10Web Social Post Feed < 1.1.27 - Authenticated SQL Injection

Authenticated SQL injection in the 10Web Social Post Feed WordPress Plugin 1.1.26 via the /wordpress/wp-admin/admin.php?page=infoffwd searchvalue parameter. PoC https://drive.google.com/file/d/1Hndhdy3leYTzutx-DJvu1B-tW5Y5teBB/view...

Exploit for CVE-2020-13933

CVE-2020-13933 – Test Bed shiro: Permission configuration...

BugPoC: Reading arbitrary files via running arbitrary python code

Summary: Reading arbitrary files via running arbitrary python code Steps To Reproduce: 1. Go to Python POC and execute arbitrary code to read arbitrary files Recording: F976069 I have stopped testing further. Users can run arbitrary python code. Please do let me know If anything is unclear. Impac...

FreeBSD : gnupg -- AEAD key import overflow (f9fa7adc-ee51-11ea-a240-002590acae31)

Importing an OpenPGP key having a preference list for AEAD algorithms will lead to an array overflow and thus often to a crash or other undefined behaviour. Importing an arbitrary key can often easily be triggered by an attacker and thus triggering this bug. Exploiting the bug aside from crashes ...

Automattic: Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - Bypass

Hello there, I hope all is well! I found a stored xss on https://app.crowdsignal.com/ Steps: Go to https://app.crowdsignal.com/dashboard Create a survey. Go to https://app.crowdsignal.com/quizzes/survey-id/question Add Multiple Choice Click Add media button. Select Embed Media Paste this:...

Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind

cve-2020-24616-poc cv...

Mara CMS 7.5 Remote Code Execution

Exploit Title: Mara CMS 7.5 - Remote Code Execution Authenticated Google Dork: N/A Date: 2020-08-31 Exploit Author: Michele Cisternino 0blio Vendor Homepage: https://sourceforge.net/projects/maracms/ Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download Version: 7.5...

Bulk Change <= 1.0 - Authenticated Reflected Cross-Site Scripting

The Bulk Change page under Tools Bulk Posts Change has an 's' GET parameter echoed to a text input tag value without being sanitised, leading to a cross-site scripting issue. PoC /wp-admin/tools.php?page=bulk-change%2Fbulk-change.phppage=10=Search+...posttypeaction="...

Online Shopping Alphaware 1.0 - 'id' SQL Injection

Title: Online Shopping Alphaware 1.0 - 'id' SQL Injection Exploit Author: Moaaz Taha 0xStorm Date: 2020-08-28 Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html Software Link:...

GLSA-202008-14 : Wireshark: Denial of service

The remote host is affected by the vulnerability described in GLSA-202008-14 Wireshark: Denial of service A double free error was discovered in Wiresharks Kafka dissector. Impact : A remote attacker could exploit these vulnerabilities by sending a malformed packet or enticing a user to read a...

Exploit for CVE-2020-1938

It is an exploit module for CNVD-2020-10487 CVE-2020-1938, a file read vulnerability in Tomcat AJP. The vulnerability allows an attacker to read files on the server by sending a specially crafted AJP request. The exploit is implemented in Python 2.7 and uses the ajpy library to interact with the...

Google Fixes High-Severity Chrome Browser Code Execution Bug

The Google Chrome web browser has a high-severity vulnerability that could be used to execute arbitrary code, researchers say. The flaw has been fixed in the Chrome 85 stable channel, set to be rolled out to users this week. The flaw CVE-2020-6492 is a use-after-free vulnerability in the WebGL We...

WordPress NAB Transact WooCommerce 2.1.0 Payment Bypass Vulnerability

Exploit for php platform in category web applications Title: Payment bypass Product: WordPress NAB Transact WooCommerce Plugin Vendor Homepage: https://woocommerce.com/products/nab-transact-direct-post/ Vulnerable Version: 2.1.0 Fixed Version: 2.1.2 CVE Number: CVE-2020-11497 Author: Jack Misiura...

CVE-2020-10290 RVD#1495: Universal Robots URCaps execute with unbounded privileges

Universal Robots controller execute URCaps zip files containing Java-powered applications without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our PoC we demonstrate how a malicious actor...

CVE-2020-10290

The CVE-2020-10290 issue affects Universal Robots URCaps: zip-based URCaps deployable by the UR controller allow execution with unbounded privileges via a Java-powered URCap. The root cause is execution of URCaps without permission restrictions, using a broad API that can compromise robot operati...

Brave Software: Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSS

Summary: An attacker can use the "Save .torrent file" option in WebTorrent to smuggle malicious files onto the client's machine. Description Brave allows users to download the ".torrent" via WebTorrent. WebTorrent decides whether a file is torrent or not based on the following headers...

Rocket.Chat: Session Hijack via Self-XSS

Summary: It's possible to hijack a session by tricking the user to perform a Self-XSS on the drag and drop functionality in the chat. Description: Self-XSS is an underrated vulnerability that can have a harmful impact on the users of the application like here, after we get access to the user's...

Joomla Adagency 6.1.2 Cross Site Scripting

Exploit Title: Joomla! Adagency V 6.1.2 Cross Site Scripting Date: 24.07.2020 Author: Vincent666 ibn Winnie Software Link: https://adagency.ijoomla.com/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest-vincent.blogspot.com/...

WordPress NAB Transact WooCommerce 2.1.0 Payment Bypass

Title: Payment bypass Product: WordPress NAB Transact WooCommerce Plugin Vendor Homepage: https://woocommerce.com/products/nab-transact-direct-post/ Vulnerable Version: 2.1.0 Fixed Version: 2.1.2 CVE Number: CVE-2020-11497 Author: Jack Misiura from The Missing Link Website:...

Elegant Testimonial <= 1.1.6 - Multiple Authenticated Stored Cross-Site Scripting

The name, company and text fields used while adding a testimonial to a page was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a user loads a page where the plugin shortcode is used. All WordPress websites...