Exploit for CVE-2023-38646

Metabase Pre Authentication RCE CVE-2023-38646 We have pro...

Exploit for CVE-2023-38646

CVE-2023-38646 Metabase Pre-auth R...

Exploit for Command Injection in Tp-Link Archer_Ax21_Firmware

Description CVE-2023–1389 is an Unauthenticated Command Inject...

Malicious code in imposter-pkg-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e5127f46671b090bf9ac113a3ff87f19d522e0ec80dda844332b9625b30ecf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-521 Malicious code in imposter-pkg-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e5127f46671b090bf9ac113a3ff87f19d522e0ec80dda844332b9625b30ecf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Zomplog 3.9 - Cross site scripting Vulnerability

Exploit Title: Zomplog 3.9 - Cross-site scripting XSS Application: Zomplog Version: v3.9 Bugs: XSS Technology: PHP Vendor URL: http://zomp.nl/zomplog/ Software Link: http://zomp.nl/zomplog/downloads/zomplog/zomplog3.9.zip Date of found: 22.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2...

Zomplog 3.9 - Cross-site scripting (XSS)

Exploit Title: Zomplog 3.9 - Cross-site scripting XSS Application: Zomplog Version: v3.9 Bugs: XSS Technology: PHP Vendor URL: http://zomp.nl/zomplog/ Software Link: http://zomp.nl/zomplog/downloads/zomplog/zomplog3.9.zip Date of found: 22.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2...

Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets

CVE-2023-27163 PoC CVE-2023-27163, SSRF, request-baskets h...

Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets

CVE-2023-27163 Poc of SSRF for Request-Baskets CVE-2023-27163...

GHSA-F54Q-J679-P9HH copyparty vulnerable to reflected cross-site scripting via k304 parameter

Summary The application contains a reflected cross-site scripting via URL-parameter ?k304=... and ?setck=... Details A reflected cross-site scripting XSS vulnerability exists in the web interface of the application that could allow an attacker to execute malicious javascript code by tricking user...

IURNY by INDIGITALL < 3.2.3 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to the plugin's settings. 2...

WP Brutal AI < 2.06 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC In the plugin settings, for a...

QWE DL v2.0.1 iOS - Persistent Cross Site Vulnerability

Document Title: =============== QWE DL v2.0.1 iOS - Persistent Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2326 Release Date: ============= 2023-07-23 Vulnerability Laboratory ID VL-ID: ====================================...

Exploit for Code Injection in Apache Airflow

Apache Airflow official report description says: A vulnerab...

Exploit for Off-by-one Error in F5 Nginx

CVE-2021-23017...

CMS Made Simple 2.2.17 Server-Side Template Injection

Exploit Title: CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection SSTI Application: CmsMadeSimple Version: v2.2.17 Bugs: SSTI Technology: PHP Vendor URL: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Date of found: 13-07-2023...

Elementor < 3.5.5 - Iframe Injection

Description The plugin does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs. PoC...

CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection Vulnerability

Exploit Title: CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection SSTI Application: CmsMadeSimple Version: v2.2.17 Bugs: SSTI Technology: PHP Vendor URL: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Date of found: 13-07-2023...

Blackcat Cms v1.4 - Remote Code Execution Vulnerability

Exploit Title: Blackcat Cms v1.4 - Remote Code Execution RCE Application: blackcat Cms Version: v1.4 Bugs: RCE Technology: PHP Vendor URL: https://blackcat-cms.org/ Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS Date of found: 13.07.2023 Author: Mirabbas Ağalarov Tested on: Lin...

Blackcat Cms v1.4 - Stored XSS Vulnerability

Exploit Title: Blackcat Cms v1.4 - Stored XSS Application: blackcat Cms Version: v1.4 Bugs: Stored XSS Technology: PHP Vendor URL: https://blackcat-cms.org/ Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC...