GhostEmperor: From ProxyLogon to kernel mode

Download GhostEmperors technical details PDF While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. This cluster stood out for its usage of a formerly unknown Windows kernel mode...

WordPress Google Maps Plugin < 8.1.13 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:codecabin:wpgomaps"; if description...

Storage Unit Rental Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)

Exploit Title: Storage Unit Rental Management System 1.0 - Remote Code Execution RCE Unauthenticated Date: 28.09.2021 Exploit Author: Fikrat Ghuliev Ghuliev Vendor Homepage: https://www.sourcecodester.com/php/14932/storage-unit-rental-management-system-using-php-free-source-code.html Software Lin...

Exploit for SQL Injection in Online_Food_Ordering_Web_App_Project Online_Food_Ordering_Web_App

CVE-2021-41647 CVE-2021-41647 SQL Injection in Online-Food-Or...

Simple Attendance System 1.0 Authentication Bypass

Exploit Title: Simple Attendance System v1.0 - Unauthenticated Add Admin Account Exploit Author: Richard Jones Date: September 26, 2021 Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html Software Link:...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin TranslatePress, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

Simple Attendance System 1.0 Authentication Bypass Exploit

Exploit Title: Simple Attendance System v1.0 - Unauthenticated Add Admin Account Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html Software Link:...

Akamai Named a Gartner Magic Quadrant Leader for Web Application and API Protection

This week, Gartner released its new 2021 Magic Quadrant for Web Application and API Protection WAAP report, which replaces the Magic Quadrant for Web Application Firewalls WAF report, and Akamai has been named a Leader. Akamai was named a Leader in the four previous WAF Magic Quadrants...

Imperva An Eight-Time Magic Quadrant Leader for Web Application and API Protection

2021 has seen a lot of change. Billionaires now go where only governments and Red Bull gimmicks could go before. The 2020 Olympics didn’t take place in 2020. Tom Brady won his 7th Super Bowl for a completely new franchise those of you in the US get this reference. Similar change in application...

E-Negosyo System 1.0 SQL Injection

Exploit Title: E-Negosyo System 1.0 - Time-Based Blind SQLi - admin/login.php Date: 2021-09-22 Exploit Author: Janik Wehrli Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsenordering0.zip Version:...

e107 CMS 2.3.0 Shell Upload

Exploit Title: e107 CMS 2.3.0 - Remote Code Execution RCE Authenticated Date: 21-09-2021 Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://e107.org/ Software Link: https://e107.org/download Version: 2.3.0 Category: Webapps Tested on: Linux/Windows e107 is a free website content...

Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)

Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting Reflected Date: 10.06.2021 Exploit Author: Akıner Kısa Vendor Homepage: https://cloudron.io Software Link: https://www.cloudron.io/get.html Version: 6.3 CVE : CVE-2021-40868 Proof of Concept: 1. Go to...

Apache Struts 2 Double OGNL Evaluation Vulnerability (CVE-2020-17530)

A vulnerability CVE-2020-17530 discovered last year in the Object Graph Navigation Language OGNL evaluation function of Apache Struts versions 2.0.0 – 2.5.25 can be exploited by attackers to perform remote code execution. This RCE vulnerability doesn’t come packaged with Apache struts but is...

ownCloud < 4.0.1 Multiple XSS Vulnerabilities

ownCloud is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WP Cookie Choice <= 1.1.0 - CSRF to Stored Cross-Site Scripting

The plugin is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack...

The vulnerability of the WAF engine for Apache ModSecurity, related to deficiencies in handling exceptional states, allows a attacker to trigger a service failure.

The vulnerability of the WAF engine for Apache ModSecurity is related to incorrect data processing in the form of key-value pairs. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service interruptions...

Lacework: Broken link profile in the website leads to identity theft.

Hi, I have found the Broken link profile in the website where the attacker can perform identity theft. Summary : When a web application has any pages, sources, links to external 3rd party services and are broken then the attacker can claim those endpoints to successfully conduct the attack and...

XssHunter-Express 授权问题漏洞

XssHunter-Express is used to test and find blind XSS. XssHunter-Express suffers from an Authorization Problem vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Apache Struts RCE Vulnerability (S2-048) - Version Check

Apache Struts is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Apache Struts Security Update (CVE-2007-6726)

Apache Struts is prone to multiple cross-site scripting XSS vulnerabilities in Dojo. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...