SurgeNews User Credentials

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SurgeNews User Credentials', 'Description' = %q This module exploits a vulnerability in the WebNews web interface of SurgeNews on TCP ports 9080...

WordPress Custom-contact-forms Plugin SQL Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress custom-contact-forms Plugin SQL Upload', 'Description' = %q The WordPress custom-contact-forms plugin 'Marc-Alexandre Montpas',...

Exploit for CVE-2024-46310

CVE-2024-46310 POC for CVE-2024-46310 For FXServer version's v...

Exploit for CVE-2024-46310

CVE-2024-46310 POC for CVE-2024-46310 For FXServer version's v...

BIT-KEYDB-2021-32675 DoS vulnerability in Redis

Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to user-specified values which determine the number of elements in the multi-bulk header and size of each element in the bulk header. ...

Hardcoded Credential Vulnerability Found in SolarWinds Web Help Desk

SolarWinds has issued patches to address a new security flaw in its Web Help Desk WHD software that could allow remote unauthenticated users to gain unauthorized access to susceptible instances. "The SolarWinds Web Help Desk WHD software is affected by a hardcoded credential vulnerability, allowi...

GO-2022-0704 Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030) in github.com/goharbor/harbor

Unauthenticated users can exploit an enumeration vulnerability in Harbor CVE-2019-19030 in github.com/goharbor/harbor...

GO-2022-0491 Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go

Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go...

CVE-2024-43410

CVE-2024-43410 (Russh) : The russh Rust SSH library is vulnerable to an OOM DoS caused by allocating memory based on an untrusted 4-byte packet length. An unauthenticated client can set this length to any value, triggering large allocations before authentication and potentially exhausting the ser...

CVE-2024-43410

Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet consists of a 4-byte big-endian length, followed by a byte stream of this length. After parsing and potentially decrypting the 4-byte length,...

CVE-2024-6847

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot...

CVE-2024-6847 SmartSearch WP <= 2.4.4 - Unauthenticated SQLi

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot...

CVE-2024-6847

CVE-2024-6847 affects the WordPress plugin Chatbot with ChatGPT WordPress, version prior to 2.4.5. The issue is an unsanitized/uncleaned parameter being used in a SQL statement, enabling unauthenticated SQL injection when users submit messages to the chatbot. Impact is high (unauthenticated acces...

CVE-2024-6843

CVE-2024-6843 affects the WordPress Chatbot with ChatGPT plugin prior to version 2.4.5. The issue is stored XSS caused by insufficient sanitization/escaping of user inputs, enabling unauthenticated users to inject scripts that can affect admins. Red Hat’s entry reiterates the same description. Im...

PT-2024-37898 · WordPress · Chatbot With Chatgpt

Name of the Vulnerable Software and Affected Versions: The Chatbot with ChatGPT WordPress plugin versions prior to 2.4.5 Description: The issue concerns the lack of sanitization and escaping of user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

PT-2024-11926 · WordPress · Metform Elementor Contact Form Builder

Name of the Vulnerable Software and Affected Versions: The Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.2.4 Description: The issue is related to insufficient file type validation, allowing unauthenticated visitors to perform a "double extension" attack. Th...

U.S. Dept Of Defense: Improper Authentication Allows Making Appeals as Other Users

The vulnerability allowed unauthenticated users to submit appeals by manipulating HTTP responses. This undermined the security and integrity of the application, as users could perform actions reserved for logged-in users...

CVE-2024-38530

CVE-2024-38530 affects the Open eClass platform (H5P module) via an arbitrary file upload in the module’s save.php, allowing unauthenticated uploads to the server filesystem. The underlying issue enables potential unrestricted remote code execution on the backend, since the upload location is int...

CVE-2024-38530 Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

The Open eClass platform formerly known as GUnet eClass is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RC...

CVE-2024-38530 Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

The Open eClass platform formerly known as GUnet eClass is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RC...