Change WordPress Login Logo < 1.1.5 - Authenticated Stored Cross-Site Scripting

The height, and width fields used to update the custom logo was found to be vulnerable to stored XSS, as they did not sanitize user input properly before publishing the changes. It is triggered when a user loads the login page. PoC Set the following payload as Height or Width in the plugin's...

Acronis: CSRF and XSS on www.acronis.com

Vulnerability description not provided...

vBulletin 5.6.2 Persistent Cross Site Scripting

Exploit Title: vBulletin 5.6.2 Stored XSS Date:15.08.2020 Author: Vincent666 ibn Winnie Software Link: https://www.vbulletin.com/en/features/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest-vincent.blogspot.com/ PoC:...

XenForo 2.1.10 Patch 2 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: XenForo v2.1.10 Patch 2 Stored XSS Author: Vincent666 ibn Winnie Software Link: https://xenforo.com/demo/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog :https://pentest-vincent.blogspot.com/ PoC...

Geo Magazine <= 2.0 - Unauthenticated Reflected XSS

An Unauthenticated Reflected XSS vulnerability was discovered in the Geo Magazine theme through 2.0 for WordPress. Edit WPScanTeam: July 27th, 2020 - Confirmed & Escalated to Envato July 28th, 2020 - Envato Investigating August 17th, 2020 - No updates, disclosing The PoC will be displayed once th...

WebKit On iOS PAC / JIT Hardening Bypass Vulnerability

PAC and JIT Hardening Bypass in WebKit on iOS As per discussions with email protected, Apple would like to treat the PAC bypass described here as a security vulnerability by itself. The bypass was initially reported without a deadline on May 6. After receiving the reply that they will treat it as...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft

cve-2020-1337-poc poc for CVE-2020-1337 Windows Print Spooler...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft

PoC exploit for CVE-2020-1048. It is an exploit targeting a bina...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft

CVE-2020-1337 CVE-2020-1337 is a bypass of PrintDemon...

Exploit for CVE-2020-6519

Chromium 83 Zero Day Full CSP Bypass Cross Platforms CVE-...

Zomato: [api.zomato.com] Abusing LocalParams (city_id) to Inject SOLR query

Disclosing it as per the request from @zzzhacker13. This report is identical to 844428 but this one was on a different endpoint. POC - - :v2/red/homepage.json?lat=&lon=&cityid=!dismax+df=cityid86&androidcountry=US&lang=en&androidlanguage=en Zomato Security Team...

Daily Expenses Management System 1.0 - 'item' SQL Injection

Exploit Title: Daily Expenses Management System 1.0 - 'item' SQL Injection Date: 2020-08-05 Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html Software Link:...

Online Shopping Alphaware 1.0 Insecure Direct Object Reference Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Shopping Alphaware 1.0 - 'Summary' Insecure Direct Object Reference Authenticated Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html Software Link:...

Daily Expenses Management System 1.0 SQL Injection

Exploit Title: Daily Expenses Management System 1.0 - Multiple SQL Injection Vulnerabilty Date: 2020-8-5 Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html Software Link:...

Daily Expenses Management System 1.0 Cross Site Scripting

Exploit Title: Daily Expenses Management System 1.0 - Multiple Persistent Cross-Site Scripting Date: 2020-8-4 Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html Software Link:...

Daily Expenses Management System 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Daily Expenses Management System 1.0 - Multiple SQL Injection Vulnerabilty Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html Software Link:...

Online Shopping Alphaware 1.0 Unauthorized Administrative Access

Exploit Title: Online Shopping Alphaware 1.0 - Unauthorized Admin Page Access Date: 2020-8-4 Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html Software Link:...

RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)

Exploit Title: RTSP for iOS 1.0 - 'IP Address' Denial of Service PoC Author: Luis Martinez Discovery Date: 2020-08-03 Vendor Homepage: https://appadvice.com/app/rtsp-viewer/1056996189 Software Link: App Store for iOS devices Tested Version: 1.0 Vulnerability Type: Denial of Service DoS Local Test...

Exploit for Origin Validation Error in Solarwinds Dameware_Mini_Remote_Control

CVE-2019-3980 This repo was created to utilize the Nessus POC...

Mara CMS 7.5 Cross Site Scripting

============================================================================== | Title : Mara CMS 7.5 Cross Site Scripting | | Author : George Tsimpidas | | Tested on : Kali Linux X64 | | Vendor : https://sourceforge.net/projects/maracms/ |...