Hotel Booking Engine 1.0 - h_room_type SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Hotel Booking Engine 1.0 - 'hroomtype' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://scriptzee.com/ Software Link: http://scriptzee.com/products/details/35 Version: 1.0 Category: Webapps Tested on:...

Education Website 1.0 - subject SQL Injection

Education Website 1.0 - subject SQL Injection Exploit Title: Education Website 1.0 - 'subject' SQL Injection Dork: N/A Date: 2018-10-01 Exploit Author: Ihsan Sencan Vendor Homepage: http://scriptzee.com/ Software Link: http://scriptzee.com/products/details/34 Version: 1.0 Category: Webapps Tested...

MensaMax 4.3 Hardcoded Encryption Key Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 e2 Security GmbH Advisory 2018-01 Unencrypted transmission and usage of hardcoded encryption key Overview Advisory ID: E2SA-2018-01 Advisory Version: 1.0 Advisory Status: Public Advisory URL: https://advisories.e2security.de/2018/E2SA-2018-01.txt...

WUZHICMS 2.0 Cross Site Scripting

Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-10-01 Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in the WUZHICMS 2.0 web-application. The...

Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit

A cybersecurity researcher with Google Project Zero has released the details, and a proof-of-concept PoC exploit for a high severity vulnerability that exists in Linux kernel since kernel version 3.16 through 4.18.8. Discovered by white hat hacker Jann Horn, the kernel vulnerability CVE-2018-1718...

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free Exploit

Exploit for multiple platform in category dos / poc tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...

WebKit - WebCore::SVGTRefElement::updateReferencedText Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer: heap-use-after-free on address...

WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free Exploit

Exploit for multiple platform in category dos / poc htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001, .class1 1vmax; display:...

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer: heap-use-after-free on...

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc -webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 = document.getElementById"htmlvar00049";...

Brave Software: RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context

Summary: \395737 has shown that Brave supports chrome://brave/ URLs. The Brave team introduced a patch which blocks navigation to chrome://brave and removed chrome.remote.require to prevent command execution on the machine. Navigation to chrome://brave via shortcut files From my understanding: 1...

QIWI: [*.rocketbank.ru] Web Cache Deception & XSS

Практически все сайты .rocketbank.ru, основанные на readymag.rocketbank.ru, уязвимы к Web Cache Deception и XSS. Пример запроса: http GET /?xx HTTP/1.1 Host: wknd.rocketbank.ru X-Forwarded-Host: cacheattack'"alertdocument.domain HTTP ответ: html alertdocument.domain/friends/" alertdocument.domain...

Microsoft Edge - Sandbox Escape

Content process - Privileged content process firststage.js When spawning a new Edge content process, its privilege is determined by its URL. This URL check is performed by the LCIEUrlPolicy::GetPICForPrivilegedInternalPage method in eModel.dll. The method calls several another methods to check...

TransMac 12.2 - Denial of Service (PoC)

TransMac 12.2 - Denial of Service PoC Exploit Title: TransMac 12.2 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-09-26 Software Link: http://www.acutesystems.com/tmac/tmsetup.exe Tested Version: 12.2 Tested on OS: Windows 7 32-bit Steps to Reproduce: Run the python...

CrossFont 7.5 - Denial of Service (PoC)

Exploit Title: CrossFont 7.5 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-09-26 Software Link: http://www.acutesystems.com/cfnt/cfsetup.exe Tested Version: 7.5 Tested on OS: Windows 7 32-bit Steps to Reproduce: Run the python exploit script, it will create a new file...

Joomla Article Factory Manager 4.3.9 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Article Factory Manager 4.3.9 - SQL Injection Vendor Homepage: https://thephpfactory.com/ Software Link:...

Joomla AlphaIndex Dictionaries 1.0 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component AlphaIndex Dictionaries 1.0 - SQL Injection Vendor Homepage: http://multiplanet.gr/ Software Link: https://extensions.joomla.org/extensions/extension/authoring-a-content/alphaindex-dictionaries/ Version: 1.0...

WebKit WebCore::SVGTRefElement::updateReferencedText Use-After-Free

WebKit: Use-after-free in WebCore::SVGTRefElement::updateReferencedText CVE-2018-4315 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC:...

Joomla! Questions 1.4.3 SQL Injection

Exploit Title: Joomla! Component Questions 1.4.3 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://extensiondeveloper.com/ Software Link: https://extensions.joomla.org/extensions/extension/communication/question-a-answers/questions/ Version: 1.4.3 Category: Webapps Tested on:...

WebKit WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free

WebKit: Use-after-free in WebCore::SVGAnimateElementBase::resetAnimatedType CVE-2018-4314 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...