3108 matches found
Exploit for Command Injection in Jc21 Nginx_Proxy_Manager
POCCVE-2024-46256 CVE-2024-46256 and CVE-2024-46257 is the...
CVE-2024-25270
An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference IDOR vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data...
Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow
CVE-2024-37084-Poc Setup ,Analysis , Demo exploit and poc abou...
GHSA-7Q74-G774-7X3G Interchain Security: The signers of ICS messages do not need to match the provider address
Context ICS has the following four messages that enable validators on the provider chain to perform different actions: - MsgOptIn -- adds a validator to the consumer chain’s active set - MsgOptOut -- removes a validator from the consumer chain’s active set - MsgAssignConsumerKey -- changes the...
Wordpress LiteSpeed Cache plugin cookie theft
This module exploits an unauthenticated account takeover vulnerability in LiteSpeed Cache, a Wordpress plugin that currently has around 6 million active installations. In LiteSpeed Cache versions prior to 6.5.0.1, when the Debug Logging feature is enabled, the plugin will log admin cookies to the...
Linux Kernel 5.6.13 Use-After-Free Exploit
Proof of concept exploit that uses a use-after-free vulnerability due to a race condition in MIDI devices in Linux Kernel version 5.6.13. // gcc -o exploit exploit.c -masm=intel -static -s -lpthread define GNUSOURCE include include include include include include include include include include...
Kaillera 0.86 Server Denial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Kaillera 0.86 Server Denial of Service' , 'Description' = %q The Kaillera 0.86 server can be shut down by sending any malformed packet after the...
FIWARE Keyrock Encryption Problem Vulnerability (CNVD-2024-37461)
FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the algorithm used to create the disable2fakey being predictable, and can be exploited by an attacker to predict...
Courier Management System 1.0 Cross Site Request Forgery
============================================================================================================================================= | Title : Courier Management System 1.0 CSRF add admin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...
Multi-Vendor Online Groceries Management System 1.0 Cross Site Request Forgery
============================================================================================================================================= | Title : Multi-Vendor Online Groceries Management System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozill...
Tourism Management System 2.0 Cross Site Scripting Vulnerability
Exploit Title: Tourism Management System v2.0 - Cross Site Scripting XSS Exploit Author: Sampath kumar kadajari Vendor Homepage: https://phpgurukul.com/tourism-management-system-free-download/ Software Link: https://phpgurukul.com/?sdmprocessdownload=1&downloadid=7204 Version: v2.0 CVE:...
ROS-20240725-10
A vulnerability in the NVIDIA GPU Display Driver software driver for Linux is related to privilege management errors. Exploitation of the vulnerability could allow an attacker to disclose protected information and cause a denial of service A vulnerability in the NVIDIA GPU Display Driver for Linu...
SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path
Exploit Title: SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path Date: 2024-07-31 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H: https://mirror-h.org/search/hacker/49626/ Vendor Homepage:...
CVE-2024-41799 tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users
tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files could be uploaded via...
CVE-2024-41354
phpipam 1.6 is vulnerable to Cross Site Scripting XSS via /app/admin/widgets/edit.php...
WordPress PZ Frontend Manager 1.0.5 Cross Site Request Forgery
Exploit Title: pz-frontend-manager = 1.0.5 - CSRF change user profile picture Date: 2024-07-01 Exploit Author: Vuln Seeker Cybersecurity Team Vendor Homepage: https://wordpress.org/plugins/pz-frontend-manager/ Version: = 1.0.5 Tested on: Firefox Contact me: [email protected] The plugin does no...
Exploit for CVE-2024-37726
CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitra...
CVE-2024-36992
CVE-2024-36992 affects Splunk Enterprise and Splunk Cloud Platform. A low-privilege user who does not hold admin/power roles can craft a malicious payload via a Dashboard element’s url parameter due to insufficient input validation, leading to persistent Cross-site Scripting (XSS) by executing un...
SolarWinds Platform 2024.1 SR1 - Race Condition
Exploit Title: SolarWinds Platform 2024.1 SR1 - Race Condition CVE: CVE-2024-28999 Affected Versions: SolarWinds Platform 2024.1 SR 1 and previous versions Author: Elhussain Fathy, AKA 0xSphinx import requests import urllib3 import asyncio import aiohttp...