GHSA-55J9-849X-26H4 Remote Code Execution in Red Discord Bot

Impact A RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive...

Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC)

CVE-2020-0796 PoC aka CoronaBlue aka SMBGhost Download https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48216.zip Usage ./CVE-2020-0796.py servername This script connects to the target host, and compresses the authentication request with a bad offset field set in t...

qdPM < 9.1 - Remote Code Execution Exploit

Exploit for multiple platform in category web applications !/usr/bin/python ------------------------------------------------------------------------------------- Title: qdPM Webshell Upload + RCE Exploit qdPMv9.1 and below CVE-2020-7246 Author: Tobin Shields @TobinShields Description: This is an...

Oracle WebLogic Server Web Services RCE

Remote code execution vulnerability in Oracle WebLogic Server Web Services via XMLDecoder Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

vBulletin 5.x 0-Day Pre-Auth Remote Command Execution

description = vBulletin 5.x 0day pre-auth RCE exploit This should work on all versions from 5.0.0 till 5.5.4 local http = require "http" local shortport = require "shortport" local vulns = require "vulns" local stdnse = require "stdnse" local string = require "string" --- -- @usage -- nmap -p...

Moodle 3.4.1 Remote Code Execution

php MoodleExploit.php url=http://example.com user=teacher pass=password ip=10.10.10.10 port=1010 course=1 user The account username pass The password to the account ip Callback IP port Callback Port course Valid course ID belonging to the teacher Make sure you're running a netcat listener on the...

Sony Playstation 4 (PS4) < 6.20 - WebKit Code Execution (PoC)

PS4 6.20 WebKit Code Execution PoC ============== This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as well as an arbitrary object address leak in wkexploit.j...

Exim SMTP listener base64d function one-character buffer overflow

Added: 05/16/2018 CVE: CVE-2018-6789 BID: 103049 Background Exim is a mail transfer agent used on Unix-like operating systems. Problem Exim 5.90 and earlier are vulnerable to a one-character buffer overflow in the base64d function in the SMTP listener. Resolution Upgrade to Exim 4.90.1 or higher,...

Exodus Wallet (ElectronJS Framework) - Remote Code Execution Exploit

Exploit for windows platform in category remote exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' class MetasploitModule 'Exodus Wallet ElectronJS Framework remote Code...

BMC Server Automation RSCD Agent - NSH Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BMC Server Automation RSCD Agent NSH Remote ' \ 'Command Execution', 'Description' = %q This module exploits a weak access control check in the B...

Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

CVE-2017-10271 identification and exploitation. Unauthenticated...

NETGEAR DGN1000/DGN2200 RCE

Remote code execution vulnerability in NETGEAR DGN1000/DGN2200 setup.cgi currentsetting.htm Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Unitrends UEB 9.1 Privilege Escalation

Exploit Title: Authenticated lowpriv RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Benny Husted, Jared Arave, Cale Smith Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...

TerraMaster NAS TOS <= 3.0.30 Unauthenticated RCE as Root

Recently I bought a TerraMaster F2-420 NAS from Amazon in order to store my private code, backups and this kind of stuff. As soon as it arrived I started to play with its web interface and eventually I wanted to see how it was implemented, moreover I was curious to see if I could find any remotel...

PlaySMS 1.4 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications Exploit Title: PlaySMS 1.4 Remote Code Execution to Poisoning admin log Date: 19-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website:...

Autodesk Backburner Manager 3 Denial Of Service

import sys import datetime import socket import argparse import os import time remotehost = '' remoteport = '' def callExit: print "\n\t\t! exiting at %s .....\n" % datetime.datetime.now sys.exit1 def mySocket: try: s = socket.socketsocket.AFINET, socket.SOCKSTREAM except socket.error: print...

shopify-scripts: Type confusion in wrap_decimal leading to memory corruption

Decimal can be redefined, causing the Decimal class lookup in wrapdecimal to be invalid. This can lead to memory corruption or arbitrary code execution. The following snippet results in a native crash in mruby-engine olddecimal = Decimal.new1 Decimal = Hash a = -olddecimal puts a I suspect you...

Dolphin 7.3.2 authentication bypass and command execution vulnerabilities

No description provided by source. !/usr/bin/env python -- coding: utf-8 -- ''' Software : Dolphin = 7.3.2 Auth bypass / RCE exploit Vendor : www.boonex.com Author : Ahmed sultan 0x4148 Home : 0x4148.com | https://www.linkedin.com/in/0x4148 Email : [email protected] Auth bypass trick credit go to...

Boonex Dolphin 7.3.2 - Authentication Bypass Remote Code Execution

Boonex Dolphin 7.3.2 - Authentication Bypass Remote Code Execution !/usr/bin/env python -- coding: utf-8 -- ''' Software : Dolphin = 7.3.2 Auth bypass / RCE exploit Vendor : www.boonex.com Author : Ahmed sultan 0x4148 Home : 0x4148.com | https://www.linkedin.com/in/0x4148 Email : [email protected]...

shopify-scripts: TOCTTOU bug in mrb_str_setbyte leading the memory corruption

The Stringsetbyte function caches the length of the string before loading the function arguments. Loading function arguments through mrbgetargs can call into ruby code to run type conversion methods toi, tos and the like. A malicious conversion method is able to force the string to be reallocated...