Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software

CVE-2020-3452 !PoChttps://i.ibb.co/9sds0py/Po...

Newsportal 3 SQL Injection

Exploit Title: Newsportal v3 - 'uname' - SQL Injection Date: 2020-07-24 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/news-portal-project-in-php-and-mysql/ Software Link:...

Newsportal 3 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Newsportal v3 - 'uname' - SQL Injection Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/news-portal-project-in-php-and-mysql/ Software...

lemlist: Stored XSS at [ https://app.lemlist.com/campaigns/cam_QRS5caF2ca7MJtiLS/leads ] in " LINKEDIN URL" Field.

Summary: Vulnerability : A. Type:- Cross Site Scripting Stored B. Description:- Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Summary : When you will login into the...

ZenTao Pro 8.8.2 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ZenTao Pro 8.8.2 Remote Code Execution', 'Description' = %q This module exploits a command injection vulnerability in ZenTao Pro 8.8.2 and earlie...

WordPress Theme NexosReal Estate 1.7 - 'search_order' SQL Injection

Exploit Title: WordPress Theme NexosReal Estate 1.7 - 'searchorder' SQL Injection Google Dork: inurl:/wp-content/themes/nexos/ Date: 2020-06-17 Exploit Author: Vlad Vector Vendor: Sanljiljan https://themeforest.net/user/sanljiljan Software Version: 1.7 Software Link:...

Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java

CVE-2020-6287-exploit PoC for CVE-2020-6287 The PoC in...

Daily Expense Tracker 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Daily Expense Tracker 1.0 - Authentication Bypass Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Directory Management System (DMS) 1.0 SQL Injection

Exploit Title: Directory Management System DMS 1.0 - Authentication Bypass Date: 2020-07-20 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/directory-management-system-using-php-and-mysql/ Software Link:...

Employee Record Management System 1.1 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Employee Record Management SystemERMS 1.1 - Authentication Bypass Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Email Subscribers & Newsletters < 4.5.1 - Authenticated SQL injection in es_newsletters_settings_callback()

An authenticated high privilege attacker could exploit this issue an gain access to the DBMS. PoC https://github.com/tenable/poc/blob/master/WordPress/plugins/Icegram/emailsubscribersandnewsletters/sqliinfodisclosurepoc.py...

BugPoC: Improper use of "path" parameter can be used to trick testers into leaking their Front-End PoC

Summary: In https://bugpoc.com/testers/front-end, the populateFromFragment function incorrectly assigns hash parameter path to the subdomain element, allowing the "Test" functionality of the Front-End PoC Generator to open a popup on any domain instead of the expected web.bugpoc.ninja. It can be...

PMB 5.6 Cross Site Scripting

Exploit Title: PMB 5.6 Cross Site Scripting XSS Google Dork: inurl:opaccss Date: 20-04-2020 Exploit Author: 41-trk Tarik Bakir Email: tarikbak999atgmail.com Vendor Homepage: http://www.sigb.net Software Link: http://forge.sigb.net/redmine/projects/pmb/files Affected versions : alert1&critical=1...

MTN Group: xss on [developers.mtn.com]

xss on history.pushState'', '', '/' F908897 Impact POC F908895 F908896...

U.S. Dept Of Defense: Reflected XSS in https://www.██████/

Hello Security Team, I would like to report the XSS vulnerability on your system. The i= parameter is not escaped properly for URL encoded values. Steps To Reproduce: Visit the following POC link:...

Exploit for Improper Input Validation in Microsoft

This is an educational exercise. Use at your own risk. CVE-...

Apartment Visitors Management System Project 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Apartment Visitors Management System Project 1.0 - Authentication Bypass Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Apartment Visitors Management System Project 1.0 SQL Injection

Exploit Title: Apartment Visitors Management System Project 1.0 - Authentication Bypass Date: 2020-07-14 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Park Ticketing Management System 1.0 SQL Injection

Exploit Title: Park Ticketing Management System 1.0 - Authentication Bypass Date: 2020-07-13 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/park-ticketing-management-system-using-php-and-mysql/ Software...

Park Ticketing Management System 1.0 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Park Ticketing Management System 1.0 - Authentication Bypass Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...