iGreeting Cards 1.0 - SQL Injection

Exploit Title: iGreeting Cards 1.0 - SQL Injection Dork: N/A Date: 04.09.2017 Vendor Homepage: http://coryapp.com/ Software Link: http://coryapp.com/?product&index Demo: http://coryapp.com/demo/greetingcards/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author:...

Joomla! Component Survey Force Deluxe 3.2.4 - 'invite' SQL Injection

Exploit Title: Joomla! Component Survey Force Deluxe 3.2.4 - SQL Injection Dork: N/A Date: 03.09.2017 Vendor Homepage: http://joomplace.com/ Software Link: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/surveys/survey-force-deluxe/ Demo:...

Joomla! Component CheckList 1.1.0 - SQL Injection

Exploit Title: Joomla! Component CheckList 1.1.0 - SQL Injection Dork: N/A Date: 03.09.2017 Vendor Homepage: http://joomplace.com/ Software Link: https://extensions.joomla.org/extensions/extension/living/personal-life/checklist/ Demo: http://checklistdemo.joomplace.com/ Version: 1.1.0 Category:...

Lotus Notes Diagnostic Tool 8.5/9.0 - Local Privilege Escalation

Exploit Title: Lotus Notes Diagnostic Tool nsd.exe Privelege Escalation Date: 02-09-2017 Exploit Author: ParagonSec Website: https://github.com/paragonsec Version: 8.5 & 9.0 Tested on: Windows 7 Enterprise CVE: CVE-2015-0179 Vendor CVE URL: http://www-01.ibm.com/support/docview.wss?uid=swg2170002...

IBM Notes 8.5.x/9.0.x - Denial of Service

Exploit Title: IBM Notes is affected by a denial of service vulnerability Date: 31 August 2017 Software Link: https://www-01.ibm.com/support/docview.wss?uid=swg24037141 Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ CVE: CVE-2017-1129...

Motorola Bootloader - Kernel Cmdline Injection Secure Boot and Device Locking Bypass

Sources: https://alephsecurity.com/2017/08/30/untethered-initroot/ https://github.com/alephsecurity/initroot initroot: Motorola Bootloader Kernel Cmdline Injection Secure Boot & Device Locking Bypass CVE-2016-10277 By Roee Hay / Aleph Research, HCL Technologies Recap of the Vulnerability and the...

OpenJPEG - 'mqc.c' Heap Buffer Overflow

DESCRIPTION An Out-of-Bounds Write issue can be occurred in function opjmqcbyteout of mqc.c during executing opjcompress. This issue was caused by a malformed BMP file. CREDIT This vulnerability was discovered by Ke Liu of Tencent's Xuanwu LAB. TESTED VERSION Master version of OpenJPEG 805972f,...

WordPress Plugin Participants Database < 1.7.5.10 - Cross-Site Scripting

Exploit Title: Wordpress Plugin Participants Database 1.7.5.10 - XSS Google Dork: inurl:wp-content/plugins/participants-database/ Date: 01-Sep-17 Exploit Author: Benjamin Lim Vendor Homepage: https://xnau.com/ Software Link: https://wordpress.org/plugins/participants-database/ Version: 1.7.5.9...

Joomla! Component Huge-IT Portfolio Gallery Plugin 1.0.7 - SQL Injection

Exploit Title Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla Date: 2016-09-16 Exploit Author: Larry W. Cashdollar, @larry0 Vendor Homepage: http://huge-it.com/joomla-catalog/ Software Link: Version: 1.0.7 Tested on: Linux CVE : CVE-2016-1000125 Advisory:...

Joomla! Component Huge-IT Portfolio Gallery Plugin 1.0.6 - SQL Injection

Exploit Title Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6 Date: 2016-09-16 Exploit Author: Larry W. Cashdollar, @larry0 Vendor Homepage: http://huge-it.com/joomla-portfolio-gallery/ Software Link: Version: 1.0.6 Tested on: Linux CVE : CVE-2016-1000124 Advisory:...

IBM Notes 8.5.x/9.0.x - Denial of Service (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "IBM Notes encodeURI DOS", 'Description' = %q This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes. If...

IBM Notes 8.5.x/9.0.x - Denial of Service (2)

Exploit Title: IBM Notes is affected by a denial of service vulnerability Date: 31 August 2017 Software Link: http://www-01.ibm.com/support/docview.wss?uid=swg21999384 Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ CVE: CVE-2017-1130...

Sitefinity CMS 9.2 - Cross-Site Scripting

Exploit Title: Stored Cross Site Scripting XSS in Progress Sitefinity CMS 9.2 Date: Aug 31, 2017 Exploit Author: Pralhad Chaskar Vendor Homepage: http://www.sitefinity.com/ Tested on: Progress Sitefinity CMS 9.2 and lower CVE : NA Vendor Description ------------------ Progress® Sitefinity™ is a...

Git < 2.7.5 - Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Malicious Git HTTP Server For CVE-2017-1000117', 'Description' = %q This module exploits CVE-2017-1000117, which affects Git version 2.7.5 and...

Joomla! Component Huge-IT Video Gallery 1.0.9 - SQL Injection

Exploit Title Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla Google Dork: if applicable Date: 2016-09-15 Exploit Author: Larry W. Cashdollar, @larry0 Vendor Homepage: http://huge-it.com/joomla-video-gallery/ Software Link: Version: 1.0.9 Tested on: Linux CVE :...

Joomla! Component Joomanager 2.0.0 - 'com_Joomanager' Arbitrary File Download (PoC)

Exploit Title: Joomla! Component Joomanager 2.0.0 - Arbitrary File Download Dork: N/A Date: 30.08.2017 Vendor Homepage: http://www.joomanager.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/joomanager/ Demo:...

Linux/x86 - Fork Bomb Shellcode (9 bytes)

Linux/x86 - Fork Bomb Shellcode 9 bytes. Shellcode exploit for Linx86 platform / ;Title: Linux/x86 - Fork Bomb Shellcode ; Author: Touhid M.Shaikh ; Contact: https://github.com/touhidshaikh ; Category: Shellcode ; Architecture: Linux x86 ; Description: This shellcode may crash ur system if execut...

Metasploit Web UI < 4.14.1-20170828 - Cross-Site Request Forgery

Exploit Title: CSRF Date: Wed, Aug 30, 2017 Software Link: https://www.metasploit.com/ Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ CVE: CVE-2017-15084 R7-2017-22 Category: Metasploit Pro, Express, Ultimate, and Community 1...

Oracle Java JDK/JRE < 1.8.0.131 / Apache Xerces 2.11.0 - 'PDF/Docx' Server Side Denial of Service

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in Oracle Java JDK/JRE 1.8.0.131 and previous versions packages and Apache Xerces 2.11.0 The vulnerabilities are: Oracle JDK/JRE Concurrency-Related Denial of Service java.net.URLConnection with no...

Joomla! Component Quiz Deluxe 3.7.4 - SQL Injection

Exploit Title: Joomla! Component Quiz Deluxe 3.7.4 - SQL Injection Dork: N/A Date: 30.08.2017 Vendor Homepage: http://joomplace.com/ Software Link: https://extensions.joomla.org/extensions/extension/living/education-a-culture/quiz-deluxe/ Demo:...

Invoice Manager 3.1 - Cross-Site Request Forgery (Add Admin)

======================================================== Invoice Manager v3.1 Cross site request forgery Add Admin Description : Invoice Manager v3.1 is vulnerable to CSRF attack No CSRF token in place which if an admin user can be tricked to visit a crafted URL created by attacker via spear...

PHP-SecureArea < 2.7 - Multiple Vulnerabilities

Exploit Title: PHP-SecureArea = v2.7 - SQL Injection Date: 30-08-2017 Exploit Author: Cryo Contact: https://twitter.com/KernelEquinox Vendor Homepage: https://www.withinweb.com Software Link: https://www.withinweb.com/phpsecurearea/ Version: 2.7 and below Tested on: Windows, Linux, Mac OS X 1...

Brickcom IP Camera - Credentials Disclosure

Advisory Information ======================================== Title: Brickcom IP-Camera Remote Credentials and Settings Disclosure Vendor Homepage: http://www.brickcom.com Tested on Camera types: WCB-040Af, WCB-100A, WCB-100Ae, OB-302Np, OB-300Af, OB-500Af Remotely Exploitable: Yes...

D-Link DIR-600 - Authentication Bypass

Exploit Title: D-Link DIR-600 - Authentication Bypass Absolute Path Traversal Attack CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12943 Date: 29-08-2017 Exploit Author: Jithin D Kurup Contact : https://in.linkedin.com/in/jithin-d-kurup-77b616142 Vendor : www.dlink.com Version:...

QNAP Transcode Server - Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'QNAP Transcode Server Command Execution', 'Description' = %q This module exploits an unauthenticated remote command injection vulnerability in QN...

User Login and Management - Multiple Vulnerabilities

----------------------------------------------------------------------------------- | |---------------------------------------------------------------------------------- 1 admin dashboard authentication bypass Description : An Attackers are able to completely compromise the web application built...

FineCMS 1.0 - Multiple Vulnerabilities

Exploit Title: FineCMS 1.0 Multiple Vulnerabilities Dork: N/A Date: 29.08.2017 Vendor Homepage : http://mvc.net.pl/ Software Link: https://github.com/andrzuk/FineCMS Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: sohaip-hackerDZ Author Web:...

PHP Appointment Booking Script - Authentication Bypass

======================================================== Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin Proof of Concept : - http://localhost/appointment/adminlogin.php set username and password to admin' or 1=1 -- -...

PHP Search Engine 1.0 - SQL Injection

Exploit Title: PHP Search Engine 1.0 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://nelliwinne.net/ Software Link: https://www.codester.com/items/2975/php-search-engine-mysql-based-simple-site-search Demo: http://codester.nelliwinne.net/PHPSearchEngine/ Version: 1.0 Category:...

WYSIWYG HTML Editor PRO 1.0 - Arbitrary File Download

Exploit Title: WYSIWYG HTML Editor PRO 1.0 - Arbitrary File Download Dork: N/A Date: 28.08.2017 Vendor Homepage: http://nelliwinne.net/ Software Link: https://codecanyon.net/item/wysiwyg-html-editor-pro-php-based-editor-with-image-uploader-and-more/19012022 Demo:...

Easy Vedio to PSP Converter 1.6.20 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: Easy Vedio to PSP Converter 1.6.20 - Local Buffer Overflow SEH Date: 28-08-2017 Exploit Author: Kishan Sharma Email : [email protected] Vulnerable Software: Easy Vedio to PSP Converter Vendor Homepage: http://www.divxtodvd.net/ Version: 1.6.20 Software Link...

Smart Chat 1.0.0 - SQL Injection

Exploit Title: Smart Chat - PHP Script 1.0.0 - Authentication Bypass Dork: N/A Date: 28.08.2017 Vendor Homepage: http://codesgit.com/ Software Link: https://www.codester.com/items/997/smart-chat-php-script Demo: http://demos.codesgit.com/smartchat/ Version: 1.0.0 Category: Webapps Tested on:...

Easy WMV/ASF/ASX to DVD Burner 2.3.11 - Local Buffer Overflow (SEH)

!/usr/bin/python ======================================================================================================================== Exploit Author: Touhid M.Shaikh Exploit Title: Easy WMV/ASF/ASX to DVD Burner 2.3.11 - 'Enter User Name' Field Buffer Overflow SEH Date: 28-08-2017 Website:...

Flash Poker 2.0 - 'game' SQL Injection

Exploit Title: Flash Multiplayer Poker PHP Script 2.0 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://www.flashpoker.it/ Software Link: https://www.codester.com/items/559/flash-poker-v2-multiplayer-poker-php-script Demo: http://www.flashpoker.it/index/ Version: 2.0 Category:...

PHP Video Battle Script 1.0 - SQL Injection

Exploit Title: PHP Video Battle Script 1.0 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://www.rocky.nu/ Software Link: http://www.rocky.nu/product/php-video-battle/ Demo: http://videobattle.rocky.nu/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Explo...

FTP Made Easy PRO 1.2 - SQL Injection

Exploit Title: FTP Made Easy PRO 1.2 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://nelliwinne.net/ Software Link: https://codecanyon.net/item/ftp-made-easy-pro-php-multiple-ftp-manager-client-with-code-editor/17460747 Demo: http://codecanyon.nelliwinne.net/FTPMadeEasyPRO/...

Abusing Token Privileges For LPE

Abusing Token Privileges For LPE. Papers exploit for Windows platform |=-----------------------------------------------------------------------=| |=----------------= Abusing Token Privileges For LPE=------------------=| |=-----------------------------------------------------------------------=|...

NethServer 7.3.1611 - Cross-Site Request Forgery (Create User / Enable SSH Access)

HTML Decoded PoC: history.pushState'', '', '/' input type="hidden" name="AccountUsercr...

NethServer 7.3.1611 - Cross-Site Request Forgery / Cross-Site Scripting

NethServer 7.3.1611 Upload.json CSRF Script Insertion Vulnerability Vendor: NethServer.org Product web page: https://www.nethserver.org Affected version: 7.3.1611-u1-x8664 Summary: NethServer is an operating system for the Linux enthusiast, designed for small offices and medium enterprises. It's...

Car or Cab Booking Script - Authentication Bypass

======================================================== Car or Cab Booking Script - SQL injection login bypass Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin of the particular school Proof of Concept : -...

Easy RM RMVB to DVD Burner 1.8.11 - Local Buffer Overflow (SEH)

!/usr/bin/python ======================================================================================================================== Exploit Author : Touhid M.Shaikh Exploit Title : Easy RM RMVB to DVD Burner 1.8.11 - 'Enter User Name' Field Buffer Overflow SEH Date : 28-08-2017 Website :...

Easy Web Search 4.0 - SQL Injection

Exploit Title: Easy Web Search 4.0 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://nelliwinne.net/ Software Link: https://codecanyon.net/item/easy-web-search-php-search-engine-with-image-search-and-crawling-system/17574164 Demo: http://codecanyon.nelliwinne.net/EasyWebSearch/...

Login-Reg Members Management PHP 1.0 - Arbitrary File Upload

Exploit Title: Login-Reg Members Management PHP 1.0 - Arbitrary File Upload Dork: N/A Date: 28.08.2017 Vendor Homepage : https://www.codester.com/user/mostalo Software Link: https://www.codester.com/items/627/login-reg-members-management-php Demo: http://0log.890m.com/log/signup.php Version: 1.0...

Schools Alert Management Script - Authentication Bypass

======================================================== Schools Alert Management - SQL injection login bypass Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin of the particular school Proof of Concept : -...

Matrimonial Script 2.7 - Authentication Bypass

======================================================== admin panel Authentication bypass Description : An Attackers are able to completely compromise the web application built upon Matrimonial Script as they can gain access to the admin panel and manage the website as an admin without prior...

Easy DVD Creator 2.5.11 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: Easy DVD Creator 2.5.11 - Buffer Overflow Windows 10 64bit, SEH Date: 26-08-2017 Exploit Author: tr0ubl3m4k3r Vulnerable Software: Easy DVD Creator Vendor Homepage: http://www.divxtodvd.net/ Version: 2.5.11 Software Link: http://www.divxtodvd.net/easydvdcreator.exe...

Apple iOS < 10.3.1 - Kernel

Sources: https://github.com/doadam/ziVA https://blog.zimperium.com/ziva-video-audio-ios-kernel-exploit/ ziVA An iOS kernel exploit designated to work on all 64-bit iOS devices = 10.3.1 More general information https://blog.zimperium.com/zimperium-zlabs-ios-security-advisories/...

AutoCar 1.1 - 'category' SQL Injection

Exploit Title: Auto Car - Car listing Script 1.1 - SQL Injection Dork: N/A Date: 25.08.2017 Vendor: http://kamleshyadav.com/ Software Link: https://codecanyon.net/item/auto-car-car-listing-script/19221368 Demo: http://kamleshyadav.com/scripts/autocarpreview/ Version: 1.1 Tested on: WiN10X64 Explo...

Disk Pulse Enterprise 9.9.16 - Remote Buffer Overflow (SEH)

!/usr/bin/env python Exploit Title: Disk Pulse Enterprise 9.9.16 Remote SEH Buffer Overflow Date: 2017-08-25 Exploit Author: Nipun Jaswal & Anurag Srivastava Author Homepage: www.pyramidcyber.com Vendor Homepage: http://www.diskpulse.com Software Link:...

Disk Savvy Enterprise 9.9.14 - Remote Buffer Overflow (SEH)

!/usr/bin/env python Exploit Title: Disk Savvy Enterprise 9.9.14 Remote SEH Buffer Overflow Date: 2017-08-25 Exploit Author: Nipun Jaswal & Anurag Srivastava Author Homepage: www.pyramidcyber.com Vendor Homepage: http://www.disksavvy.com Software Link:...