Simple Client Management System 1.0 SQL Injection / Shell Upload

Exploit Title: Simple Client Management System 1.0 - Remote Code Execution RCE Date: July 4, 2021 Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip Version: 1.0 Tested...

Wordpress Backup Guard 1.5.8 Plugin - Remote Code Execution (Authenticated) Exploit

Exploit Title: Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution Authenticated Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://backup-guard.com/products/backup-wordpress Software Link: https://downloads.wordpress.org/plugin/backup.1.5.8.zip Version: Before 1.6.0 Tested on...

Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE

The plugin did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE PoC PoC | Authenticated RCE | Caching Exclude URLs / Cached query strings: POST /wp-admin/admin.php?page=sbp-settings HTTP/2 Host: example.com...

ForgeRock AM远程代码执行漏洞（CVE-2021-35464）

Pre-auth RCE in ForgeRock OpenAM CVE-2021-35464 Michael Stepankin Researcher @artsploit Published: 29 June 2021 at 11:23 UTC Updated: 29 June 2021 at 18:15 UTC While participating in one private bug bounty program, I discovered a pre-auth RCE in ForgeRock OpenAM server - a popular access manageme...

TextPattern CMS 4.9.0-dev - Remote Command Execution (RCE) (Authenticated)

Exploit Title: TextPattern CMS 4.9.0-dev - Remote Command Execution RCE Authenticated Date: 07/04/2021 Exploit Author: Mevlüt Akçam Software Link: https://github.com/textpattern/textpattern Vendor Homepage: https://textpattern.com/ Version: 4.9.0-dev Tested on: 20.04.1-Ubuntu !/usr/bin/python3...

Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution (Authenticated)

Exploit Title: Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution Authenticated Date 02.07.2021 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://backup-guard.com/products/backup-wordpress Software Link: https://downloads.wordpress.org/plugin/backup.1.5.8.zip Version: Before...

Simple Client Management System 1.0 - Remote Code Execution Exploit

Exploit Title: Simple Client Management System 1.0 - Remote Code Execution RCE Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip Version: 1.0 Tested on: Windows 10 Hom...

Simple Client Management System 1.0 - Remote Code Execution (RCE)

Exploit Title: Simple Client Management System 1.0 - Remote Code Execution RCE Date: July 4, 2021 Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip Version: 1.0 Tested...

Exploit for Code Injection in Phpunit_Project Phpunit

laravel phpunit rce masscanner CVE-2017-9841 Masscanner for La...

Exploit for Code Injection in Phpunit_Project Phpunit

laravel phpunit rce masscanner CVE-2017-9841 Masscanner for La...

Exploit for Use After Free in Microsoft

CVE-2021-31166-Exploit Exploit for MS Http Protocol Stack RCE...

CISA Offers New Mitigation for PrintNightmare Bug

The U.S. government has stepped in to offer a mitigation for a critical remote code execution RCE vulnerability in the Windows Print Spooler service that may not have been fully patched by Microsoft’s initial effort to fix it. To mitigate the bug, dubbed PrintNightmare, the CERT Coordination Cent...

Microsoft Warns of Critical "PrintNightmare" Flaw Being Exploited in the Wild

Microsoft on Thursday officially confirmed that the "PrintNightmare" remote code execution RCE vulnerability affecting Windows Print Spooler is different from the issue the company addressed as part of its Patch Tuesday update released earlier this month, while warning that it has detected...

Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution Vulnerabilities

Exploit Title: Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution XSS/RCE Google Dork: 'inurl:"/projects/editor/?tutorial=getStarted" -mit.edu' not foolproof on versioning Exploit Author: Stig Magnus Baugstø Vendor Homepage: https://scratch.mit.edu/ Software Link:...

ManageEngine ServiceDesk Plus < 11.2 Build 11205 RCE

A command injection vulnerability exists in ManageEngine ServiceDesk Plus 11.2 Build 11205 due to insufficient sanitisation of user supplied input. An authenticated, remote attacker can exploit this to execute arbitrary commands with SYSTEM privileges. Note that Nessus has not tested for this iss...

ForgeRock Access Management < 7.0 RCE

The version of ForgeRock Access Management detected on the remote host is affected by a remote code execution vulnerability due to unsafe object deserialization. An unauthenticated, remote attacker can exploit this to execute code on the remote host. Note that Nessus has not tested for this issue...

Scratch Desktop 3.17 - Remote Code Execution

Exploit Title: Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution XSS/RCE Google Dork: 'inurl:"/projects/editor/?tutorial=getStarted" -mit.edu' not foolproof on versioning Date: 2021-06-18 Exploit Author: Stig Magnus Baugstø Vendor Homepage: https://scratch.mit.edu/ Software Link:...

U.S. Dept Of Defense: Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)

RCE is possible thanks to unsafe Java deserialization in the Jato framework used by OpenAM. Impact An unauthenticated, 3rd-party attacker or adversary can execute remote code Supporting Material/References - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464 System...

Exploit for Deserialization of Untrusted Data in Forgerock Access_Management

openam CVE-2021-35464 tomcat 执行命令回显. 项目基于 ysoserialhttps:/...

ASB-A-167389063

In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation...