Exploit for CVE-2023-38646

Poc-Metabase-Preauth-CVE-2023-38646 Ho to use? λ cve git...

FollowNFT storage collision

Lines of code Vulnerability details Impact The lastFollowTokenId of FollowNFT contract has a storage collision. V2.0 storage layout: | lastFollowTokenId | uint128 | 17 | 0 | 16 | contracts/FollowNFT.sol:FollowNFT | | followerCount | uint128 | 17 | 16 | 16 | contracts/FollowNFT.sol:FollowNFT |...

Zomplog 3.9 Cross Site Scripting

Exploit Title: Zomplog 3.9 - Cross-site scripting XSS Application: Zomplog Version: v3.9 Bugs: XSS Technology: PHP Vendor URL: http://zomp.nl/zomplog/ Software Link: http://zomp.nl/zomplog/downloads/zomplog/zomplog3.9.zip Date of found: 22.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2...

Possible integer underflow

Lines of code Vulnerability details Impact The previous FollowNFT implementation is different between v1.3 and v2.0. The followerCount is 0 for existing FollowNFTeven if lastFollowTokenId is not 0 after upgrade. // Old uint256 lastFollowTokenId slot splitted into two uint128s to include...

Exploit for CVE-2023-38646

Metabase Pre Authentication RCE CVE-2023-38646 We have pro...

Exploit for CVE-2023-38646

CVE-2023-38646 Metabase Pre-auth R...

Exploit for Command Injection in Tp-Link Archer_Ax21_Firmware

Description CVE-2023–1389 is an Unauthenticated Command Inject...

Malicious code in imposter-pkg-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e5127f46671b090bf9ac113a3ff87f19d522e0ec80dda844332b9625b30ecf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-521 Malicious code in imposter-pkg-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e5127f46671b090bf9ac113a3ff87f19d522e0ec80dda844332b9625b30ecf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Zomplog 3.9 - Cross site scripting Vulnerability

Exploit Title: Zomplog 3.9 - Cross-site scripting XSS Application: Zomplog Version: v3.9 Bugs: XSS Technology: PHP Vendor URL: http://zomp.nl/zomplog/ Software Link: http://zomp.nl/zomplog/downloads/zomplog/zomplog3.9.zip Date of found: 22.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2...

Zomplog 3.9 - Cross-site scripting (XSS)

Exploit Title: Zomplog 3.9 - Cross-site scripting XSS Application: Zomplog Version: v3.9 Bugs: XSS Technology: PHP Vendor URL: http://zomp.nl/zomplog/ Software Link: http://zomp.nl/zomplog/downloads/zomplog/zomplog3.9.zip Date of found: 22.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2...

Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets

CVE-2023-27163 PoC CVE-2023-27163, SSRF, request-baskets h...

Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets

CVE-2023-27163 Poc of SSRF for Request-Baskets CVE-2023-27163...

GHSA-F54Q-J679-P9HH copyparty vulnerable to reflected cross-site scripting via k304 parameter

Summary The application contains a reflected cross-site scripting via URL-parameter ?k304=... and ?setck=... Details A reflected cross-site scripting XSS vulnerability exists in the web interface of the application that could allow an attacker to execute malicious javascript code by tricking user...

IURNY by INDIGITALL < 3.2.3 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to the plugin's settings. 2...

WP Brutal AI < 2.06 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC In the plugin settings, for a...

QWE DL v2.0.1 iOS - Persistent Cross Site Vulnerability

Document Title: =============== QWE DL v2.0.1 iOS - Persistent Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2326 Release Date: ============= 2023-07-23 Vulnerability Laboratory ID VL-ID: ====================================...

Exploit for Code Injection in Apache Airflow

Apache Airflow official report description says: A vulnerab...

Exploit for Off-by-one Error in F5 Nginx

CVE-2021-23017...

CMS Made Simple 2.2.17 Server-Side Template Injection

Exploit Title: CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection SSTI Application: CmsMadeSimple Version: v2.2.17 Bugs: SSTI Technology: PHP Vendor URL: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Date of found: 13-07-2023...