TP-Link TL-WR840N/TL-WR841N - Authenticaton Bypass

Title: TP-Link Multiple RouterTL-WR840N and TL-WR841N Unauthenticated Router Access Vulnerability Author: BlackFog Team Date: 27 May 2018 Website: SecureLayer7.net Contact: [email protected] Version: 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n Hardware: TL-WR841N v13 00000013 Version : Firmwar...

CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) (DEP Bypass)

Exploit: CloudMe Sync netstat -nao | find "8888" TCP 0.0.0.0:8888 0.0.0.0:0 LISTENING 2640 C:\tasklist | find "2640" CloudMe.exe 2640 Console 1 36,632 K Attacking Machine: root@kali:/Desktop python cloudme.py CloudMe Sync v1.10.9 Buffer Overflow with DEP Bypass + CloudMe Target IP 192.168.12.4...

ALFTP 5.31 - Local Buffer Overflow (SEH Bypass)

Exploit Title: ALFTP 5.31 - Local Buffer Overflow SEH Bypass Exploit Author: Gokul Babu Vendor Homepage: http://www.altools.com/downloads/alftp.aspx Vulnerable Software: http://advert.estsoft.com/?event=201001127730323 Tested on: Windows XP Professional SP3 -Version-2002 Steps to reproduce-1: eip...

Joomla! Component JoomOCShop 1.0 - Cross-Site Request Forgery

Exploit Title: Joomla! extension JoomOCShop 1.0 - Cross site request forgery Date: 2018-05-28 Exploit Author: L0RD or [email protected] Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/e-commerce-integrations/joomocshop/ Vendor Homepage:...

WordPress Plugin Events Calendar - SQL Injection

Exploit Title: Wordpress Plugin Events Calendar - SQL Injection Dork: N/A Date: 2018-05-27 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor: Wachipi Vendor Homepage: https://codecanyon.net/item/wp-events-calendar-plugin/5025660 Version: 1.0 Category: Webapps Tested on: Kali linux Description : An...

wityCMS 0.6.1 - Cross-Site Scripting

Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field Date: 05/28/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: https://creatiwity.net/witycms Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.1 Version: 0.6.1 Tested on:...

DomainMod 4.09.03 - 'oid' Cross-Site Scripting

Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter Date: 2018-05-28 Exploit Author: longer（[email protected]） Vendor Homepage: domainmod https://github.com/domainmod/domainmod Software Link: domainmod https://github.com/domainmod/domainmod Version: v4.09.0...

DomainMod 4.09.03 - 'sslpaid' Cross-Site Scripting

Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter Date: 2018-05-28 Exploit Author: longer（[email protected]） Vendor Homepage: domainmod https://github.com/domainmod/domainmod Software Link: domainmod https://github.com/domainmod/domainmod...

Joomla! Component jCart for OpenCart 2.3.0.2 - Cross-Site Request Forgery

Exploit Title: Joomla! extension jCart for OpenCart 2.3.0.2 - Cross site request forgery Date: 2018-05-28 Exploit Author: L0RD or [email protected] Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/e-commerce-integrations/jcart-for-opencart/ Vendor Homepage:...

Joomla! Component Full Social 1.1.0 - 'search_query' SQL Injection

Exploit Title: Joomla! extension Full Social 1.1.0 - 'searchquery' SQL Injection Date: 2018-05-28 Exploit Author: L0RD or [email protected] Software Link: https://extensions.joomla.org/extension/full-social/ Vendor Homepage: https://www.joomlaextensions.co.in/ Version: 1.1.0 Tested on...

Bitmain Antminer D3/L3+/S9 - Remote Command Execution

Exploit Title: Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution Google Dork: N/A Date: 27/05/2018 Exploit Author: Corrado Liotta Vendor Homepage: https://www.bitmain.com/ Software Link: N/A Version: Antminer - D3, L3+, S9, and other Tested on: Windows/Linux CVE :...

WordPress Plugin Booking Calendar 3.0.0 - SQL Injection / Cross-Site Scripting

Exploit Title: Wordpress Plugin Booking Calendar 3.0.0 - SQL Injection / Cross-Site Scripting Dork: N/A Date: 26.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor: Wachipi Vendor Homepage: https://codecanyon.net/item/wp-booking-calendar/4639530 Version: 3.0.0 Category: Webapps Tested on:...

ClipperCMS 1.3.3 - Cross-Site Scripting

Exploit Title: ClipperCMS 1.3.3 Persistent XSS on 'Site name' field Date: 05/27/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: http://www.clippercms.com/ Software Link: https://github.com/ClipperCMS/ClipperCMS/releases/tag/clipper1.3.3 Version: 1.3.3 Tested on:...

Baby Names Search Engine 1.0 - 'a' SQL Injection

Exploit Title: Baby Names Search Engine v1.0 - 'a' SQL Injection Dork: N/A Date: 27.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor: MediaGeni Vendor Homepage: https://codecanyon.net/item/baby-names-search-engine/11864316 Version: 2.0 Category: Webapps Tested on: Kali linux Description :...

BookingWizz Booking System 5.5 - 'id' SQL Injection

Exploit Title: BookingWizz Booking System 5.5 - 'bs-services-add.php' SQL Injection Dork: N/A Date: 27.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/booking-system/87919 Version: 5.5 Category: Webapps Tested on: Kali linux Description : The service...

Ingenious School Management System - 'id' SQL Injection

Exploit Title: Ingenious School Management System - SQL Injection Date: 2018-05-26 Exploit Author: Meisam Monsef - [email protected] - @meisamrce Vendor Homepage: https://www.codester.com/items/4945/ingenious-school-management-system Version: All Version Exploit :...

Sharetronix CMS 3.6.2 - Cross-Site Request Forgery / Cross-Site Scripting

Exploit Title: Sharetronix CMS XSRF Vulnerability Version : 3.6.2 Exploit Author: Hesam Bazvand Software Link: http://sharetronix.ir/wp-content/uploads/2014/10/gold.zip Tested on: Windows 10 / Kali Linux Category: WebApps Dork : Use You Mind :D Email : [email protected] Video :...

My Directory 2.0 - SQL Injection / Cross-Site Scripting

Exploit Title: My Directory 2.0 - SQL Injection / Cross-Site Scripting Dork: N/A Date: 27.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/my-directory/15859886 Version: 2.0 Category: Webapps Tested on: Kali linux Description : The vulnerability allow...

Listing Hub CMS 1.0 - SQL Injection

Exploit Title: Listing Hub CMS 1.0 - Multiple SQL Injection Dork: N/A Date: 27.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/listing-hub-cms-directory-listings-theme/21361294 Version: 1.0 Category: Webapps Tested on: Kali linux Description : An...

Lyrist - 'id' SQL Injection

Exploit Title: Lyrist - Music Lyrics Script - SQL Injection Date: 2018-05-26 Exploit Author: Meisam Monsef - [email protected] - @meisamrce Vendor Homepage: https://www.codester.com/items/7250/lyrist-music-lyrics-script Version: All Version Exploit :...

Werewolf Online 0.8.8 - Information Disclosure

Exploit Title: Werewolf Online 0.8.8 - Insecure Logging Date: 2018-05-24 Software Link: https://play.google.com/store/apps/details?id=com.werewolfapps.online Download Link: https://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details Exploit Author: ManhNho Version...

EasyService Billing 1.0 - Cross-Site Scripting

!-- Exploit Title: EasyService Billing 1.0 Cross-Site Scripting in 'q' Parameter Date: 25-05-2018 Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 Exploit Author: Divya Jain Version: EasyService Billing 1.0 CVE: CVE-2018-11443...

EasyService Billing 1.0 - Cross-Site Request Forgery

history.pushState'', '', '/'...

Employee Work Schedule 5.9 - 'cal_id' SQL Injection

Exploit Title: EWS 5.9 - 'search' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/employee-work-schedule-multicalendar/10545683 Version: 5.9 Category: Webapps Tested on: Kali linux Description : The vulnerability allo...

EasyService Billing 1.0 - 'q' SQL Injection

!-- Exploit Title: EasyService Billing 1.0 SQL Injection on page jobcard-ongoing.php?q= Date: 25-05-2018 Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 Exploit Author: Divya Jain Version: EasyService Billing 1.0 CVE:...

easyLetters 1.0 - 'id' SQL Injection

Exploit Title: easyLetters 1.0 - 'id' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/easyletters/5281396 Version: 1.0 Category: Webapps Tested on: Kali linux ==================================================== Demo ...

Symfony 2.7.0 < 4.0.10 - Denial of Service

The PDOSessionHandler class allows to store sessions on a PDO connection. Under some configurations see below and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources. An application is vulnerable when: - It is using...

Ajax Full Featured Calendar 2.0 - 'search' SQL Injection

Exploit Title: Ajax Full Featured Calendar 2.0 - 'search' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ajax-full-featured-calendar-2/10158465 Version: 2.0 Category: Webapps Tested on: Kali linux Description : The...

mySurvey 1.0 - 'id' SQL Injection

Exploit Title: mySurvey 1.0 - 'statistic.php' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/mysurvey/6794645 Version: 1.0 Category: Webapps Tested on: Kali linux Description : You can see the notifications on the le...

D-Link DSL-2750B - OS Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'D-Link DSL-2750B OS Command Injection', 'Description' = %q This module exploits a remote command injection vulnerability in D-Link DSL-2750B...

Skia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write

!-- Skia bug report: https://bugs.chromium.org/p/skia/issues/detail?id=7674 Mozilla bug report: https://bugzilla.mozilla.org/showbug.cgi?id=1441941 In Skia, SkTDArray stores length fCount and capacity fReserve as 32-bit ints and does not perform any integer overflow checks. There are a couple of...

Microsoft Edge Chakra - Cross Context Use-After-Free

f.onload = null; // Garbage collection for let i = 0; i 10; i++ new ArrayBuffer1024 1024 40; let obj = opt; // "opt" returns the freed string constant. ; // Closing the diffrent context f.src = 'about:blank'; But in fact, if you run the code, you will see an exception saying "Can't execute code...

Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x - Cross-Site Scripting

Exploit Title: Multiple XSS Oracle WebCenter Sites FatWire Content Server 7.x 11gR1 Dork: inurl:Satellite?c Date: 18.12.201 Exploit Author: Richard Alviarez Vendor Homepage: http://oracle.com Version: 7.x 11gR1 CVE: CVE-2018-2791 Category: Webapps Tested on: Kali linux...

SAP Internet Transaction Server 6200.x - Session Fixation / Cross-Site Scripting

Exploit Title: SAP Internet Transaction Server ITS 6200.X.X - Session Fixation/ Cross-Site Scripting Dork: /scripts/wgate/ Date: 25.05.2018 Exploit Author: J. Carrillo Lencina 0xd0m7 Vendor Homepage: https://www.sap.com Version: SAP ITS 6200.X.X Category: Webapps Tested on: All Platforms CVE:...

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting

Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting Date: 2018-05-17 Author: 0xB9 Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 CVE: N/A 1. Description: The plugin allows moderators to save notes and display them...

KomSeo Cart 1.3 - 'my_item_search' SQL Injection

Exploit Title: KomSeo Cart 1.3 - 'edit.php' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor: SITEMAKIN Vendor Homepage: https://sitemakin.com Version: 1.3 Category: Webapps Tested on: Kali linux Description : The vulnerability allows an attacker to inject...

Oracle WebCenter FatWire Content Server < 7 - Improper Access Control

Exploit Title: Oracle WebCenter FatWire Content Server 7 - Improper Access Control Dork: inurl:Satellite?pagename Date: 2017-10-17 Exploit Author: Sebastian Cornejo Olave Vendor Homepage: http://oracle.com Version: 5.5.2 ,7.5 = CVE: CVE-2017-10033 Category: Webapps Tested on: Kali linux...

Linux/x86 - Reverse (10.0.7.17:4444/TCP) Shell (/bin/sh) Shellcode (101 Bytes)

Linux/x86 - Reverse 10.0.7.17:4444/TCP Shell /bin/sh Shellcode 101 Bytes. Shellcode exploit for Linuxx86 platform / Name : Jonathan "Chops" Crosby Email : [email protected] Twitter : @securitychops Website : https://securitychops.com Blog Post :...

GNU glibc < 2.27 - Local Buffer Overflow

GNU glibc Vendor Homepage: http://www.gnu.org/ CVE: CVE-2018-11237 POC: $ cat mempcpy.c define GNUSOURCE 1 include include define N 97699 char aN; char bN+128; int main void memset a, 'x', N; char c = mempcpy b, a, N; assert c == 0; $ gcc -g mempcpy.c -o mempcpy -fno-builtin-mempcpy $ ./mempcpy...

Linux/x86 - Reverse (10.10.2.4:4444/TCP) Shell Shellcode (68 bytes)

Linux/x86 - Reverse 10.10.2.4:4444/TCP Shell Shellcode 68 bytes. Shellcode exploit for Linuxx86 platform / ; Title : Linux/x86 - Reverse TCP Shell Shellcode 68 bytes ; Date : May, 2018 ; Author : Nuno Freitas ; Blog Post : https://bufferoverflowed.wordpress.com ; Twitter : @nunof11 ; SLAE ID :...

OpenDaylight - SQL Injection

OpenDaylight - SQL Injection. CVE-2018-1132. Webapps exploit for Java platform Exploit Title: OpenDaylight SQL Injection Date: 2018-05-24 Exploit Author: JameelNabbo Website: jameelnabbo.com Vendor Homepage: https://www.opendaylight.org CVE: CVE-2018-1132 intro: OpenDaylight ODL is a modular open...

PaulNews 1.0 - 'keyword' SQL Injection / Cross-Site Scripting

Exploit Title: PaulNews 1.0 - 'keyword' SQL Injection / Cross-Site Scripting Dork: N/A Date: 23.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor: MediaSoft Pro Vendor Homepage: https://codecanyon.net/item/paulnews-newspaper-and-magazine-script/19260686 Version: v1.0 Category: Webapps Test...

Honeywell XL Web Controller - Cross-Site Scripting

Exploit Title: Honeywell XL Web Controller - Cross-Site Scripting Date: 2018-05-24 Exploit Author: t4rkd3vilz Vendor Homepage: https://www.honeywell.com Version: WebVersion : XL1000C50 EXCEL WEB 52 I/O, XL1000C100 EXCEL WEB 104 I/O, XL1000C500 EXCEL WEB 300 I/O, XL1000C1000 EXCEL WEB 600 I/O,...

EU MRV Regulatory Complete Solution 1 - Authentication Bypass

Exploit Title: EU MRV Regulatory Complete Solution 1 - Authentication Bypass Date: 2018-05-24 Exploit Author: Veyselxan Vendor Homepage: https://codecanyon.net/item/eu-mrv-regulatory-complete-solution/21680923?srank=11 Version: v1 REQUIRED Tested on: Windows...

Timber 1.1 - Cross-Site Request Forgery

Exploit Title: Timber - Ultimate Freelancer Platform 1.1 - Cross site request forgery Date: 2018-05-24 Exploit Author: L0RD or [email protected] Vendor Homepage: https://codecanyon.net/item/timber-ultimate-freelancer-platform/14747284?srank=1717 Version: 1.1 Tested on: Kali linux...

ASP.NET jVideo Kit - 'query' SQL Injection

Exploit Title: ASP.NET jVideo Kit - 'query' SQL Injection Dork: N/A Date: 23.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor: MediaSoft Pro Vendor Homepage: https://www.mediasoftpro.com/video-sharing-script/mvc/ Version: v1.0 Category: Webapps Tested on: Kali linux Description : The...

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change

Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Date: 2018-05-23 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on: Windows CVE: - Class: Unauthorized Admin Credential Change...

NewsBee CMS 1.4 - Cross-Site Request Forgery

NewsBee CMS 1.4 - Cross-Site Request Forgery. Webapps exploit for PHP platform Title: NewsBee CMS 1.4 - Cross-Site Request Forgery Author: indoushka Tested on: windows 10 Français V.Pro Vendor: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937 Dork: N...

Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) + IPv6 Shellcode (113 bytes)

Linux/x86 - Bind 4444/TCP Shell /bin/sh + IPv6 Shellcode 113 bytes. Shellcode exploit for Linuxx86 platform // Title: Linux/x86 - IPv6 TCP bind tcp shell on 4444 port // Length : 113 bytes // Author : Matteo Malvica // Tested On : kali linux 4.15 // Contact : [email protected] // Description: it...

Siemens SCALANCE S613 - Remote Denial of Service

Exploit Title: Siemens SCALANCE S613 - Remote Denial of Service Date: 2018-05-23 Exploit Author: t4rkd3vilz Vendor Homepage: https://www.siemens.com/ Version: SCALANCE S613 MLFB: 6GK5613-0BA00-2AA3: All versions. Tested on: Kali Linux CVE: CVE-2016-3963 !/usr/bin/python import socket import sys i...