PT-2023-16395 · WordPress · Auto Rename Media On Upload

Name of the Vulnerable Software and Affected Versions: Auto Rename Media On Upload WordPress plugin versions prior to 1.1.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, f...

Free VPN Amnezia Helps Users Avoid Censorship in Russia

Amnezia, a free virtual private network, allows users to set up their own servers, making it harder for Moscow to block this portal to the outside world...

POLR URL 2.3.0 Shortener Admin Takeover

Exploit Title: POLR URL 2.3.0 - Shortener Admin Takeover Date: 2021-02-01 Exploit Author: p4kl0nc4t Vendor Homepage: - Software Link: https://github.com/cydrobolt/polr Version: 2.3.0 Tested on: Linux CVE : CVE-2021-21276 import json import requests payload = 'acctusername': 'admin', 'acctpassword...

POLR URL 2.3.0 - Shortener Admin Takeover

Exploit Title: POLR URL 2.3.0 - Shortener Admin Takeover Date: 2021-02-01 Exploit Author: p4kl0nc4t Vendor Homepage: - Software Link: https://github.com/cydrobolt/polr Version: 2.3.0 Tested on: Linux CVE : CVE-2021-21276 import json import requests payload = 'acctusername': 'admin', 'acctpassword...

Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

An unknown threat actor used a malicious self-extracting archive SFX file in an attempt to establish persistent backdoor access to a victim's environment, new findings from CrowdStrike show. SFX files are capable of extracting the data contained within them without the need for dedicated software...

Site Reviews < 6.7.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Login as Admin. 2. Go to...

CVE-2023-27761

An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the uniconverter1464bitsetupfull14204.exe file...

CVE-2023-27762

An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreatorsetupfull7743.exe file...

CVE-2023-27763

An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletranssetupfull5793.exe file...

CVE-2023-27770

An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-maxsetupfull5371.exe file...

CVE-2023-27765

An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoveritsetupfull4134.exe file...

CVE-2023-27764

An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairitsetupfull5913.exe file...

CVE-2023-27771

An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCCsetupfull10819.exe file...

CVE-2023-27760

An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmorasetupfull846.exe...

CVE-2023-27768

An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-prosetupfull5239.exe file...

Amr Ical Events Lists <= 6.6 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Login as Admin. 2. Go to...

Wondershare code issues and vulnerabilities

Wondershare is a data transfer tool. A security vulnerability exists in Wondershare MobileTrans that originates from a command that can be executed remotely via mobiletranssetupfull5793.exe...

PT-2023-21330 · Wondershare · Wondershare Mobiletrans

Name of the Vulnerable Software and Affected Versions: Wondershare MobileTrans version 4.0.2 Description: An issue in Wondershare MobileTrans allows a remote attacker to execute arbitrary commands via the mobiletrans setup full5793.exe file. Recommendations: For version 4.0.2, consider removing o...

Wondershare code issues and vulnerabilities

Wondershare is a data transfer tool. A security vulnerability exists in Wondershare Filmora that originates from a command that can be executed remotely via filmorasetupfull846.exe...

PT-2023-21334 · Wondershare · Wondershare Dr.Fone

Name of the Vulnerable Software and Affected Versions: Wondershare Dr.Fone version 12.4.9 Description: An issue in Wondershare Dr.Fone allows a remote attacker to execute arbitrary commands via the drfone setup full3360.exe file. Recommendations: For version 12.4.9, consider removing or restricti...