CVE-2021-29447-Authenticated-XXE-WordPress-5.6-5.7

CVE-2021-29447 Exploitation XXE Authentifiée pour WordPress 🎯 Un PoC en Python pour exploiter la vulnérabilité XXE authentifiée CVE-2021-29447 dans les versions de WordPress 5.6–5.7 via les métadonnées WAV. Il abuse du morceau iXML dans les fichiers WAV pour déclencher une exfiltration Out-of-Ban...

CVE-2021-30137

Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points...

Design/Logic Flaw

Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points...

CVE-2021-30137

Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points...

Default credentials

xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...

HP Enterprise Maps 1.00 Authenticated XXE Injection

HP Enterprise Maps 1.00 Authenticated XXE vulnerability http://www8.hp.com/us/en/software/enterprise-software.html Any user that has the ability to import a file to create an artifact most, if not all authed users? can upload a specially crafted WSDL that will read files such as /etc/passwd. If y...