50m-ctf: Weak credentials, Blind SQLi, Timing attack, that leads to web admin access

Summary: Discovery of the application: The h1Thermostat application was discovered by extracting the bit.do URL from the image at https://pbs.twimg.com/media/D0XoThpW0AE2r8S.png:large. The URL https://bit.do/h1therm then led to a Google Drive where the Android application file h1thermostat.apk...

CVE-2018-4059

An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuratio...

TheCarProject v2 - Multiple SQL Injection Vulnerability

Exploit for php platform in category web applications =========================================================================================== Exploit Title: TheCarProject v2 - 'manid' SQL Inj. Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://thecarproject.org/ Software Link:...

UBUNTU-CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

GW Security IP Camera Default Credentials (HTTP)

The remote installation of GW Security Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either...

CVE-2019-9652

There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the t2 parameter...

Unikrn: bypass Claudflare access crm.mautic.com

Hi @unikrn! Hello, I see that when you switch to the crm,unikrn.com, login attempts are filtered by Claudflare Access to avoid brute-force account attacks, but we can ByPASS Claudflare access. Example: https://crm.unikrn.com/oauth/v2/authorizelogin Impact having accounts, we can easily get into t...

WordPress security: Steps to assess an employee before granting admin access to WordPress

By Waqas Are you planning to hand over admin access of your WordPress site to someone else? You certainly need to take some steps to ensure the security of your WordPress website. Since your WordPress site is your creation and you have put in a lot of hard work and efforts to make it what it is …...

Dark web hacker selling admin access to a Chinese railway company

By Waqas The IT security researchers at Sixgill's threat intelligence team have identified an "experienced threat actor" on the dark web selling access to the admin panel of a Chinese rail control system. This access would enable criminals to manipulate train control systems, affecting over one...

PYSEC-2019-142

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

Invision Power Board Stored Cross-Site Scripting Vulnerability

Invision Power Board is a popular forum program. Invision Power Board suffers from a stored cross-site scripting vulnerability. An attacker can exploit the vulnerability to gain access to the backend administrator's After obtaining administrator access to the backend, an attacker can modify...

DASAN H665 Backdoor Account Vulnerability

DASAN H665 has a vendor backdoor built into BusyBox /bin/login that provides remote root access with no password. DASAN H665 has vendor backdoor built into BusyBox /bin/login. Account named "dnsekakf2$$" gives access to admin uid 0 account over telnet without any password, at least for...

M/Monit 3.7.2 - Privilege Escalation Exploit

Exploit for multiple platform in category web applications !/usr/env/python3 """ Vulnerability title: M/Monit = 3.7.2 - Privilege Escalation Author: Dolev Farhi Vulnerable version: 2.0.151021 Link: https://mmonit.com Date: 2/17/2019 """ import sys import requests MMONITURL =...

CVE-2019-8407

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...

DASAN H665 Backdoor Account

Hi! DASAN H665 has vendor backdoor built into BusyBox /bin/login. Account named "dnsekakf2$$" gives access to admin uid 0 account over telnet without any password, at least for administration interface documented in H665 Quick Guide subnet 192.168.55.0/24 on LAN interface. $ telnet 192.168.55.1...

Magento Community Edition 2.1.x < 2.1.7 / 2.0.x < 2.0.14 Multiple Vulnerabilities

Binary data 700415.prm...

CVE-2019-7674

An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. /admin/access accepts a request to set the "aaaaa" password, considered insecure for some use cases, from a user...

Avtech IP Camera Default Credentials (HTTP)

The remote installation of Avtech SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.114064";...

CVE-2018-16483

CVE-2018-16483 affects express-cart (

UBUNTU-CVE-2019-6339

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing fi...