12857 matches found
VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities
Exploit Title: VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities Google Dork: intext:"Wallpaper Admin" "LOGIN" "password" "Username" Exploit Author: Edd13Mora Vendor Homepage: www.viaviweb.com Version: N/A Tested on: Windows 11 - Kali Linux ------------------ SQLI on the Login page...
InPost Gallery <= 2.1.4.1 - Reflected XSS
The plugin does not sanitise and escape the imgurl parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Ibexa Ezplatform-Graphql
CVE-2022-41876 - eZ Platform user information disclosure A vu...
Exploit for Untrusted Pointer Dereference in Microsoft
CVE-2023-21768 Local Privilege Escalation POC authors: chomp...
Stored XSS in name parameter of "Customers Reports"
Description The name parameter of the "Static Routes" functionality is vulnerable to stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Marketing - Customers Reports - Add and Enter the name of the new item a-zA-Z-. 3.Then capture the request on the burp suite an...
Multiple Stored XSS in name parameter of "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes"
Description The name parameter of the "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes" functionality is vulnerable to Stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Online Shop - Pricing Rules - Add and Enter the name of the new...
Online Pizza Ordering System 1.0 SQL Injection Vulnerability
Exploit Title: Online Pizza Ordering System 1.0 - "id" SQLi Exploit Author: Abdulhakim Öner Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html Software Download:...
All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal
The plugin does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only displays the last 50 lines of the file. PoC POST...
Adobe Connect 11.4.5 / 12.1.5 Local File Disclosure
Title: adobe connect - Local File Disclosure / Download security feature bypass vulnerability Author: h4shur date:2021.01.16-2023.02.17 CVE: CVE-2023-22232 Vendor Homepage: https://www.adobe.com Software Link: https://www.adobe.com/products/adobeconnect.html Version: 11.4.5 and earlier, 12.1.5 an...
Exploit for Improper Input Validation in Microsoft
CVE-2023-23397-POC-Using-...
Exploit for Improper Input Validation in Microsoft
CVE-2023-23397 CVE-2023-23397 C PoC 1- download the msgkit 2...
Exploit for Out-of-bounds Write in Fortinet Fortios
FortiOS SSL-VPN buffer overflow vulnerability cve-2022-424...
Human Resources Management System - Multiple SQL injection Vulnerability
A Blind SQL injection vulnerability in the login page /hrm/controller/login.php in Human Resources Management System allows remote unauthenticated attackers to execute remote command through arbitrary SQL commands by "name" parameter. Request PoC POST /hrm/controller/login.php HTTP/1.1 Host:...
Exploit for Cross-site Scripting in Snyk Advisor
Stored XSS snyk.io Discovery 19/03/23 CVE-2023...
Exploit for Incorrect Authorization in Cacti
CVE-2022-46169 PoC: Authentication Bypass and Remote Code Exec...
Exploit for Improper Access Control in Joomla Joomla\!
CVE-2023-23752 Introduction Open-source, Go-based multi-conc...
org.xwiki.platform:xwiki-platform-panels-ui vulnerable to Eval Injection
Impact Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of UIX parameters A proof of concept exploit is to log in, add an XWiki.UIExtensionClass xobject to the user profil...
Exploit for Untrusted Pointer Dereference in Microsoft
CVE-2023-21768 Local Privilege Escalation POC authors: chomp...