2896 matches found
Webmin 1.840 / 1.880 LFI
A local file inclusion vulnerability exists in Webmin 1.840 and 1.880 when the default Yes setting of 'Can view any file as a log file' is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to...
WordPress NextGEN Gallery Plugin < 3.5.0 Multiple Vulnerabilities
The WordPress plugin SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:imagely:nextgengallery"; if description...
CVE-2020-35942
A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...
WordPress Backup by Supsystic plugin <= 2.3.12 - Local File Inclusion (LFI) vulnerability
Local File Inclusion LFI vulnerability found by Erik David Martin in WordPress Backup by Supsystic plugin versions = 2.3.12. Solution 2021-02-08 - we were unable to find a patched version of this plugin. Notice from WordPress plugin repository: "This plugin has been closed as of December 1, 2020...
WordPress Popup Builder plugin <= 3.71 - Authenticated Local File Inclusion (LFI) vulnerability
Authenticated Local File Inclusion LFI vulnerability found by Dave Jong WebARX Security in WordPress Popup Builder plugin versions = 3.71. Solution Update the WordPress Popup Builder plugin to the latest available version at least 3.72...
Selea Targa IP OCR-ANPR Camera - 'addr' Remote Code Execution (Unauthenticated)
Exploit Title: Selea Targa IP OCR-ANPR Camera - 'addr' Remote Code Execution Unauthenticated Date: 07.11.2020 Exploit Author: LiquidWorm Vendor Homepage: https://www.selea.com !/bin/bash Selea Targa IP OCR-ANPR Camera Unauthenticated Remote Code Execution Vendor: Selea s.r.l. Product web page:...
Selea Targa IP OCR-ANPR Camera Unauthenticated Remote Code Execution
Summary IP camera with optical character recognition OCR software for automatic number plate recognition ANPR also equipped with ADR system that enables it to read the Hazard Identification Number HIN, also known as the Kemler Code and UN number of any vehicle captured in free-flow mode. TARGA is...
EyesOfNetwork 5.3 Local File Inclusion
Exploit Title: EyesOfNetwork 5.3 - LFI Date: 10/01/2021 Exploit Author: Audencia Business SCHOOL Red Team Vendor Homepage: https://www.eyesofnetwork.com/en Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x8664-bin.iso Version: 5.3 The php not exclude other tools than proposed...
EyesOfNetwork 5.3 - LFI
Exploit Title: EyesOfNetwork 5.3 - LFI Date: 10/01/2021 Exploit Author: Audencia Business SCHOOL Red Team Vendor Homepage: https://www.eyesofnetwork.com/en Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x8664-bin.iso Version: 5.3 The php not exclude other tools than proposed...
[20210402] - Core - Inadequate filters on module layout settings
Inadequate filters on module layout settings could lead to an LFI...
Rukovoditel 2.6.1 - RCE (1)
Exploit Title: Rukovoditel 2.6.1 - RCE Date: 2020-06-11 Exploit Author: coiffeur Write Up: https://therealcoiffeur.github.io/c1010 Vendor Homepage: https://www.rukovoditel.net/ Software Link: https://www.rukovoditel.net/download.php Version: v2.6.1 CVE: CVE-2020-11819 set -e function usage echo...
Car Rental Management System 1.0 Local File Inclusion / SQL Injection
Exploit Title: Car Rental Management System 1.0 - SQL Injection / Local File include Date: 22-10-2020 Exploit Author: Mosaaed Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html Software Link:...
Local File Inclusion (LFI)
october/cms is vulnerable to local file inclusion LFI. The vulnerability exists as unauthenticated users can read local files on an October CMS server through a web request...
Octopus WAF - Web Application Firewall Made In C Language And Use Libevent
OctopusWAF is a open source Web application firewall, is made in C language uses libevent to make multiple connections. First step Instal lib-pcre, if you use RPM based distros search pcre-devel package, in BSD based search in ports or brew... Need libevent-dev, on RPM distros libevent-devel,...
CVE-2020-7187
CVE-2020-7187 describes a remote code execution in HPE Intelligent Management Center (iMC) prior to PLAT 7.3 (E0705P07). The flaw is a reportpage index expression language injection in the index.xhtml handling of overTopForm:actionInput, where unsanitized input can be rendered with SYSTEM-level p...
BugPoC: LFI from bypassing image parser and faking HEAD response with redirection
Summary: add summary of the vulnerability By specially crafted request, a fake python3 http server and exploit.py we can read any files from the server Supporting Material/References: list any additional material e.g. screenshots, logs, etc. Bugpoc id: bp-HdMxEwwr bp-HdMxEwwr Bugpoc pass:...
BugPoC: LFI to steal /etc/passwd - Bypass filter in the <meta property="og:image"> tag via redirect and much more
Hey Team, Good &simple challenge. Wasn't able to find time to attempt this initially but was able to go about it today. The explanation of the bug with the POC is hosted on bugpoc.com Here is the id & password as requested - BugPoC ID : bp-wHwB2qAF - Password : dARKlYbAnana89 POC Screenshot using...
Sony: LFI at http://www.████
The researcher reported that a Sony endpoint was vulnerable to a Local File Inclusion LFI vulnerability via a URL parameter. The researcher was able to leverage this vulnerability to read the contents of sensitive system files such as /etc/passwd and /proc/version...
WordPress Theme mTheme-Unus < 2.3 LFI Vulnerability - Version Check
The WordPress theme mTheme-Unus, which comes with the WP Mobile Edition plugin, is prone to a local file inclusion LFI vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...