12878 matches found
WBCE CMS 1.6.1 - Open Redirect & CSRF Vulnerability
Exploit Title: WBCE CMS 1.6.1 - Open Redirect & CSRF Version: 1.6.1 Bugs: Open Redirect + CSRF = CSS KEYLOGGING Technology: PHP Vendor URL: https://wbce-cms.org/ Software Link: https://github.com/WBCE/WBCECMS/releases/tag/1.6.1 Date of found: 03-07-2023 Author: Mirabbas Ağalarov Tested on: Linux ...
D-Link DAP-1325 - Broken Access Control Vulnerability
Exploit Title: D-Link DAP-1325 - Broken Access Control Exploit Author: ieduardogoncalves Contact : twitter.com/0x00dia Vendor : www.dlink.com Version: Hardware version: A1 Firmware version: 1.01 Tested on:All Platforms 1 Description Security vulnerability known as "Unauthenticated access to...
XEL CMS 1.1 Cross Site Request Forgery
==================================================================================================================================== | Title : XEL cms© v1.1 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.332-bit | | Vendor :...
Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)
Exploit Title: Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting XSS Date: 1/07/2023 Exploit Author: tmrswrr Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: v15.0 POC: 1 Login in demo page , go to this url...
Prestashop 8.0.4 Cross Site Scripting
Exploit Title: Prestashop 8.0.4 - Cross-Site Scripting XSS Application: prestashop Version: 8.0.4 Bugs: Stored XSS Technology: PHP Vendor URL: https://prestashop.com/ Software Link: https://prestashop.com/prestashop-edition-basic/ Date of found: 30.06.2023 Author: Mirabbas Ağalarov Tested on: Lin...
Exploit for Cross-site Scripting in Citrix Gateway
Python & G...
CVE-2021-34506
Microsoft Edge Chromium-based Security Feature Bypass Vulnerability...
GHSA-VPXF-Q44G-W34W Sealos billing system permission control defect
Summary There is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account. sealos. io/v1/Payment, resulting in the ability to recharge any amount of 1 RMB. Details The reason is that sealos is in arrears. Egg pain, we can't create a terminal...
Exploit for Use After Free in Arm Avalon_Gpu_Kernel_Driver
Exploit for CVE-2022-46395 to run on FireTV 2nd gen Cube Thi...
Exploit for Use After Free in Arm Avalon_Gpu_Kernel_Driver
Exploit for CVE-2022-46395 to run on FireTV 3rd gen Cube Thi...
Exploit for Out-of-bounds Write in Microsoft
Since February 2022 was reported a new ransomware that appears t...
Exploit for Out-of-bounds Write in Microsoft
Since February 2022 was reported a new ransomware that appears t...
Coraza has potential denial of service vulnerability
Summary Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. Details https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.goL26-L29 The bodyprocessors of multipart uses...
Querlo Chatbot <= 1.2.4 - Stored Cross-Site Scripting
The plugin does not escape or sanitize chat messages, leading to a stored Cross-Site Scripting vulnerability. PoC Submit the following in the chat message: """ See the XSS in Querlo...
Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit Remote Code Execution Vulnerability
Title: Microsoft 365 MSO Version 2305 Build 16.0.16501.20074 64-bit Remote Code Execution Vulnerability Author: nu11secur1ty Date: 04.17.2023 Vendor: https://www.microsoft.com/ Software: https://www.microsoft.com/en-us/microsoft-365/ Reference:...
Microsoft Office Remote Code Execution
Title: Microsoft Office Remote Code Execution Vulnerability Author: nu11secur1ty Date: 04.17.2023 Vendor: https://www.microsoft.com/ Software: https://www.microsoft.com/en-us/microsoft-365/ Reference: https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/ CVE-2023-28285...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick
ImageMagick Arbitrary Read Files - CVE-2022-44268 This reposi...
Mars: Stored XSS + CSRF in "apellido" value
A stored cross-site scripting and cross-site request forgery vulnerability was discovered in the "apellido" value of a user profile updating form, allowing unauthorized changes to be made to user accounts...
GHSA-X49M-3CW7-GQ5Q jcvi vulnerable to Configuration Injection due to unsanitized user input
Summary A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. PoC The vulnerable code snippet is...