CVE-2022-26133

CVE-2022-26133 affects Atlassian Bitbucket Data Center via SharedSecretClusterAuthenticator. A remote, unauthenticated attacker can execute arbitrary code through Java deserialization. Vulnerable versions include: 5.14.0 and later before 7.6.14; 7.7.0 and later before 7.17.6; 7.18.0 and later bef...

Pharmacy Management System 1.0 Shell Upload

Exploit Title: Pharmacy management system - Remote Code Execution RCE Date: 19/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15281/multi-language-pharmacy-management-system-project-source-code.html Version:...

CVE-2022-27862

Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin = 1.5.3 on WordPress allows attackers to upload and execute dangerous file types e.g. PHP shell via the signature upload on the booking form...

CVE-2022-27862

The CVE-2022-27862 entry concerns the WordPress VikBooking Hotel Booking Engine & PMS plugin (versions

Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload

The plugin allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE PoC As any authenticated user, upload a PHP file via /wp-admin/upload.php?page=adv-file-upload The file will be at https://example.com/wp-content/uploads/2022/03/.php...

CVE-2022-0661

The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user Admin+ to inject arbitrary HTML or javascript even with unfilteredhtml disallowed, leading to a stored cross-site scripting XSS...

Cross site scripting

The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user Admin+ to inject arbitrary HTML or javascript even with unfilteredhtml disallowed, leading to a stored cross-site scripting XSS...

CVE-2022-0661

CVE-2022-0661 affects the WordPress Ad Injection plugin (versions up to 1.2.0.19). The issue is due to improper sanitization of the injected ad body, enabling a high-privileged Admin+ user to inject arbitrary HTML/Javascript, resulting in stored XSS, and it can also allow PHP code injection leadi...

CVE-2022-0661 Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE

The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user Admin+ to inject arbitrary HTML or javascript even with unfilteredhtml disallowed, leading to a stored cross-site scripting XSS...

Exploit for CVE-2022-26318

Watchguard-RCE-POC-C...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCE

Arbitrary File Upload leading to RCE discovered by Huli Cymetrics in WordPress VikBooking Hotel Booking Engine & PMS plugin versions = 1.5.3. Solution Update the WordPress VikBooking Hotel Booking Engine & PMS plugin to the latest available version at least 1.5.4...

Exploit for CVE-2021-3129

Remote Code Execution: Laravel CVE-2021-3129...

Exploit for Unrestricted Upload of File with Dangerous Type in Elementor Website_Builder

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Exe...

CVE-2022-24485

Technical details about CVE-2022-24485 are not provided in the connected documents. No affected product/version information or exploit specifics are available here. Monitor for official updates and vendor advisories.

Low: Red Hat Security Advisory: Red Hat Process Automation Manager 7.12.1 security update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

Nintendo: [WiiU/Switch] Remote code execution inside the ENL library

Vulnerability description not provided...

Exploit for Code Injection in Vmware Spring_Cloud_Function

Spring Cloud Function SpEL Expression Injection Vulnerability...

Microsoft Excel 2016 RCE Vulnerability (KB5002177)

This host is missing a critical security update according to Microsoft KB5002177 Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Microsoft Excel 2013 RCE Vulnerability (KB5002175)

This host is missing a critical security update according to Microsoft KB5002175 Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Remote Code Execution (RCE)

laravel/laravel is vulnerable to remote code execution. The vulnerability exists in destruct in PendingResourceRegistration.php, Manager.php, and ClosureWrapper.php which allows an attacker is able to inject malicious code via an unserialize pop chain...