12946 matches found
Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF
The theme and plugin have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF Server Side Request Forgery and RFI Remote File Inclusion vulnerabilities on...
SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting (XSS)
Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting XSS Date: 24/06/2021 Exploit Author: Luqman Hakim Zahari @ Saitamang Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html Version: 2.5 Tested on: CentOS 7 CVE : CVE-2021-35475...
Cross-site Scripting (XSS) - Stored in falconchristmas/fpp
✍️ Description GET parameter &value= in fppjson.php is vulnerable to stored cross site scripting. Analysis Trace: 1. Application takes unvalidated user data in &value= from GET request of /fppjson.php?command=setSetting&plugin=&key=emailserver&value=ytes";alert1 2. Now visiting any application pag...
Exploit for Deserialization of Untrusted Data in Apache Tapestry
CVE-2021-27850 Exploit Overview CVE-2021-27850 is a...
MTN Group: XSS at videostore.mtnonline.com/GL/*.aspx via all parameters
PoC https://videostore.mtnonline.com/GL/MyAccount.aspx?PId=126&CID=5&OprId=11%27 Symbols are not filtered that alloweds to inject HTML code. F1353609 Impact XSS at videostore.mtnonline.com...
Exploit for Type Confusion in Linux Linux_Kernel
Proof of Concept for CVE-2021-33624 compile with gcc -pthre...
Cisco ASA Bug Now Actively Exploited as PoC Drops
Researchers have dropped a proof-of-concept PoC exploit on Twitter for a known cross-site scripting XSS vulnerability in the Cisco Adaptive Security Appliance ASA. The move comes as reports surface of in-the-wild exploitation of the bug. Researchers at Positive Technologies published the PoC for...
Exploit for Cross-site Scripting in Cisco Firepower_Threat_Defense
PoC exploit for CVE-2020-3580, a vulnerability in the Apache Hud...
Exploit for Unrestricted Upload of File with Dangerous Type in Seeddms
CVE-2019-12744 Information Exploit Title: Remote Command...
ZoomSounds < 6.05 - Unauthenticated Arbitrary File Upload
The plugin contained a PHP file, allowing unauthenticated users to upload an arbitrary file anywhere on the web server. Note WPScanTeam: It's unclear which version fixed the issue exactly, however we were able to confirm the issue on version as high as v5.96 and that the related file has been...
Online Library Management System 1.0 SQL Injection
Exploit Title: Online Library Management System 1.0 - 'Search' SQL Injection Date: 23-06-2021 Exploit Author: Berk Can Geyikci Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/ols.zip Version: 1.0 Tested on: Windows...
Online Library Management System 1.0 - 'Search' SQL Injection
Exploit Title: Online Library Management System 1.0 - 'Search' SQL Injection Date: 23-06-2021 Exploit Author: Berk Can Geyikci Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/ols.zip Version: 1.0 Tested on: Windows...
Online Library Management System 1.0 - (Search) SQL Injection Vulnerability
Exploit Title: Online Library Management System 1.0 - 'Search' SQL Injection Exploit Author: Berk Can Geyikci Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/ols.zip Version: 1.0 Tested on: Windows 10 Pro 64 Bit...
Sign-up Sheets < 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in the admin dashboard PoC As admin, add a...
myStickymenu < 2.5.2 - Authenticated Stored XSS
The plugin does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue, which will be triggered in the plugin's setting, as well as all front-page of the blog when the Welcome bar is active Put...
Photon OS 3.0: Python PHSA-2021-3.0-0253
An update of the python package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0253. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...
Simple CRM 3.0 - (name) Stored Cross site scripting Vulnerability
Exploit Title: Simple CRM 3.0 - 'name' Stored Cross site scripting XSS Exploit Author: Riadh Benlamine rbn0x00 Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/small-crm-php/ Version: 3.0 Category: Webapps Tested on: Apache2+MariaDB latest version Description : Simpl...
myStickymenu < 2.5.2 - Authenticated Stored XSS
The plugin does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue, which will be triggered in the plugin's setting, as well as all front-page of the blog when the Welcome bar is active PoC...
NamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation
This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotato. I faced...
Heap-based Buffer Overflow in squell/id3
✍️ Description While testing id3 built from commit 0de713 with Clang 13 +ASan on Ubuntu 20.04.2, we discovered a POC which triggers a heap-buffer-overflow in tag::unbinarize. This particular flaw was discovered with the help of honggfuzz. 🕵️♂️ Proof of Concept echo...