WordPress Revamp CRM for WooCommerce plugin <= 1.0.3 - Local File Inclusion (LFI) vulnerability

Local File Inclusion LFI vulnerability found in WordPress Revamp CRM for WooCommerce plugin versions = 1.0.3. Solution Update the WordPress Revamp CRM for WooCommerce plugin to the latest available version at least 1.0.4...

CVE-2019-3737

Dell EMC Avamar ADMe Web Interface 1.0.50 and 1.0.51 are affected by an LFI vulnerability which may allow a malicious user to download arbitrary files from the affected system by sending a specially crafted request to the Web Interface application...

CVE-2019-3737

Dell EMC Avamar ADMe Web Interface versions 1.0.50 and 1.0.51 are affected by a Local File Inclusion (LFI) vulnerability. The issue allows a malicious user to download arbitrary files from the affected system via a specially crafted request to the Web Interface. The connected CNVD entry confirms ...

CVE-2019-3737 Dell EMC Avamar Security Update for ADMe Web UI Vulnerability

Dell EMC Avamar ADMe Web Interface 1.0.50 and 1.0.51 are affected by an LFI vulnerability which may allow a malicious user to download arbitrary files from the affected system by sending a specially crafted request to the Web Interface application...

Sina Extension For Elementor <= 2.2.0 - LFI

The Sina Extension for Elementor WordPress plugin was affected by a LFI security vulnerability...

RapidScan - The Multi-Tool Web Vulnerability Scanner

Evolution: It is quite a fuss for a pentester to perform binge-tool-scanning running security scanning tools one after the other sans automation. Unless you are a pro at automating stuff, it is a herculean task to perform binge-scan for each and every engagement. The ultimate goal of this program...

Revamp CRM for WooCommerce <= 1.0.3 - LFI

The Revamp CRM for WooCommerce WordPress plugin was affected by a LFI security vulnerability...

CVE-2019-12314

Deltek Maconomy 2.2.5 is vulnerable to Local File Inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, demonstrated by requests like cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd. Public references (Exploit-DB, PacketStorm, and related advisories) describe LFI access to se...

Photo Gallery by 10Web <= 1.5.24 - Authenticated LFI

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an Authenticated LFI security vulnerability...

CVE-2019-11397

GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 when used with .NET Framework 4.5 allows Local File Inclusion via the FileDesc parameter...

QRGen - Simple Script For Generating Malformed QRCodes

Simple Script For Generating Malformed QRCodes. These qrcodes are useful if you want to test some QRCode scanner's parser or how the application handle QRCode data. Down side of this tool: you need to manually scan codes with camera. Proof Installation What do you need: python3 qrcode Pillow...

CVE-2019-11537

CVE-2019-11537 affects osTicket prior to 1.12. An XSS flaw exists in file upload paths (/upload/file.php, /upload/scp/users.php?do=import-users, /upload/scp/ajax.php/users/import) when an agent manager uploads a crafted CSV to the User Importer, caused by error-message content echoing file conten...

osTicket 1.11 - Cross-Site Scripting / Local File Inclusion Vulnerabilities

Exploit for php platform in category web applications Exploit Title: osTicket v1.11 - Cross-Site Scripting to Local File Inclusion Exploit Author: Özkan Mustafa Akkuş AkkuS @ehakkus Contact: https://pentest.com.tr Vendor Homepage: https://osticket.com Software Link:...

osTicket 1.11 Cross Site Scripting / Local File Inclusion

Exploit Title: osTicket v1.11 - Cross-Site Scripting to Local File Inclusion Date: 09.04.2019 Exploit Author: Özkan Mustafa Akkuş AkkuS @ehakkus Contact: https://pentest.com.tr Vendor Homepage: https://osticket.com Software Link: https://github.com/osTicket/osTicket References:...

osTicket 1.11 - Cross-Site Scripting Local File Inclusion

osTicket 1.11 - Cross-Site Scripting Local File Inclusion Exploit Title: osTicket v1.11 - Cross-Site Scripting to Local File Inclusion Date: 09.04.2019 Exploit Author: Özkan Mustafa Akkuş AkkuS @ehakkus Contact: https://pentest.com.tr Vendor Homepage: https://osticket.com Software Link:...

osTicket 1.11 - Cross-Site Scripting / Local File Inclusion

Exploit Title: osTicket v1.11 - Cross-Site Scripting to Local File Inclusion Date: 09.04.2019 Exploit Author: Özkan Mustafa Akkuş AkkuS @ehakkus Contact: https://pentest.com.tr Vendor Homepage: https://osticket.com Software Link: https://github.com/osTicket/osTicket References:...

Contact Form Builder <= 1.0.68 - CSRF to LFI

The WDContactFormBuilder WordPress plugin was affected by a CSRF to LFI security vulnerability...

WordPress Contact Form Builder 1.0.67 CSRF / LFI

Exploit Title: Contact Form Builder CSRF → LFI Date: 2019-03-17 Exploit Author: Panagiotis Vagenas Vendor Homepage: http://web-dorado.com/ Software Link: https://wordpress.org/plugins/contact-form-builder Version: 1.0.67 Tested on: WordPress 5.1.1 Description ----------- Plugin implements the...

U.S. Dept Of Defense: LFI with potential to RCE on ██████ using CVE-2019-3396

POC POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: ██████ Content-Type: application/json Content-Length: 174 "contentId":"12345","macro":"name":"widget","body":"","params":"url":"https://www.youtube.com/watch?v=wHEHYJpCkpg","width":"300","height":"200","template":"file://../" Thanks, Ben Impac...

Zeebsploit - Web Scanner / Exploitation / Information Gathering

zeebsploit is a tool for hacking searching for web information and scanning vulnerabilities of a web Installation & Usage apt-get install git git clone https://github.com/jaxBCD/Zeebsploit.git cd Zeebsploit chmod +x install ./install python3 zeebsploit.py type 'help' for show modules and follow...