CVE-2021-29447

Ordine di installazione ed esecuzione 0. Esecuzione di docker root@kitploit: $docker-compose up 1. Esecuzione di wordpress.sh Prima di installare wordpress, si configurano le impostazioni nel file wp-config.php. root@kitploit: $docker exec -it -u root wordpress /bin/bash -c...

CVE-2021-29447

CVE-2021-29447 Impatto Divulgazione arbitraria di file: il contenuto di qualsiasi file sul filesystem dell'host potrebbe essere recuperato, ad esempio wp-config.php che contiene dati sensibili come le credenziali del database. Server-Side Request Forgery SSRF: potrebbero essere effettuate richies...

CVE-2021-29447

WordPress 5.6-5.7 – Authentifiziert Autor+ XXE CVE-2021-29447 Verwendung Schritt 1. WordPress ausführen root@kitploit: $ make up-wp Schritt 2. Angreifer-Webserver ausführen root@kitploit: $ make up-mal Schritt 3. Bösartige WAV-Datei erzeugen Ohne wavefile-npm empfohlen root@kitploit: $ echo -en...

blind-xxe-controller-CVE-2021-29447

Controller per Blind XXE Ho creato questo controller per la macchina metatwo di HackTheBox per sfruttare CVE-2021-29447, una vulnerabilità XXE di WordPress nella libreria multimediale che colpisce le versioni 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. dove un utente autenticato con la possibilità di caricar...

CVE-2021-29447

Generatore di Exploit XXE per iXML WAV Genera file WAV dannosi che sfruttano vulnerabilità XXE nei plugin WordPress che analizzano blocchi di metadati iXML es. BookingPress │ Target │ └──────────┘ └──────────┘ ▲ │ │ │ 2. Parse XML │ │ │ 3. GET /xxe.dtd │ │─────────────────────────────┘ │ │ 4. GET...

Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

Obiettivo del Progetto: Dimostrare una catena di attacco completa su un'installazione vulnerabile di WordPress, sfruttando CVE-2021-29447 XXE nella libreria multimediale per ottenere esecuzione di codice remoto e compromissione totale del sistema. Fase 1: Ricognizione ed Enumerazione Scansione di...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE in WordPress WordPress 5.6-5.7 - Autenticato Autore+ XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Utilizzo Step1. Esegui WordPress root@kitploit: $ make up-wp Step2. Esegui il server web attaccante root@kitploit: $ make up-mal Step3. Genera file WAV malevolo...

CVE-2021-29447

CVE-2021-29447 - Exploit della vulnerabilità XXE di WordPress Descrizione Questo repository contiene un exploit per CVE-2021-29447, una vulnerabilità XXE XML External Entity presente in WordPress 5.7.0 e versioni precedenti. La vulnerabilità risiede nella libreria multimediale che elabora file WA...

cve-2021-29447_auto-script

CVE-2021-29447: WordPress Media Library XXE-Schwachstelle Dieses Repository beschreibt die CVE-2021-29447-Schwachstelle, einen kritischen Sicherheitsfehler in WordPress, der authentifizierte XML-External-Entity-Angriffe XXE über die Media Library ermöglichte. Es enthält außerdem ein automatisches...

CVE-2021-29447-POC

CVE-2021-29447-POC परिचय यह स्क्रिप्ट Wordpress में मीडिया अपलोड कार्यक्षमता में CVE-2021-29447 का शोषण करने और XXE के माध्यम से फ़ाइलें निकालने के लिए आवश्यक चरणों को स्वचालित करती है। उपयोग root@kitploit: ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port...

SUSE CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

PT-2026-69329

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-bad affected versions not specified Description A heap out-of-bounds write occurs in the adpcmdec element when decoding IMA/DVI ADPCM audio. This is caused by insufficient validation of the per-block sample count for...

libsndfile: integer overflow in ima_reader_init()

A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application...

Astra Linux – Vulnerability in wavpack

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variables. The impact includes unexpected control flow, crashes, and segfaults. The affected component is ParseCaffHeaderConfig caff.c:486. The attack vector is a maliciously crafted .wav file. The fixed version is after the...

CVE-2026-4009

A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwavreadpcmframess16msadpcm in the library src/audiosource/wav/drwav.h of the component WAV File Parser. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploi...

CVE-2018-25212 Boxoft wav-wma Converter 1.0 Local Buffer Overflow SEH

Boxoft wav-wma Converter 1.0 contains a local buffer overflow vulnerability in structured exception handling that allows attackers to execute arbitrary code by crafting malicious WAV files. Attackers can create a specially crafted WAV file with excessive data and ROP gadgets to overwrite the SEH...

EUVD-2026-11542

A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwavreadpcmframess16msadpcm in the library src/audiosource/wav/drwav.h of the component WAV File Parser. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploi...

CVE-2026-4009

A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwavreadpcmframess16msadpcm in the library src/audiosource/wav/drwav.h of the component WAV File Parser. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploi...

CVE-2026-4009

CVE-2026-4009 affects jarikomppa soloud, specifically the WAV File Parser component. The vulnerability is in the function drwav_read_pcm_frames_s16__msadpcm within src/audiosource/wav/dr_wav.h, causing an out-of-bounds read. The issue can be exploited locally, and the exploit has been disclosed p...