12843 matches found
Exploit for Path Traversal in Microsoft
CVE-2021-40444 CVE-2021-40444 POC -----BEGIN PUBLIC KEY-----...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
PoC exploit for CVE-2021-26084, a vulnerability in Confluence. T...
Cross-Site Request Forgery (CSRF) in star7th/showdoc
✍️ Description With CSRF vulnerability Attacker able to delete any member to of any item if users visit attacker website. We can bypass the CSRF Protection if we put our payload on a iframe or a html file and send them to victim as after that the Origin header will be set to null and we can bypass...
Cross-Site Request Forgery (CSRF) in neorazorx/facturascripts
✍️ Description Attacker able to delete any number of Warehouse Products with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your...
User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting
The plugin does not properly sanitise the userregistrationprofilepicurl value when submitted directly via the userregistrationupdateprofiledetails AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed PoC 1...
Better Find and Replace < 1.2.9 - Reflected Cross-Site Scripting
The plugin does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=cs-all-masking-rules=...
U.S. Dept Of Defense: AWS subdomain takeover of www.███████
Description: The AWS bucket hosted on www.████████ was vulnerable to a subdomain takeover. It has a DNS record pointing to an unclaimed bucket that I was able to register and serve a PoC on. References Output of dig: ;; QUESTION SECTION: ;www.███████. IN A ;; ANSWER SECTION: www.████. 1833 IN CNA...
Support Board < 3.3.4 - Multiple Unauthenticated SQL Injections
The plugin does not escape multiple POST parameters such as statuscode, department, userid, conversationid, conversationstatuscode, and recipientid before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users. PoC The login-cookie parameter is...
Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...
Cisco Patches Critical Bug With Public Exploit
Cisco has patched a near-max critical bug in its NFVIS software for which there’s a publicly available proof-of-concept PoC exploit. On Wednesday, Cisco released patches for the flaw – an authentication bypass vulnerability in Enterprise NFV Infrastructure Software NFVIS that’s tracked as...
OpenSIS Community 8.0 SQL Injection
Exploit Title: OpenSIS Community 8.0 - 'cpidmissattn' SQL Injection Date: 09/01/2021 Exploit Author: Eric Salario Vendor Homepage: http://www.os4ed.com/ Software Link: https://opensis.com/download Version: 8.0 Tested on: Windows, Linux A SQL injection vulnerability exists in the Take Attendance...
OpenSIS Community 8.0 - (cp_id_miss_attn) SQL Injection Vulnerability
Exploit Title: OpenSIS Community 8.0 - 'cpidmissattn' SQL Injection Exploit Author: Eric Salario Vendor Homepage: http://www.os4ed.com/ Software Link: https://opensis.com/download Version: 8.0 Tested on: Windows, Linux A SQL injection vulnerability exists in the Take Attendance functionality of...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
ConfluenceCVE-2021-26084 Remote Code Execution on Confluence...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
CVE-2021-26084 CVE-2021-26084 Remote Code Execution on Conflu...
Software License Manager < 4.5.0 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise or escape its License Key Prefix setting before outputting it in the Add/Edit Licenses page, leading to an Authenticated Stored Cross-Site Scripting issue PoC Go the plugin’s settings and add " as a License Key Prefix Then go the the Add/Edit Licenses page to trigger...
Backdoor.Win32.Delf.wr Authentication Bypass / Code Execution
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/fc74e80ff2f49380972904d77df1c0f1.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Delf.wr Vulnerability: Authentication Bypass RCE Description: The CrazyInvadres Group...
Prototype Pollution in immerjs/immer
✍️ Description immer package is vulnerable to Prototype Pollution. 🕵️♂️ Proof of Concept Create the following PoC file: // poc.js const immer = require"immer"; immer.enablePatches; let obj = ; const patch = op: 'add', path: "proto","polluted", value: "Yes! Its Polluted"; console.log"Before : " +...
Exploit for Weak Password Recovery Mechanism for Forgotten Password in Strapi
CVE-2019...
Cross-Site Request Forgery (CSRF) in combodo/itop
✍️ Description Attacker able to delete Standard SLA with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attack...
Cross-Site Request Forgery (CSRF) in qkqpttgf/onemanager-php
✍️ Description Attacker able to rename any file with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks it...