SEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Request or Destination settings of the plugin: "...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

CVE-2021-4034 - Proof Of Concept This POC exploits GLib's...

Exploit for Use After Free in Microsoft

CVE-2021-40449-NtGdiResetDC-UAF A POC for CVE-2021-40449. Onl...

Exploit for CVE-2022-25257

CVE-2022-25257 SAS Logon 9.4 allows warning-message injection...

Exploit for Code Injection in Digitaldruid Hoteldruid

CVE-2022-22909 Description A Code Injection vulnerability h...

[WP-H0] DEFAULT_ADMIN_ROLE of BribeVault can steal tokens from users' wallets

Lines of code Vulnerability details The current design/implementation allows the DEFAULTADMINROLE of BribeVault to steal funds from any address that approved this contract up to allowance: As a DEFAULTADMINROLE, the attack is simply do the following steps: 1. grantDepositorRole to self; 2...

Profile Builder < 3.6.2 - Reflected Cross-Site Scripting

The plugin does not properly sanitise and escape the siteurl parameter before outputting it back in an href attribute, leading to a Reflected Cross-Site Scripting issue PoC...

Powerkit < 2.5.9 - Post Views Settings Update/Reset via CSRF

The plugin does not have CSRF checks when saving or reseting its post views settings, which could allow an attacker to make a logged in admin change or reset them via a CSRF attack PoC...

WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)

Exploit Title: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing Authenticated Date: 09-11-2021 Exploit Author: Ceylan Bozogullarindan Exploit Website: https://bozogullarindan.com Vendor Homepage: https://bestwebsoft.com/ Software Link:...

Exploit for HTTP Request Smuggling in Sap Content_Server

It is an offensive tool for SAP memory pipesMPI desynchronizat...

Video Conferencing with Zoom < 3.8.17 - E-mail Address Disclosure

The plugin does not have authorisation in its vczapigetwpusers AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog PoC Open the following URL as a subscriber:...

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability. PoC POST /"/onmouseover=alert1;// HTTP/1.1 Host: 127.0.0.1 Content-Type:...

Exploit for Incorrect Authorization in Polkit_Project Polkit

CVE-2021-3560-Polkit-DBus Simple proof of concenpt script for...

Email Subscribers & Newsletters < 5.3.2 - Unauthenticated arbitrary option update

The plugin lacks both authentication and nonce checks in its esdismissadminnotice function, allowing an external attacker to set arbitrary plugin options to "yes". PoC https://example.com/?optionname=userrolesdismissadminnotice=1 This will set the option igesuserroles to "yes"...

AtomCMS v2.0 - SQL injection Vulnerability

Exploit Title: AtomCMS v2.0 - SQLi Exploit Author: Luca Cuzzolin aka czz78 Vendor Homepage: https://github.com/thedigicraft/Atom.CMS Version: v2.0 Category: Webapps Tested on: Debian linux CVE : CVE-2022-24223 ==================================================== PoC : SQLi :...

Exploit for Link Following in Microsoft

SpoolFool Exploit for CVE-2022-21999 - Windows Print Spooler...

Exploit for Out-of-bounds Read in Microsoft

POC CVE-2022-21877 This repository contains a POC for the CVE...

CISA Orders Federal Agencies to Fix Actively Exploited Windows Bug

CISA is putting the thumbscrews on federal agencies to get them to patch an actively exploited Windows vulnerability. On Friday, the U.S. Cybersecurity and Infrastructure Security Agency CISA announced that it added the vulnerability – tracked as CVE-2022-21882 and with a CVSS criticality rating ...

Exploit for Out-of-bounds Write in Microsoft

cve-2022-21882-poc lpe poc...

Servisnet Tessa - MQTT Credentials Dump (Unauthenticated) Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require 'metasploit/framework/loginscanner/mqtt' class MetasploitModule 'Servisnet Tessa - MQTT Credentials Dump...