uc-http Daemon - Local File Inclusion Directory Traversal

uc-http Daemon - Local File Inclusion Directory Traversal ''' | \ | \ | | | | | | / \ | | | |/ / | |/ / | | | | | | | | | / / | | | / | / | | | | | | | | | | | | | | | |\ \ \ / / // / | | | /\ | | | | | / / / / / | | | \ | | / | | | / \ | | | | | \ | | | | \ \ / / | | | | | \ --. | | |...

uc-http Daemon - Local File Inclusion / Directory Traversal Vulnerabilities

Exploit for hardware platform in category web applications ''' | \ | \ | | | | | | / \ | | | |/ / | |/ / | | | | | | | | | / / | | | / | / | | | | | | | | | | | | | | | |\ \ \ / / // / | | | /\ | | | | | / / / / / | | | \ | | / | | | / \ | | | | | \ | | | | \ \ / / | | | | | \ --. | |...

uc-http Daemon - Local File Inclusion / Directory Traversal

''' | \ | \ | | | | | | / \ | | | |/ / | |/ / | | | | | | | | | / / | | | / | / | | | | | | | | | | | | | | | |\ \ \ / / // / | | | /\ | | | | | / / / / / | | | \ | | / | | | / \ | | | | | \ | | | | \ \ / / | | | | | \ --. | | | / / | | | | | |/ / | | | | \ V / | | | . | --. \ | | | |...

Exponent CMS 2.3.9 LFI

Local file include vulnerability in Exponent CMS page parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Design/Logic Flaw

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access...

CVE-2017-7282

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access...

CVE-2017-7282

The CVE-2017-7282 vulnerability affects Unitrends Enterprise Backup before 9.1.1. The downloadFile function in api/includes/restore.php accepts any filename passed to /api/restore/download, allowing an authenticated attacker to read arbitrary files accessible to the web server (Local File Inclusi...

XiongMai uc-http 1.0.0 Local File Inclusion / Directory Traversal

uc-httpd is an HTTP daemon used by a wide array of IoT devices and is vulnerable to local file inclusion and directory traversal bugs. +---------------------------------------------------------+ | Vulnerable Software: uc-httpd | | Vendor: XiongMai Technologies | | Vulnerability Type: LFI, Directo...

XiongMai uc-http 1.0.0 Local File Inclusion / Directory Traversal

| \ | \ | | | | | | / \ | | | |/ / | |/ / | | | | | | | | | / / | | | / | / | | | | | | | | | | | | | | | |\ \ \ / / // / | | | /\ | | | | | / / / / / | | | \ | | / | | | / \ | | | | | \ | | | | \ \ / / | | | | | \ --. | | | / / | | | | | |/ / | | | | \ V / | | | . | --. \ | | | | | |...

Intellinet NFC-30IR Camera - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Multiple Vulnerabilities in Intellinet NFC-30IR Network Cameras ADVISORY -------- Title: Local File Inclusion in CGI-SCRIPT & Hard-Coded Manufacturer Backdoor Advisory ID: BITL-17-001 Date published: 2017-04-05 Date of last update:...

WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)

The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...

WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)

The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. PoC http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...

Direct Download for WooCommerce <= 1.15 - Unauthenticated LFI

The directdownload WordPress plugin was affected by an Unauthenticated LFI security vulnerability...

WordPress WP Vault 0.8.6.6 LFI

Local file include vulnerability in WordPress WP Vault plugin wpv-image parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Python JSON Fuzzer: PyJFuzz

Python JSON Fuzzer PyJFuzz is a small, extensible and ready-to-use framework used to fuzz JSON inputs , such as mobile endpoint REST API, JSON implementation, Browsers, cli executable and much more. Dependencies In order to work PyJFuzz need a single dependency, bottle , you can install it from...

InPost Gallery <= 2.1.2 - LFI & Authenticated Stored XSS

The InPost Gallery WordPress plugin was affected by a LFI & Authenticated Stored XSS security vulnerability...

BLACKBOx - A Penetration Testing Framework

Password Attacks: MD5 CRACKER SHA1 CRACKER SHA224 CRACKER SHA256 CRACKER SHA384 CRACKER SHA512 CRACKER MSSQL2000 CRACKER MSSQL2005 CRACKER MYSQL323 CRACKER MYSQL41 CRACKER ORACLE11 CRACKER Web Hacking : Wordpress Bruteforce – Bruteforce wordpress panel FTP Bruteforce – Bruteforcing FTP LOGIN SSH...

Zimbra iCollaboration Server LFI

Local file include vulnerability in Zimbra iCollaboration Server Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Elasticsearch < 1.6.1 LFI

LFI on snapshot Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

CYSTEME Finder <= 1.3 - Unauthenticated LFI and Unauthenticated File Upload

CYSTEME does not properly check SESSION Cookies allowing a remote attacker to upload, view, or delete files from any location on the remote file system. PoC - Retrieve all data in the root wordpress directory. This will return JSON. Exploit:...