Cosmetics And Beauty Product Online Store 1.0 Cross Site Scripting

Title: Cosmetics and Beauty Product Online Store v1.0 remote Multiple XSS-Reflected Author: nu11secur1ty Date: 02.18.2022 Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15181/cosmetics-and-beauty-product-online-store-phpoop-free-source-code.html...

WordPress dzs-zoomsounds 6.60 Shell Upload

Exploit Title: WordPress Plugin dzs-zoomsounds - Remote Code Execution RCE Unauthenticated Google Dork: inurl:wp-content/plugins/dzs-zoomsounds Date: 16/02/2022 Exploit Author: Overthinker1877 1877 Team Vendor Homepage: https://digitalzoomstudio.net/docs/wpzoomsounds/ Version: 6.60 Tested on:...

Design/Logic Flaw

Remote Command Execution RCE vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters...

Remote code execution

Remote Code Execution RCE vulnerability exists in D-Link Router DIR-846 DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use "\ " or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.Th...

CVE-2021-46319

CVE-2021-46319 is linked to a D-Link DIR-846 RCE issue previously observed as CVE-2019-17509. Connected sources describe a remote code execution path in DIR-846 devices, where an attacker can bypass shell metacharacters in ssid0/ssid1 via crafted input to execute arbitrary OS commands as root (e....

CVE-2021-46315

CVE-2021-46315 is a remote code execution vulnerability affecting D-Link DIR-846 series routers (examples: DIR846A1_FW100A43.bin, DIR846enFW100A53DLA-Retail.bin) via HNAP1/control/SetWizardConfig.php. The flaw allows an attacker to inject shell metacharacters (e.g., , backticks) in ssid0/ssid1 pa...

CVE-2021-45382

A Remote Command Execution RCE vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End ...

Command injection

A Remote Command Execution RCE vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End ...

CVE-2022-22916

O2OA v6.4.7 is affected by a remote code execution (RCE) vulnerability exposed via the endpoint /x_program_center/jaxrs/invoke. The RCE flaw, described across multiple sources (Red Hat, CVE records, OSV, etc.), stems from this JAX-RS invocation path and could allow a remote attacker to execute ar...

CVE-2022-22916

O2OA v6.4.7 was discovered to contain a remote code execution RCE vulnerability via /xprogramcenter/jaxrs/invoke...

CVE-2021-46314

CVE-2021-46314 targets D-Link DIR-846 routers, with the flaw in HNAP1/control/SetNetworkTomographySettings.php. The issue is a backtick-based command injection in domain-name validation, enabling remote command execution over the network. Public sources (NVD) assign a CVSS v3.1 base score of 9.8 ...

CVE-2021-45382

CVE-2021-45382 affects D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers. The vulnerability is a Remote Command Execution via the DDNS function in the ncc2 binary, allowing unauthenticated command execution and potentially full router compromise. The issue is described as a c...

PHP 7.4.x < 7.4.28

The version of PHP installed on the remote host is prior to 7.4.28. It is, therefore, affected by a vulnerability as referenced in the Version 7.4.28 advisory. - In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT...

Tiny File Manager 2.4.3 Shell Upload Exploit

Tiny File Manager Example: ./exploit.sh http://files.ubuntu.local/index.php admin "email protected" https://github.com/febinrev/tinyfilemanager-2.4.3-exploit !/bin/bash check which curl if $? = 0 then printf "✔ Curl found! \n" else printf "❌ Curl not found! \n" exit fi which jq if $? = 0 then...

High-Severity RCE Bug Found in Popular Apache Cassandra Database

Researchers have shared details about a now-patched, high-severity security bug in the Apache Cassandra open-source NoSQL distributed database that’s easy to exploit and, if left unpatched, could enable attackers to gain remote code execution RCE. The bug, which involves how Cassandra creates...

High-Severity RCE Security Bug Reported in Apache Cassandra Database Software

Researchers have revealed details of a now-patched high-severity security vulnerability in Apache Cassandra that, if left unaddressed, could be abused to gain remote code execution RCE on affected installations. "This Apache security vulnerability is easy to exploit and has the potential to wreak...

Tiny File Manager 2.4.3 Shell Upload

Tiny File Manager Example: ./exploit.sh http://files.ubuntu.local/index.php admin "admin@123" https://github.com/febinrev/tinyfilemanager-2.4.3-exploit !/bin/bash check which curl if $? = 0 then printf "✔ Curl found! \n" else printf "❌ Curl not found! \n" exit fi which jq if $? = 0 then printf "✔...

CVE-2022-24665

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Path Traversal in prasathmani/tinyfilemanager

Description A Path Traversal vulnerability exists in Tiny File Manager, which allows the upload of files to an arbitrary location in the server. This flaw derives from the way that the file upload/creation is handled when a file with the same name already exists in the target directory. Affected...

CVE-2022-23992

CVE-2022-23992 concerns XCOM Data Transport for Windows, Linux, and UNIX 11.6 with an input validation flaw that could allow remote execution of arbitrary commands with elevated privileges. The issue surface is due to insufficient input validation. Affected component: XCOM Data Transport 11.6; im...