12881 matches found
Exploit for OS Command Injection in Apsystems Energy_Communication_Unit_Firmware
CVE-2023-28343 CVE-2023-28343 POC exploit Usage shell us...
Unhandled SWF Tags in MP4Box: Potential Vulnerability in GPAC
An unhandled series of SWF tags have been identified in the MP4Box software, which is part of the GPAC multimedia framework. These tags are not properly processed, leading to potential vulnerabilities such as denial of service, buffer overflows, or other malicious attacks. POC: ./MP4Box -dash 100...
Exploit for Out-of-bounds Write in Linux Linux_Kernel
My POC for CVE-2022-...
Exploit for Untrusted Pointer Dereference in Microsoft
CVE-2023-21768-POC CVE-2023-21768: Windows 11 2...
InPost Gallery <= 2.1.4.1 - Reflected XSS
The plugin does not sanitise and escape the imgurl parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open...
VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities
Exploit Title: VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities Google Dork: intext:"Wallpaper Admin" "LOGIN" "password" "Username" Exploit Author: Edd13Mora Vendor Homepage: www.viaviweb.com Version: N/A Tested on: Windows 11 - Kali Linux ------------------ SQLI on the Login page...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Ibexa Ezplatform-Graphql
CVE-2022-41876 - eZ Platform user information disclosure A vu...
Exploit for Untrusted Pointer Dereference in Microsoft
CVE-2023-21768 Local Privilege Escalation POC authors: chomp...
Stored XSS in name parameter of "Customers Reports"
Description The name parameter of the "Static Routes" functionality is vulnerable to stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Marketing - Customers Reports - Add and Enter the name of the new item a-zA-Z-. 3.Then capture the request on the burp suite an...
Multiple Stored XSS in name parameter of "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes"
Description The name parameter of the "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes" functionality is vulnerable to Stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Online Shop - Pricing Rules - Add and Enter the name of the new...
All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal
The plugin does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only displays the last 50 lines of the file. PoC POST...
Online Pizza Ordering System 1.0 SQL Injection Vulnerability
Exploit Title: Online Pizza Ordering System 1.0 - "id" SQLi Exploit Author: Abdulhakim Öner Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html Software Download:...
Adobe Connect 11.4.5 / 12.1.5 Local File Disclosure
Title: adobe connect - Local File Disclosure / Download security feature bypass vulnerability Author: h4shur date:2021.01.16-2023.02.17 CVE: CVE-2023-22232 Vendor Homepage: https://www.adobe.com Software Link: https://www.adobe.com/products/adobeconnect.html Version: 11.4.5 and earlier, 12.1.5 an...
Exploit for Improper Input Validation in Microsoft
CVE-2023-23397-POC-Using-...
Exploit for Improper Input Validation in Microsoft
CVE-2023-23397 CVE-2023-23397 C PoC 1- download the msgkit 2...
Exploit for Out-of-bounds Write in Fortinet Fortios
FortiOS SSL-VPN buffer overflow vulnerability cve-2022-424...
Human Resources Management System - Multiple SQL injection Vulnerability
A Blind SQL injection vulnerability in the login page /hrm/controller/login.php in Human Resources Management System allows remote unauthenticated attackers to execute remote command through arbitrary SQL commands by "name" parameter. Request PoC POST /hrm/controller/login.php HTTP/1.1 Host:...
Exploit for Cross-site Scripting in Snyk Advisor
Stored XSS snyk.io Discovery 19/03/23 CVE-2023...