OTRS 6.0.1 Remote Command Execution

Exploit Title: OTRS 6.0.1 - Remote Command Execution 2 Date: 21-04-2021 Exploit Author: Hex26 Vendor Homepage: https://www.otrs.com/ Software Link: http://ftp.otrs.org/pub/otrs/ Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 Tested on: OTRS 5.0.2/CentOS 7.2.1511 CVE : CVE-2017-16921...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

CSRF-to-RCE ..| CVE-2021-31762 |.. Description : Exploit...

Exploit for Cross-site Scripting in Webmin

CVE-2021-31761 Description : Exploiting a Reflected Cross-S...

Exploit for Cross-site Scripting in Webmin

..| CVE-2021-31761 |.. Description : Exploiting a Reflected...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

..| CVE-2021-31760 |.. Description : Exploiting a Cross-sit...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

..| CVE-2021-31760 |.. Description : Exploiting a Cross-sit...

Cockpit CMS 0.11.1 NoSQL Injection / Remote Command Execution Exploit

This Metasploit module exploits two NoSQL injection vulnerabilities to retrieve the user list and password reset tokens from the system. Next, the USER is targeted to reset their password. Then, a command injection vulnerability is used to execute the payload. While it is possible to upload a...

Askey Fiber Optic Router Unauthorized RCE Vulnerability

Askey is the world's first professional manufacturer of international network communication equipments, the main products are ADSL, Cable, Modem, ADSL Router, Cable Router and so on. The main products are ADSL, Cable Modem, ADSL Router, Cable Router and so on. The Askey Fiber Optic Router...

GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GravCMS Remote Command Execution', 'Description' = %q This module exploits arbitrary config write/update vulnerability to achieve remote code...

cisco RV34X系列身份绕过和远程命令执行漏洞（CVE-2021-1472 CVE-2021-1473）

Advisory: Cisco RV34X Series – Authentication Bypass and Remote Command Execution APRIL 13, 2021 TL;DR In early 2021, we reported a few security issues to Cisco related to their RV34X series of routers, two of which have been recently patched. The issues in question were an authentication bypass...

GravCMS 1.10.7 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GravCMS Remote Command Execution', 'Description' = %q This module exploits arbitrary config write/update vulnerability to achieve remote code...

GravCMS 1.10.7 - Unauthenticated Arbitrary File Write (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GravCMS Remote Command Execution', 'Description' = %q This module exploits arbitrary config write/update vulnerability to achieve remote code...

asset-inventory (0.0.7), mixbytes-tank (>=0.1.2.dev20190704124001, <=0.2.1) +3 more potentially affected by CVE-2019-14904 via ansible (>=2.8.0, <=2.8.6)

ansible PYPI version =2.8.0, =0.1.2.dev20190704124001, =0.0.4, =0.1.0 - walletlib 0.1.0 Source cves: CVE-2019-14904 Source advisory: GHSA-GWR8-5J83-483C...

Phone Shop Sales Management System 1.0 Shell Upload

Exploit Title: Phone Shop Sales Management System - Arbitrary File Upload Unauthenticated Date: 20/04/21 Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/10882/phone-shop-sales-managements-system.html Version: 1.0 Tested on: Windows 10 build 19041 + xampp 3.2.4...

Cisco RV Authentication Bypass / Code Execution Vulnerability

Cisco RV-series routers suffer from an authentication bypass vulnerability. The RV34X series are also affected by a command injection vulnerability in the sessionid cookie, when requesting the /upload endpoint. A combination of these issues would allow any person who is able to communicate with t...

Cisco RV Authentication Bypass / Code Execution

IoT Inspector Research Lab Security Advisory IOT-20210414-0 title: Cisco RV series Authentication Bypass and Remote Command Execution vendor/product: Cisco https://www.cisco.com/ vulnerable version: RV16X/RV26X: 1.0.01.02 & below. RV34X: 1.0.03.20 & below. fixed version: RV16X/RV26X: 1.0.01.03...

CVE-2021-20991 Fibaro Home Center Authenticated remote command execution

In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability...

SUSE: Security Advisory (SUSE-SU-2015:0805-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-27692

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the...

CVE-2021-27710

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...