Exploit for CVE-2018-9995

CVE-2018-9995 - DVR Authentication Bypass This repository add...

HTML Injection

Description I think your website is quite secure. But you overlooked the HTML Injection vulnerability ID:WSTG-CLNT-03 of OWASP. Proof of Concept 1 .Login with demo account 2 .Access the link https://demo.librenms.org/search/search=ipv4 and insert the payload search=test/b 3 .Hit enter, html...

DOM XSS in https://demo.librenms.org/outages

Description I noticed, your website is very secure. But you overlooked a flaw XSS Detail: 1 .Login with demo account. 2 .Go to the link: https://demo.librenms.org/outages and click Filter 3 .Use burp suite to block proxy and inject payload: "alertdocument.cookie 4 .Check, detect xss Proof of...

There are 6 NULL Pointer Dereference vulnerabilities in MP4Box

NULL Pointer Dereference in function utils/xmlparser.c:1038 Description NULL Pointer Dereference in function utils/xmlparser.c:1038 Environment No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 20.04 LTS Release: 20.04 Codename: focal Version MP4Box - GPAC version...

Stored Cross-site Scripting

Description Stored XSS attack, the attacker typically injects malicious code, such as JavaScript, into a web form or other input field on a vulnerable web application. This code is then stored on the server and may be displayed to other users who visit the affected page, allowing the attacker to...

Heap-use-after-free in function buflist_altfpos in vim

Description Heap-use-after-free in function buflistaltfpos at buffer.c:3703 Proof of Concept ./vim -u NONE -i NONE -n -m -X -Z -e -s -S ./pochuaf -c :qa! ==1404==ERROR: AddressSanitizer: heap-use-after-free on address 0x625000011940 at pc 0x0000004a4dbe bp 0x7ffc6204d090 sp 0x7ffc6204d080 READ of...

Cross-site Scripting (XSS) - Reflected

Description Reflected Cross-Site Scripting XSS vulnerability allows attackers to execute arbitrary external javascript code in the browser. In the application there exists a XSS vulnerability that occurs in the api: Payload: "alertwindow.location GET /system/api/restApiViewer: Passing XSS payload...

File Upload Bypass Leads to Stored XSS

Description Fix at https://huntr.dev/bounties/fce38751-bfd6-484c-b6e1-935e0aa8ffdc/ is not adequate，attacker can use test.html?a=1 to bypass built-in PHP function pathinfo. Also can used for .php Proof of Concept // payload.html?a=1 alert'xss' POC Video:...

CVE-2015-0005

creationtimestamp| type| source ---|---|--- 2023-08-14 23:17:31+00:00| published-proof-of-concept| Telegram/3Ml6Nk8NJ3ADf7LnN2hd7auSU6aBPb8QTkezzsJ3hiqoGcY 2026-07-29 12:01:13+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-07-30 00:01:49+00:00| seen|...

Arbitrary file upload

Description Due to lack of file extension validation, privileged user administrator can upload arbitrary files with "update logo" and "update icon" features. The application uses the extension provided in the filename parameter. Proof of Concept POST /admin/default/jqadm/save/settings?locale=en...

CVE-2023-40013

creationtimestamp| type| source ---|---|--- 2023-08-14 10:51:32+00:00| published-proof-of-concept| https://github.com/shubhamjain/svg-loader/security/advisories/GHSA-xc2r-jf2x-gjr8...

XSS at file uploading

Description In menu Add page, there is a upload file function and xss payload can be injected there. Detail: 1/ Access to the web demo and go to Add page menu. 2/ At upload file function, upload an file with filename is a payload xss. 3/ It will be triggered immediately. Proof of Concept Payload:...

CVE-2023-21921

creationtimestamp| type| source ---|---|--- 2023-08-13 13:50:29+00:00| published-proof-of-concept| https://t.me/JerusalemElectronicArmy/535...

Improper validation of intent data received in TextViewerActivity allows opening of arbitrary files

Description Tested on Build87 of the Inure application. It was discovered that the application had an exported activity .activities.association.TextViewerActivity which accepted intent data via the file scheme + text/ mime type and opened the associated files from provided URI data string. It is...

Theft of Arbitrary Files due to execution of attacker scripts from BashAssociation.kt

Description Tested on Build87 of the Inure application. It was discovered that the application had an exported activity app.simple.inure.activities.association.BashAssociation which accepted intent data via the file scheme + text/x-shellscript mime type and executed the commands contained within...

CVE-2023-4265

creationtimestamp| type| source ---|---|--- 2023-08-13 02:17:48+00:00| published-proof-of-concept| https://t.me/cibsecurity/68389...

CVE-2023-4165

creationtimestamp| type| source ---|---|--- 2023-08-12 14:58:46+00:00| published-proof-of-concept| https://t.me/CNArsenal/858...

CVE-2023-38687

creationtimestamp| type| source ---|---|--- 2023-08-12 13:32:06+00:00| published-proof-of-concept| https://github.com/mskocik/svelecte/security/advisories/GHSA-7h45-grc5-89wq 2023-08-15 00:20:01+00:00| published-proof-of-concept| https://t.me/cibsecurity/68495...

CVE-2023-30533

creationtimestamp| type| source ---|---|--- 2023-08-11 03:59:21+00:00| published-proof-of-concept| https://t.me/crackcodes/4014 2023-08-11 04:00:05+00:00| published-proof-of-concept| Telegram/oCXtildE2yTi9IxdSuzh8AMqV0fg39dXN2lm3qeaYClxQ 2023-08-11 11:17:53+00:00| published-proof-of-concept|...

CVE-2023-36899

creationtimestamp| type| source ---|---|--- 2023-08-10 16:18:02+00:00| published-proof-of-concept| https://t.me/ptswarm/182 2023-08-11 14:40:00+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4901 2023-08-12 12:43:01+00:00| published-proof-of-concept|...