Centreon 19.10.5 - (id) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Centreon 19.10.5 - 'id' SQL Injection Exploit Author: Basim alabdullah Vendor Homepage: https://www.centreon.com Software Link: https://download.centreon.com/ Version: v.19.10.5 Tested on: Centos 5 EXECUTIVE SUMMARY Centreon has...

Pinger 1.0 - Remote Code Execution Exploit

Exploit for php platform in category web applications Title: Pinger 1.0 - Remote Code Execution Author: Milad Karimi Vendor Homepage: https://github.com/wcchandler/pinger Software Link: https://github.com/wcchandler/pinger Tested on: windows 10 , firefox Version: 1.0 CVE : N/A...

WordPress Plugin Media Library Assistant 2.81 - Local File Inclusion

Exploit Title: Wordpress Plugin Media Library Assistant 2.81 - Local File Inclusion Google Dork: N/A Date: 2020-04-13 Exploit Author: Daniel Monzón stark0de Vendor Homepage: http://davidlingren.com/ Software Link: https://wordpress.org/plugins/media-library-assistant/ Version: 2.81 Tested on:...

Vanguard <= 2.1 - Multiple Cross-Site Scripting (XSS)

The plugin does not sanitise, validate or escape some of its parameters before outputting the back in various place, leading to either Stored or Reflected Cross-Site Scripting issues Put the following payload in the In Products Search box: " POST /search HTTP/1.1 Accept:...

Seabreeze Consulting Cross Site Scripting

Exploit Title: Seabreezeconsulting v1 XSS vulnerability Google Dork:"by Seabreeze Consulting" +inurl:/contact.php Date: 2020-04-03 Exploit Author: @ThelastVvV Vendor Homepage: www.seabreezeconsulting.com Version: 1 Tested on: 5.4.0-4parrot1-amd6...

CVE-2020-10818

Artica Proxy 4.26 contains a vulnerability that allows remote command execution by an authenticated user via shell metacharacters in the “Modify the hostname” field. Root cause: improper handling of shell metacharacters in hostname-related input. CVE-2020-10818 is referenced in NVD with CVSS2 bas...

Exploit for SQL Injection in Cszcms Csz_Cms

CVEPOCtest Reproduction of the CVE-2019-13086 vulnerabilit...

Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload)

Exploit Title: Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass Config Upload Date: 2019-11-20 Exploit Author: Elber Tavares Vendor Homepage: https://www.intelbras.com/ Software Link: http://en.intelbras.com.br/node/1033 Version: Intelbras Wireless N 150Mbps - WRN240 Tested on: linux,...

Pricing Table by Supsystic < 1.8.1 - Cross-Site Request Forgery to XSS and Setting Changes

CSRF can be exploited against any of the functionalities in the Pricing Table by Supsystic WordPress plugin in vulnerable versions. One example:...

Revotech I6032B-P Remote Configuration Disclosure

!/usr/bin/perl Revotech I6032B-P POE 1920x1080P 2.0MP Outdoor Camera Remote Configuration Disclosure Copyright 2020 c Todor Donev https://donev.eu/ Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially th...

Chained Quiz < 1.1.9.1 - Authenticated Stored XSS

WordPress Plugin Plugin Chained Quiz latest 1.1.9 and before suffers from a Stored XSS vulnerability in the sendername, adminsubject and usersubject POST parameter when an admin completes the setting for plugin as a result, the severity is very low POST /wp-admin/admin.php?page=chainedquizoptions...

SOPlanning 1.45 - Cross-Site Request Forgery (Add User)

SOPlanning 1.45 - Cross-Site Request Forgery Add User Exploit Title: SOPlanning 1.45 - Cross-Site Request Forgery Add User Date: 2020-02-14 Exploit Author: J3rryBl4nks Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/...

WordPress Plugin Wordfence.7.4.5 - Local File Disclosure

Tile: Wordpress Plugin wordfence.7.4.5 - Local File Disclosure Author: mehran feizi Category: webapps Date: 2020-02-12 vendor home page: https://wordpress.org/plugins/wordfence/ ============================================================================== Vulnerable Source: 5662: readfile...

CVE-2019-3719

Dell support agent fails to properly identify the origin of updates. By DNS spoofing and crafted payloads, an attacker can serve up an executable file that the support agent will run as system. Recent assessments: bwatters-r7 at July 18, 2019 9:47pm UTC reported: As exploits go, being able to ser...

WP Fastest Cache < 0.9.0.3 - Cross-Site Request Forgery (CSRF) Arbitrary File Deletion

The plugin did not have a CSRF nonce check on the "wpfcdeletecurrentpagecache" action, allowing CSRF attacks against authenticated users to delete arbitrary files, including the wp-config.php file. document.form.submit;...

FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin)

FlexNet Publisher 11.12.1 - Cross-Site Request Forgery Add Local Admin Exploit Title: FlexNet Publisher 11.12.1 - Cross-Site Request Forgery Add Local Admin Date: 2019-12-29 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.flexerasoftware.com/ Software : FlexNet Publisher Product...

Auth0 < 3.11.3 - Unauthenticated Reflected XSS via wle Parameter

XSS via a wle parameter associated with wp-login.php. WP/wp-login.php?wle=%22%20onEvent%3DX186697040Y2Z%20...

Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)

Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Title: Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Author: Sarthak Saini Date: 2020-01-18 Vendor Link : https://www.adive.es/ Software Link:...

Centreon 19.04 - Authenticated Remote Code Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Centreon Authenticated Macro Expression Location Setting Handler Code Execution",...

Rukovoditel Project Management CRM 2.5.2 - (reports_id) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'reportsid' SQL Injection Blog: https://fatihhcelik.blogspot.com/ Exploit Author: Fatih Çelik Vendor Homepage: https://www.rukovoditel.net/ Software Link:...