Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion

Mirasys DVMS Workstation versions 5.12.6 and prior suffer from local file inclusion vulnerabilities. id: CVE-2018-8727 info: name: Mirasys DVMS Workstation =5.12.7 to mitigate the LFI vulnerability. reference: -...

Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass

The WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes...

Odoo <= 8.0-20160726 & 9.0 - Open Redirect

An Open Redirect vulnerability in Odoo versions = 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL. id: CVE-2017-5871 info: name: Odoo = 8.0-20160726 & 9.0 - Open Redirect author: 1337rokudenashi severity: medium description: | An Open...

XWiki >= 6.2-milestone-1 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

Jeecg-boot 3.5.0 qurestSql - SQL Injection

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. id: CVE-2023-1454 info: name: Jeecg-boot 3.5...

mooSocial v.3.1.8 - Cross-Site Scripting

Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. id: CVE-2023-44813 info: name: mooSocial v.3.1.8 - Cross-Site Scripting author: ritikchaddha severity:...

YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

XWiki >= 2.5-milestone-2 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as:...

Cherokee HTTPD <=0.5 - Cross-Site Scripting

Cherokee HTTPD 0.5 and earlier contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. id: CVE-2006-1681 info:...

WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF

WordPress Automatic plugin 3.92.1 is vulnerable to unauthenticated Arbitrary File Download and SSRF Located in the downloader.php file, could permit attackers to download any file from a site. Sensitive data, including login credentials and backup files, could fall into the wrong hands. This...

patchright

🎭 Patchright...

whatsapp-rce-patched

이 저장소에는 README가 없습니다...

pbscan

SUMMARY polarbearscan is an attempt to do faster and more efficient banner grabbing and port scanning. It combines two different ideas which hopefully will make it somewhat worthy of your attention and time. The first of these ideas is to use stateless SYN scanning using cryptographically protect...

jquery-prototype-pollution-fix

jquery-prototype-pollution-fix Исправление для CVE-2019-11358 загрязнение прототипа в jQuery Просто скачайте и включите jquery-1.12.2-patched.js в свой проект вместо оригинальной версии 1.12.2. Смотрите папку test с примерами, как проверить уязвимость...

smbexec

root@kitploit: smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage...

sdks

theos/sdks Этот репозиторий содержит пропатченные iOS SDK с приватными символами. Они были удалены из официальных SDK, начиная с Xcode 7.3 и iOS 9.3 SDK. Чтобы использовать с Theos, скачайте этот репозиторий, извлеките и скопируйте нужные вам SDK в $THEOS/sdks/. Сгенерировано с помощью...

cve-2022-42889

cve-2022-42889 cve-2022-42889 Text4Shell는 Apache Commons Text 버전 1.5부터 1.9까지 영향을 미칩니다. Commons Text 버전 1.10에서 패치되었습니다. 참고 자료: https://securitylab.github.com/advisories/GHSL-2022-018ApacheCommonsText/ https://github.com/karthikuj/cve-2022-42889-text4shell-docker...

exploits

exploits 이 저장소에는 제가 https://www.exploit-db.com/에 제출한 모든 shellcode 또는 exploits가 포함되어 있습니다. 여기에 나열된 모든 exploits는 0day가 아니며, 언급된 모든 소프트웨어에는 수정 패치가 제공됩니다. 이 exploits는 자신의 기기에서의 호기심 충족을 위한 것이거나, 자신의 소프트웨어 또는 네트워크를 점검하기 위한 것임을 유의하시기 바랍니다. 타인의 명시적 동의 없이 타인의 시스템 및 네트워크에 대해 exploits를 사용하는 것은 불법이며 금지되어 있습니...