CVE-2017-11561

CVE-2017-11561 affects ZOHO ManageEngine OpManager 12.2. An authenticated user can upload arbitrary files in the Group Chat or Alarm sections, enabling potential web shells. The vulnerability arises from insecure file upload handling, allowing an attacker to upload executable content. Public desc...

CVE-2017-11561

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

PT-2019-7896

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager version 12.2 Description An issue was discovered that allows an authenticated user to upload any file in the "Group Chat" or "Alarm" section, which can be abused by a malicious user to upload a web shell...

CVE-2017-11561: Unrestricted Upload of File with Dangerous Type

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

Exploit for Unrestricted Upload of File with Dangerous Type in Elabftw

Exploit Title : eLabFTW 1.8.5 'EntityController' Arbit...

CVE-2019-11680

KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image...

CVE-2019-11680

KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image...

Remote code execution

KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image...

CVE-2019-11680

CVE-2019-11680 affects KonaKart 8.9.0.0. The vulnerability allows remote code execution by uploading a web shell as a product category image, indicating the attacker can run arbitrary code on the server. Multiple connected sources (NVD, Red Hat advisory, CNVD, PRION, CVE lists) corroborate that K...

PT-2019-12477

Name of the Vulnerable Software and Affected Versions KonaKart version 8.9.0.0 Description The issue allows for Remote Code Execution by uploading a web shell as a product category image. Recommendations For KonaKart version 8.9.0.0, consider restricting image uploads for product categories to...

CVE-2019-11680: Undefined Security Weakness

KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image...

FIN7 Linked to Escalating Active Exploits for Microsoft SharePoint Bug

A recently patched, high-severity vulnerability in Microsoft SharePoint CVE-2019-0604 that allows remote code-execution is being increasingly exploited in the wild, according to researchers – possibly by the FIN7 group, among others. According to the Microsoft’s advisory, the vulnerability which...

CVE-2019-10276: Unrestricted Upload of File with Dangerous Type

Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type...

Joomla Jmail Breaker PHP Web Shell Backdoor

An attacker might upload a web shell backdoor to a Joomla Jmail service. A successful exploitation might allow the attacker to run arbitrary code, or use the server as a bot for further attacks...

Joomla Jmail Breaker Arbitrary File Upload

An attacker might use a web shell backdoor to upload arbitrary files using Joomla Jmail service. A successful exploitation might allow the attacker to run arbitrary code, or use the server as a bot for further attacks...

JSP Web Shell Generic Backdoor

An attacker might upload a web shell backdoor to a JSP server. A successful exploitation might allow the attacker to run arbitrary code, or use the server as a bot for further attacks...

U.S. Dept Of Defense: RCE on https://█████/ Using CVE-2017-9248

Summary: https://█████████/ is hosting an unpatched version of the Telerik DialogHandler Telerik.Web.UI.DialogHandler.aspx allowing for the machine key to be brute forced. The machine key can be used to access the DNN file manager to upload arbitrary files including ASPX giving a web shell and RC...

W3Brute - Automatic Web Application Brute Force Attack Tool

w3brute is an open source penetration testing tool that automates attacks directly to the website's login page. w3brute is also supported for carrying out brute force attacks on all websites. Features 1. Scanner: w3brute has a scanner feature that serves to support the bruteforce attack process...

Exploit for Improper Authentication in Comodo Unified_Threat_Management_Firewall

CVE-2018-17431-PoC Proof of consept for CVE-2018-17431 E...

ClipperCMS 1.3.3 - Cross-Site Request Forgery (File Upload) Vulnerability

Exploit for php platform in category web applications Exploit Title: ClipperCMS 1.3.3 File Upload CSRF Vulnerability Exploit Author: Ameer Pornillos Website: http://ethicalhackers.club Vendor Homepage: http://www.clippercms.com/ Software Link:...