blind-xxe-controller-CVE-2021-29447

Controlador de XXE ciego Creé este controlador al resolver la máquina metatwo en HackTheBox para explotar CVE-2021-29447, que es una vulnerabilidad XXE en WordPress en la librería de medios de las versiones afectadas 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. En ella, un usuario autenticado con capacidad de...

CVE-2021-29447

安装及执行顺序 0. 运行 docker root@kitploit: $docker-compose up 1. 运行 wordpress.sh 在安装 wordpress 之前，需要对 wp-config.php 文件进行配置。 root@kitploit: $docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh" 2. 安装 wordpress 进入容器中运行的 wordpress 网站进行安装。 请勿直接复制，请使用 code 视图进行复制。 3. 生成 WAV 文件...

CVE-2021-29447-POC

CVE-2021-29447-POC 关于 此脚本可自动执行在 Wordpress 媒体上传功能中利用 CVE-2021-29447 所需步骤，并通过 XXE 提取文件。 用法 root@kitploit: ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port LOCALPORT --media-payload MEDIAPAYLOAD --dtd-payload DTDPAYLOAD --files-to-fetch FILESTOFETCH...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

CVE-2021-29447

WordPress 5.6-5.7 - 認証済み Author+ XXE CVE-2021-29447 使用方法 ステップ1. WordPressを起動 root@kitploit: $ make up-wp ステップ2. 攻撃者用Webサーバーを起動 root@kitploit: $ make up-mal ステップ3. 悪意のあるWAVファイルを生成 wavefile npmを使わない場合 推奨 root@kitploit: $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick;...

Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

Project Goal: To demonstrate a complete attack chain on a vulnerable WordPress installation, exploiting CVE-2021-29447 XXE in media library to achieve remote code execution and full system compromise. Phase 1: Reconnaissance & Enumeration Network Scanning with Nmap: bash Quick SYN scan to discove...

CVE-2021-29447

WAV iXML XXE Exploit Generator Generates malicious WAV files that exploit XXE vulnerabilities in WordPress plugins parsing iXML metadata chunks e.g., BookingPress │ Target │ └──────────┘ └──────────┘ ▲ │ │ │ 2. Parse XML │ │ │ 3. GET /xxe.dtd │ │─────────────────────────────┘ │ │ 4. GET...

CVE-2021-29447

CVE-2021-29447 Impact Arbitrary File Disclosure: the content of any file on the host’s file system could be retrieved, e.g. wp-config.php which contains sensitive data such as database credentials. Server-Side Request Forgery SSRF: HTTP requests could be made on behalf of the WordPress...

CVE-2021-29447

CVE-2021-29447 - WordPress XXE 漏洞利用 描述 该存储库包含一个针对 CVE-2021-29447 的 exploit，这是 WordPress 5.7.0 及更早版本中存在的一个 XXE（XML 外部实体）漏洞。该漏洞存在于处理 WAV 文件的媒体库中，允许攻击者读取服务器上的任意文件。 要求 Bash Python 3 Docker 和 Docker Compose（用于搭建测试环境） 存在漏洞的 WordPress 服务器（5.7.0 或更低版本） 文件 文件| 描述 ---|--- CVE-2021-29447.sh| 生成恶意 WAV payloa...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

cve-2021-29447_auto-script

CVE-2021-29447: WordPress Media Library XXE Vulnerability This repository details the CVE-2021-29447 vulnerability, a critical security flaw in WordPress that allowed for authenticated XML External Entity XXE attacks through the Media Library. It also provides an automatic script that demonstrate...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - WordPress中的XXE WordPress 5.6-5.7 - 认证（作者及以上）XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 使用方法 步骤1：运行WordPress root@kitploit: $ make up-wp 步骤2：运行攻击者web服务器 root@kitploit: $ make up-mal 步骤3：生成恶意WAV文件 使用wavefile npm root@kitploit: $ make make-wav...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

Amazon Linux 2 : gstreamer1-plugins-bad-free, --advisory ALAS2-2026-3895 (ALAS-2026-3895)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3895 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-bad-free (UTSA-2026-104837)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104837 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of th...

Astra Linux – Vulnerability in wavpack

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variables. The impact includes unexpected control flow, crashes, and segfaults. The affected component is ParseCaffHeaderConfig caff.c:486. The attack vector is a maliciously crafted .wav file. The fixed version is after the...

SUSE CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

PT-2026-69329

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-bad affected versions not specified Description A heap out-of-bounds write occurs in the adpcmdec element when decoding IMA/DVI ADPCM audio. This is caused by insufficient validation of the per-block sample count for...