CVE-2021-29447-POC

CVE-2021-29447-POC About This script automates the required steps to exploit CVE-2021-29447 in the media upload funnctionality in Wordpress and use it to extract files vi an XXE. Usage root@kitploit: ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port...

CVE-2021-29447

CVE-2021-29447 - WordPress XXE Vulnerability Exploit Descripcion Este repositorio contiene un exploit para CVE-2021-29447, una vulnerabilidad de XXE XML External Entity presente en WordPress 5.7.0 y versiones anteriores. La vulnerabilidad existe en la biblioteca medemblic que procesa archivos WAV...

blind-xxe-controller-CVE-2021-29447

Controlador de XXE ciego Creé este controlador al resolver la máquina metatwo en HackTheBox para explotar CVE-2021-29447, que es una vulnerabilidad XXE en WordPress en la librería de medios de las versiones afectadas 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. En ella, un usuario autenticado con capacidad de...

CVE-2021-29447

Orden de instalación y ejecución 0. Ejecutar docker root@kitploit: $docker-compose up 1. Ejecutar wordpress.sh Antes de instalar WordPress, configure el archivo wp-config.php. root@kitploit: $docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh" 2. Instalar WordPress...

cve-2021-29447_auto-script

CVE-2021-29447: Vulnerabilidad XXE en la Biblioteca de Medios de WordPress Este repositorio detalla la vulnerabilidad CVE-2021-29447, un fallo de seguridad crítico en WordPress que permitía ataques de Entidad Externa XML XXE autenticados a través de la Biblioteca de Medios. También proporciona un...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE en WordPress WordPress 5.6-5.7 - XXE autenticado Autor+ CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Uso Paso 1. Ejecutar WordPress root@kitploit: $ make up-wp Paso 2. Ejecutar el servidor web del atacante root@kitploit: $ make up-mal Paso 3. Generar archivo WAV...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

CVE-2021-29447

WordPress 5.6-5.7 - 已认证（作者及以上）XXE CVE-2021-29447 使用 步骤1：运行WordPress root@kitploit: $ make up-wp 步骤2：运行攻击者Web服务器 root@kitploit: $ make up-mal 步骤3：生成恶意WAV文件 不使用wavefile npm（推荐） root@kitploit: $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick; \x00' malicious.wav 使用wavefil...

Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

项目目标：演示针对易受攻击的WordPress安装的完整攻击链，利用CVE-2021-29447（媒体库中的XXE）实现远程代码执行并完全攻陷系统。 阶段1：侦察与信息收集 使用Nmap进行网络扫描： bash 快速SYN扫描发现开放端口 nmap -sS -T4 10.201.3.95 详细的版本和脚本扫描 nmap -sV -sC -p22,80,3306 10.201.3.95 -oA initialscan 结果： text PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 80/tcp open ht...

CVE-2021-29447

WAV iXML XXE 漏洞利用生成器 生成恶意 WAV 文件，利用解析 iXML 元数据块的 WordPress 插件中的 XXE 漏洞（例如 BookingPress │ Target │ └──────────┘ └──────────┘ ▲ │ │ │ 2. Parse XML │ │ │ 3. GET /xxe.dtd │ │─────────────────────────────┘ │ │ 4. GET /?p=base64data │─────────────────────────────┐ │ │ └─ Decode and read file │ 受影响的目标...

CVE-2021-29447

CVE-2021-29447 影响 任意文件泄露：可以获取主机文件系统上任何文件的内容，例如包含数据库凭据等敏感数据的 wp-config.php。 服务端请求伪造（SSRF）：可以代表 WordPress 安装发起 HTTP 请求。根据环境不同，这可能产生严重影响。 利用漏洞 在枚举过程中，借助 wpscan 工具，识别出了一个受此漏洞影响的 WordPress 站点。 创建恶意 WAV 文件。 非常简单，在你的 bash 控制台中 nano poc.wav echo -en...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

Amazon Linux 2 : gstreamer1-plugins-bad-free, --advisory ALAS2-2026-3895 (ALAS-2026-3895)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3895 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-bad-free (UTSA-2026-104837)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104837 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of th...

Astra Linux – Vulnerability in wavpack

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variables. The impact includes unexpected control flow, crashes, and segfaults. The affected component is ParseCaffHeaderConfig caff.c:486. The attack vector is a maliciously crafted .wav file. The fixed version is after the...

SUSE CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

PT-2026-69329

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-bad affected versions not specified Description A heap out-of-bounds write occurs in the adpcmdec element when decoding IMA/DVI ADPCM audio. This is caused by insufficient validation of the per-block sample count for...