287 matches found
Exploit for Code Injection in Phpunit_Project Phpunit
laravel phpunit rce masscanner CVE-2017-9841 Masscanner for La...
Oracle WebLogic Server 14.1.1.0 - RCE (Authenticated)
Exploit Title: Oracle WebLogic Server 14.1.1.0 - RCE Authenticated Date: 2021-01-21 Exploit Author: Photubias Vendor Advisory: 1 https://www.oracle.com/security-alerts/cpujan2021.html Vendor Homepage: https://www.oracle.com Version: WebLogic 10.3.6.0, 12.1.3.0, 12.2.1.3, 12.2.1.4, 14.1.1.0 fixed ...
Terramaster TOS Authorization Issues Vulnerability
Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster in China. An authorization issue vulnerability exists in TerraMaster TOS version 4.2.06 and prior versions, which originates from email...
Exploit for SQL Injection in Drupal
vulnerability-list 常见漏洞快速检测，目前包含以下漏洞。 Tomcat： - CVE201712615 / CVE201712617 - tomcatweakpassword - examplevulnerability检测tomcat的examples等目录是否存在 moon.py -u tomcat http://xx.xx.xx.xx:xxxx Fckeditor - 获取版本及常见上传页面检测 - fck moon.py -u fck http://xx.xx.xx.xx/fckxx Weblogic - CVE201710271...
RSVPMaker < 7.8.2 - Unauthenticated SQL Injection
The plugin does not sanitise user input before using it in a SQL statement in the signedupajax AJAX action. Note: Even though the reported SQL Injection was fixed in v7.8.2, other additional sanitisation was implemented in v7.8.3 to 7.8.6. sqlmap -u "https://localhost/?action=signedup&eventcount=...
Nextcloud Deck Access Control Error Vulnerability
Nextcloud Deck is a Kanban-style organization tool developed by Nextcloud, Inc. designed for individual planning and project organization for teams integrated with Nextcloud. An access control vulnerability exists in Nextcloud Deck version 1.0.0. An attacker can exploit the vulnerability to injec...
httplib2 injection vulnerability
httplib2 is an HTTP client library. An injection vulnerability exists in httplib2 versions prior to 0.18.0. An attacker can exploit the vulnerability by changing the request header and body via the unescaped portion of a controlled uri httplib2.Http.request and sending other hidden requests to th...
Exploit for Injection in Oracle Agile_Plm
CVE-2019-2725 bypass tips coded in python3,payloadhereh...
Exploit for Injection in Oracle Agile_Plm
CVE-2019-2725 CVE-2019-2725 CNVD-C-2019-48814; WebLogic wls...
Exploit for Injection in Oracle Agile_Plm
CNTA-2019-0014-CVE-2019-2725 Disclaimer: This tool...
elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'elFinder PHP Connector exiftran Command Injection', 'Description' = %q This module exploits a command injection vulnerability in elFinder version...
GL-AR300M-Lite 2.27 - (Authenticated) Command Injection Arbitrary File Download Directory Traversal
GL-AR300M-Lite 2.27 - Authenticated Command Injection Arbitrary File Download Directory Traversal Exploit Title: GL-AR300M-Lite Authenticated Command injection - Arbitrary file download - Directory Traversal Date: 15/1/2019 Exploit Author: Pasquale Turi aka boombyte Vendor Homepage:...
Imperva SecureSphere 13 - Remote Command Execution
Imperva SecureSphere 13 - Remote Command Execution Title: Imperva SecureSphere 13 - Remote Command Execution Author: rsp3ar Date: 2018-10-08 Vendor: https://www.imperva.com/products/securesphere/ CVE: N/A Version: 13.0.10, 13.1.10, 13.2.10 Tested on: SecureSphere Virtual Appliance Description PWS...
Design/Logic Flaw
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating t...
KYOCERA Multi-Set Template Editor 3.4 Out-Of-Band XML External Entity Injection
Summary KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network administrators easy and uncomplicated control to handle a fleet for up to 10,000 devices. Tasks that used to require multiple programs or walking to each printer can now be...
Joomla! File Download Tracker 3.0 SQL Injection
Exploit Title: Joomla! Component File Download Tracker 3.0 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://techsolsystem.com/ Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/downloads/file-download-tracker/ Version: 3.0 Category:...
Joomla! Component DT Register 3.2.7 - 'id' SQL Injection
Exploit Title: Joomla! Component DT Register 3.2.7 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: https://www.dthdevelopment.com/ Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/dt-register/ Version: 3.2.7 Category: Webapps Tested on:...
Laundry Booking Script 1.0 - list?city SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Laundry Booking Script 1.0 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/laundry-booking-script/ Version: 1.0 Category: Webapps...
Infinite Automation / Mango Automation - Command Injection Exploit
Exploit for jsp platform in category remote exploits require 'msf/core' class MetasploitModule 'Infinite Automation Mango Automation Command Injection', 'Description' = %q This module exploits a command injection vulnerability found in Infinite Automation Systems Mango Automation v2.5.0 - 2.6.0...