11806 matches found
Exploit for Uncontrolled Resource Consumption in Axios
Axios Regular Expression Denial Of Service Attack This repo h...
Formula Injection Part Description
Description Formula Injection/CSV Injection in inventree due to Improper Neutralization of Formula Elements in CSV File. Proof of Concept Video PoC link: https://drive.google.com/file/d/1mfBTUDS1iZ4uJfBpc568WgpdZdN5f/view?usp=sharing...
WordPress Motopress Hotel Booking Lite 4.2.4 Plugin - Stored Cross-Site Scripting Vulnerability
Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - Stored Cross-Site Scripting XSS Exploit Author: Sanjay Singh Vendor Homepage: https://motopress.com/ Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip Version: 4.2.4 Tested on:...
Internet Bug Bounty: DoS via lua_read_body() [zhbug_httpd_94]
Greetings. I have found a bug that can crash httpd 2.4.53, causing a denial of service. The bug is that luareadbody modules/lua/luarequest.c uses the value of the Content-Length header to allocate memory. While apreadrequest limits Content-Length's value to a non-negative |aprofft| via a call to...
Exploit for Code Injection in Weblizar School_Management
CVE-2022-1609 Bash poc for CVE-2022-1609 WordPress Weblizar B...
chafa <= 4bac1466 is vulnerable to an out of bounds read vulnerability.
chafa = 4bac1466 is vulnerable to an out of bounds read vulnerability. Building Build chafa with ASANaddress sanitizer sh $ git rev-parse HEAD 4bac14668535c09f6f47552bbd1566097dab4bf8 $ export CFLAGS="-g -O0 -fsanitize=address"; export CXXFLAGS="-g -O0 -fsanitize=address"; export CC=$which...
Exploit for Uncontrolled Resource Consumption in Rust-Lang Regex
POC of CVE-2022-24713 on Ubuntu Install the current rust-regex...
Stored XSS in Project Name
Description The application Titra is vulnerable to Stored XSS in Project name field. Steps To Reproduce 1. Click on Edit button 2. Under the Project Name enter the paylaod " 3. Click on save. 4. Now navigate to details the XSS will be triggered. Image PoC...
Exploit for Improper Restriction of XML External Entity Reference in Rocketsoftware Ags-Zena
Zena Housekeeping notes: The original CookieMonster Repo can b...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
CVE-2022-26134 CVE-2022-26134 - Confluence Pre-Auth RCE | OGNL...
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File
Description Formula Injection/CSV Injection in "Task" due to Improper Neutralization of Formula Elements in CSV File. Proof of Concept 1. Click on plus track button 2. Under the task input field enter the payloads =1+1 3. Now enter the work hour as 2 4. Then click on save 5. Now go to details and...
Exploit for Code Injection in Vmware Identity_Manager
CVE-2022-22954 PoC VMware Workspace ONE Access and Identity M...
Exploit for Code Injection in Vmware Identity_Manager
CVE-2022-22954 PoC VMware Workspace ONE Access and Identity M...
BkdLocker#depositFees() can be front run to steal the newly added rewardToken
Lines of code Vulnerability details Every time the BkdLockerdepositFees gets called, there will be a surge of rewards per locked token for the existing stakeholders. This enables a well-known attack vector, in which the attacker will take a large portion of the shares before the surge, then claim...
_transfer#Executor.sol not checking all enum values
Lines of code Vulnerability details Impact Transaction can revert or have unexpected behaviour Poc In transferexecutor.sol you are checking Itemtype values Itemtype.NATIVE, Itemtype.ERC20 and Itemtype.ERC721 after then the last else clause assumes that the Itemtype is a ERC1155. else @audit assum...
Exploit for CVE-2022-30190
PoC exploit for CVE-2022-30190, an exploit module targeting the...
Co-Authors-Plus 3.5/3.5.1 - Guest Authors Email Address Disclosure
The plugin introduced an information disclosure vulnerability specifically, the e-mails of guest authors via a public REST endpoint accessible without any authentication PoC https://example.com/wp-json/wp/v2/coauthors...
Avantune Genialcloud ProJ 10 Cross Site Scripting Vulnerability
Exploit Title: Avantune Genialcloud ProJ 10 - Reflected XSS Cross-Site Scripting Exploit Author: Andrea Intilangelo Vendor Homepage: https://www.avantune.com Software Link: https://www.genialcloud.com - https://www.genialcloud.com/discover-genialcloud-proj - https://store.genialcloud.com Version:...
Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting
The plugin allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators. PoC As a vendor, add a review in any products with following payload: https://youtu.be/gGUNSG5s5JU...
New PoC Shows IoT Devices Can Be Hacked to Install Ransomware on OT Networks
By Deeba Ahmed In this PoC, the ransomware attack dubbed R4IoT uses vulnerable IoT devices in this case, vulnerable security cameras… This is a post from HackRead.com Read the original post: New PoC Shows IoT Devices Can Be Hacked to Install Ransomware on OT Networks...