Exploit for CVE-2021-38647

CVE-2021-38647 CVE-2021-38647 - POC to exploit unauthenticate...

CVE-2021-24663

The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE...

Design/Logic Flaw

The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE...

CVE-2021-24663

The CVE-2021-24663 entry concerns the Simple Schools Staff Directory WordPress plugin (versions up to 1.1). The issue is that the plugin does not validate uploaded logo images to confirm they are images, allowing high-privilege users (e.g., admins) to upload arbitrary files such as PHP code, whic...

CVE-2021-24663 Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload

The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE...

Church Management System 1.0 - Remote Code Execution (Unauthenticated) Exploit

Exploit Title: Church Management System 1.0 - Remote Code Execution RCE Unauthenticated Exploit Author: Abdullah Khawaja Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html Software Link:...

Scroll Baner <= 1.0 - CSRF to RCE

The plugin does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE via a file upload as well as XSS PoC The PHP code will put in the file at...

Church Management System 1.0 Shell Upload

Exploit Title: Church Management System CMS-Website - Unauthenticated RCE Exploit Author: Abdullah Khawaja Date: 2021-09-17 Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html Software Link:...

Microsoft Open Management Infrastructure RCE (CVE-2021-38647)

Binary data omicve-2021-38647.nbin...

Exploit for CVE-2021-38647

It is an offensive tool for testing CVE-2021-38647, a vulnerabil...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2021-26084...

CVE-2021-41392

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API...

Adobe InDesign RCE Vulnerabilities (APSB21-73) - Mac OS X

Adobe Indesign is prone to multiple vulnerabilities. This VT has been deprecated as a duplicate of the VT SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Adobe InDesign RCE Vulnerabilities (APSB21-73) - Mac OS X

Adobe Indesign is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:indesignserver";...

CISA, FBI: State-Backed APTs Are Exploiting Critical Zoho Bug

The FBI, CISA and the U.S. Coast Guard Cyber Command CGCYBER warned today that state-backed advanced persistent threat APT actors are likely among those who’ve been actively exploiting a newly identified bug in a Zoho single sign-on and password management tool since early last month. At issue is...

Exploit for CVE-2021-2302

CVE-2021-2302 Author: quynhle Gadget chain javax.manag...

Exploit for CVE-2021-38647

OMIGOD Proof on Concept Exploit for CVE-2021-38647 OMIGOD F...

Impress CMS 1.4.2 Remote Code Execution

Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution RCE Authenticated Date: 15-09-2021 Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.impresscms.org/ Software Link: https://www.impresscms.org/modules/downloads/ Version: 1.4.2 Category: Webapps Tested on: Linux/Windows...

Apache Struts RCE Vulnerability (S2-048) - Version Check

Apache Struts is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Adobe InDesign RCE Vulnerabilities (APSB21-73) - Windows

Adobe Indesign is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:indesignserver";...