Real3D FlipBook <= 2.8 - Multiple Vulnerabilities

List of vulnerabilities: - Delete any file or directory from the server Unauthenticated - Upload images in Root directory Unauthenticated - Cross-Site Scripting XSS PoC https://github.com/mukarramkhalid/wordpress-real-3d-flipbook-exploit/blob/master/real3dflipbook-exploit.py...

Nextcloud: [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS

I found stored XSS vulnerability in nextcloud server's chat module Nextcloud Server version - 9.0.51 OS - Ubuntu 14.0.4 Browser - Internet Explorer 11 Steps: 1 Login as non-admin userattacker and change full name containing XSS payload - elamaran'"alertdocument.domain 2 Login as...

Paragon Initiative Enterprises: Stored XSS using SVG

Hi , Background ------------------------------------ I had problem in setup the airship at ubuntu so I tested on your site . If you uploads any file thet can use for XSS HTML,SWF,etc the content type will change to "text/plain; charset=us-ascii" . But for images it will stay the same . so if you...

Legal Robot: Subdomain takeover at api.legalrobot.com due to non-used domain in Modulus.io.

Hi, I noticed that the following domain: api.legalrobot.com was returning the following information: NO APPLICATION WAS FOUND FOR api.legalrobot.com F102881 from Modulus.io. The problem with this is that this tends to be pretty bad depending on the service you use. In this case, what I did was to...

Phoenix Exploit Kit Remote Code Execution

Exploit Title: Phoenix Exploit Kit - Remote Code Execution Exploit Author: CrashBandicot @DosPerl Date: 2016-06-30 Tested on: MSWin32 Vuln file : geoip.php 492. isset$GET'bdr' ? eval$GET'bdr' : explode'nop','nop nop nop'; PoC : http://localhost/Phoenix/includes/geoip.php?bdr=phpinfo; Screen :...

Mail.ru: Cross Site Request Forgery (CSRF)

Hello, I've Found CSRF in townwars.mail.ru/Gallery/addComment/ while any user can add image to townwars.mail.ru/Gallery/ after that any user can add comment to this image and here there is no any protection steps to reproduce - Go to townwars.mail.ru/Gallery/ - choose any photo - you can add a...

Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities

Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMANTEC-SEPM-MULTIPLE-VULNS.txt + ISR: ApparitionSec Vendor: ================ www.symantec.com Product:...

Microsoft Windows 7 SP1 (x86) - Privilege Escalation (MS16-014)

Exploit for windows platform in category local exploits / Exploit Title: Elevation of privilege on Windows 7 SP1 x86 Date: 28/06-2016 Exploit Author: @blomster81 Vendor Homepage: www.microsoft.com Version: Windows 7 SP1 x86 Tested on: Windows 7 SP1 x86 CVE : 2016-0400 MS16-014 EoP PoC created fro...

Coinbase: Application error message

poc url:https://developers.coinbase.com/api/%e3h This page contains an error/warning message that may disclose sensitive information.The message can also contain the location of the file that produced the unhandled exception.This may be a false positive if the error message is found in...

Kagao 3.0 - Multiple Vulnerabilities

Kagao 3.0 - Multiple Vulnerabilities Application Name : Kagao v3.0 - Professional Classified Market Google Dork : inurl:/cat1.php?id2= Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL Vendor Homepage : http://kogaoscript.com/ Vulnerable Type : SQL Injection & Cross Site Scripting...

FantasyTote: Urgent Fix Balance Limit bypass

Hi check this Video POC i am able to bypass the Limit of deposite balnce the limit is 150 but i can put 2000 https://drive.google.com/file/d/0B-HtZBO84sdSMkFEQ21vZW5Uak0/view Thanks Regards Tayyab Qadir...

FantasyTote: Bypass logout

Hi again , you can logout any user by sending him this link : Poc link : https://www.fantasytote.com/logout...

Exploit for HTTP Response Splitting in Python

CVE-2016-5699-poc PoC code of CVE-2016-...

Microsoft Internet Explorer 11 (Windows 10) - VBScript Memory Corruption Proof-of-Concept Exploit (M

Exploit for windows platform in category local exploits Source: https://github.com/theori-io/cve-2016-0189 CVE-2016-0189 Proof-of-Concept exploit for CVE-2016-0189 VBScript Memory Corruption in IE11 Tested on Windows 10 IE11. Write-up http://theori.io/research/cve-2016-0189 To run 1. Download...

Microsoft Windows - Custom Font Disable Policy Bypass

Microsoft Windows - Custom Font Disable Policy Bypass Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=779 Windows: Custom Font Disable Policy Bypass Platform: Windows 10 Only Class: Security Feature Bypass Summary: It’s possible to bypass the ProcessFontDisablePolicy check in...

Yona CMS - Cross-Site Request Forgery

Yona CMS - Cross-Site Request Forgery document.forms0.submit;...

CMS Elevel 1.0 Cross Site Scripting / SQL Injection

Exploit Title : CMS Elevel 1.0 - SQL Injection / XSS Exploit Author : Persian Hack Team Vendor Homepage : http://www.elevel.it/privacy.php Google Dork : "Web Design by Elevel" inurl:news.php Category: Webapps Tested on: Win Version: 1.0 Date: 2016/06/19 PoC: id Parameter Vulnerable To SQL / XSS...

Nextcloud: Content Injection 404 page

Hi there, Similar as report 145344 and 145532 it's possbile to spoof the 404 page using http. PoC URL: http://nextcloud.com/has%2f%20been%20changed%20to%20https://www.ATTACKER.COM.%20so%20please%20visit%20https://www.ATTACKER.COM%20as%20your%20requested%20link Note: If this redirects you to https...

Nextcloud: Content Spoofing

Hi i got content spoofing vulnerability . Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. POC Link :- https://nextcloud.com/.htacess%20THIS%20IS%20CONTENT%20SPOOFING...

Nextcloud: nextcloud.com: Content Injection Custom 404 Error

Hello Team , Request: if u think the reported issues have acceptable risk and u r not going to make changes then kindly request to mark as Informative . Description : This report is about how an attacker is able to spoof the content of 404 page and can add thr own Text in way that the Current...