ClipBucket 2.8.3 - Multiple Vulnerabilities

Exploit for php platform in category web applications @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ .:. Exploit Title ClipBucket 2.8.3 - Multiple Vulnerabilities .:. Google Dorks .:. "Forged by ClipBucket" inurl:viewcollection.php?cid= .:. Date: August 15,...

Input validation

Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...

Code injection

An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2...

Easy File Sharing Web Server 7.2 - Unrestricted File Upload

Easy File Sharing Web Server 7.2 - Unrestricted File Upload 2017/6/15 Chako EFS Web Server 7.2 Unrestricted File Upload Vendor Homepage: http://www.sharing-file.com Software Link: https://www.exploit-db.com/apps/60f3ff1f3cd34dec80fba130ea481f31-efssetup.exe Version: Easy File Sharing Web Server 7...

CVE-2017-9836

CVE-2017-9836 affects Piwigo 2.9.1 with stored XSS via the virtual_name parameter in /admin.php (creating a virtual album). The issue requires an authenticated administrator to trigger the payload, allowing injection of arbitrary web script or HTML. The connected sources confirm the vulnerability...

CVE-2017-9759

SQL Injection exists in admin/index.php in Zenbership 1.0.8 via the filters array parameter, exploitable by a privileged account...

NetGain EM 7.2.647 build 941 - Authentication Bypass Local File Inclusion

NetGain EM 7.2.647 build 941 - Authentication Bypass Local File Inclusion ''' Exploit Title: Add User Account with Admin Privilege without Login & Local File Inclusion Date: 2017-05-21 Exploit Author: f3ci Vendor Homepage: http://www.netgain-systems.com Software Link:...

NetGain EM 7.2.647 build 941 - Authentication Bypass / Local File Inclusion

''' Exploit Title: Add User Account with Admin Privilege without Login & Local File Inclusion Date: 2017-05-21 Exploit Author: f3ci Vendor Homepage: http://www.netgain-systems.com Software Link: http://www.netgain-systems.com/free-edition-download/ Version: = v7.2.647 build 941 Tested on: Windows...

NetGain EM 7.2.647 build 941 - Authentication Bypass / Local File Inclusion Vulnerabilities

Exploit for jsp platform in category web applications ''' Exploit Title: Add User Account with Admin Privilege without Login & Local File Inclusion Date: 2017-05-21 Exploit Author: f3ci Vendor Homepage: http://www.netgain-systems.com Software Link:...

FortiWLC-SD Privilege escalation vulnerability using copy running-config

The lack of input sanitisation for CLI command 'copy running-config' allows a user with 'admin' or 'superuser' privilege level to gain shell on the FortiWLC-SD with root privilege...

CVE-2017-7571

public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges...

HelpDEZK 1.1.1 - Cross-Site Request Forgery / Code Execution Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1 Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.helpdezk.org/ Software Link:...

Privilege escalation

Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Base64-encoded session cookie value...

CVE-2016-9333

CVE-2016-9333 affects Moxa SoftCMS prior to version 1.6. The SoftCMS Webserver fails to properly sanitize input, enabling SQL Injection that could allow a remote attacker to gain administrator privileges. The vulnerability has been assigned CVSS v3 base score 9.8 (CRITICAL) with network access, n...

Alstrasoft FMyLife Pro 1.02 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: AlstraSoft FMyLife Pro v1.02 Script - Cross-Site Request Forgery Add Admin Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/fmylife-pro.htm Demo:...

e107 CMS-2.1.1 privilege elevation vulnerability

No description provided by source. $login, 'userpass' = $pass, 'userlogin' = 'Sign In'; curlsetopt$ch, CURLOPTPOST, 1; $content = curlexec$ch; if strpos$content, '?logout' === false die"Cannot login"; $data = array; $data'useradmin' = 1; $data'userperms' = 0; $data'userpassword' = md5$pass;...

Event Calender PHP Cross-Site Request Forgery Vulnerability

Event Calendar is an event calendar module for phpnuke. A cross-site request forgery vulnerability exists in the admin.php page of Event Calendar PHP version 1.5, which can be exploited by an attacker to add an administrator account or elevate privileges to an administrator account...

Design/Logic Flaw

Cisco IOS XR 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges, aka Bug ID CSCva38349...

Design/Logic Flaw

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

R-Scripts VRS 7R Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

PHP Vacation Rental Script version 7R suffers from cross site request forgery and cross site scripting vulnerabilities. R-Scripts VRS 7R Multiple Stored XSS And CSRF Vulnerabilities Vendor: R-Scripts Product web page: http://www.r-scripts.com Affected version: 7R Summary: PHP Vacation Rental Scri...