache Solr
CVE-2021-27905.POC POC for LFI related to CVE-2021-27905 POC...
PT-2022-21679 Β· Undefined Β· Undefined
"Source": "https://t.me/documentors", "Content": "CVE-2022-33679.zip 1.2 MB π₯π₯π₯CVE-2022-33679Windows Kerberos Elevation of Privilege - PoC exploit usage: CVE-2022-33079.py -h -ts -debug -dc-ip ip address target serverName", "author": "βοΈππ¬π π²πͺπ’π«π±π¬π―", "Detection Date": "04 Nov 2022", "Type": "Data...