SprintWork 2.3.1 - Local Privilege Escalation

Exploit Title: SprintWork 2.3.1 - Local Privilege Escalation Exploit Author: boku Date: 2020-02-13 Vendor Homepage: https://veridium.net Software Link: https://veridium.net/filesu/spx/exe/SprintWork-Setup.exe Version: 2.3.1 Tested On: Windows 10 32-bit Vulnerability Overview: SprintWork v2.3.1 x8...

WordPress Plugin Tutor.1.5.3 - Local File Inclusion

Tile: Wordpress Plugin tutor.1.5.3 - Local File Inclusion Author: mehran feizi Category: webapps Date: 2020-02-12 vendor home page: https://wordpress.org/plugins/tutor/ =================================================================== Vulnerable page: /instructors.php...

PANDORAFMS 7.0 - Authenticated Remote Code Execution

Exploit Title: PANDORAFMS 7.0 - Authenticated Remote Code Execution Date: 2020-02-12 Exploit Author: Engin Demirbilek Vendor homepage: http://pandorafms.org/ Version: 7.0 Software link: https://pandorafms.org/features/free-download-monitoring-software/ Tested on: CentOS CVE: CVE-2020-8947...

WordPress Plugin Wordfence.7.4.5 - Local File Disclosure

Tile: Wordpress Plugin wordfence.7.4.5 - Local File Disclosure Author: mehran feizi Category: webapps Date: 2020-02-12 vendor home page: https://wordpress.org/plugins/wordfence/ ============================================================================== Vulnerable Source: 5662: readfile...

OpenTFTP 1.66 - Local Privilege Escalation

Exploit Title: OpenTFTP 1.66 - Local Privilege Escalation Exploit Author: boku Date: 2020-02-12 Vendor Homepage: https://sourceforge.net/projects/tftp-server/ Software Link: https://sourceforge.net/projects/tftp-server/files/tftp%20server%20single%20port/OpenTFTPServerSPInstallerV1.66.exe/downloa...

WordPress Plugin tutor.1.5.3 - Persistent Cross-Site Scripting

Tile: Wordpress Plugin tutor.1.5.3 - Persistent Cross-Site Scripting Author: mehran feizi Category: webapps Date: 2020-02-12 vendor home page: https://wordpress.org/plugins/tutor/ =================================================================== Vulnerable page: /Quiz.php...

WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion

Title : WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion Author : mehran feizi Vendor : https://wordpress.org/plugins/ultimate-member/ Category : Webapps Date : 2020-02-11 Vendor home page: https://wordpress.org/plugins/ultimate-member/ Vulnerable Page: /class-admin-upgrade.php...

WordPress Plugin contact-form-7 5.1.6 - Remote File Upload

Tile: Wordpress Plugin contact-form-7 5.1.6 - Remote File Upload Author: mehran feizi Category: webapps Date: 2020-02-11 vendor home page: https://wordpress.org/plugins/contact-form-7/ Vulnerable Source: 134: moveuploadedfile moveuploadedfile$file'tmpname', $newfile 82: $file = $FILES$name : null...

HP System Event Utility - Local Privilege Escalation

Exploit Title: HP System Event Utility - Local Privilege Escalation Author: hyp3rlinx Date: 2020-02-11 Vendor: www.hp.com Link: https://hp-system-event-utility.en.lo4d.com/download CVE: CVE-2019-18915 + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

MyVideoConverter Pro 3.14 - 'Movie' Buffer Overflow

Exploit Title: MyVideoConverter Pro 3.14 - 'Movie' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-11 Vendor Homepage : http://www.ivideogo.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will create a new file with...

MyVideoConverter Pro 3.14 - 'TVSeries' Buffer Overflow

Exploit Title: MyVideoConverter Pro 3.14 - 'TVSeries' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-11 Vendor Homepage : http://www.ivideogo.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will create a new file...

MyVideoConverter Pro 3.14 - 'Output Folder' Buffer Overflow

Exploit Title: MyVideoConverter Pro 3.14 - 'Output Folder' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-11 Vendor Homepage : http://www.ivideogo.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will create a new...

WordPress Plugin InfiniteWP - Client Authentication Bypass (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress InfiniteWP Client Authentication Bypass', 'Description' = %q This module exploits an authentication bypass in the WordPress InfiniteWP...

FreeSSHd 1.3.1 - 'FreeSSHDService' Unquoted Service Path

Exploit Title: FreeSSHd 1.3.1 - 'FreeSSHDService' Unquoted Service Path Exploit Author: boku Date: 2020-02-10 Vendor Homepage: http://www.freesshd.com Software Link: http://www.freesshd.com/freeSSHd.exe Version: 1.3.1 Tested On: Windows 10 32-bit C:\Users\nightelfwmic service get name, pathname,...

DVD Photo Slideshow Professional 8.07 - 'Key' Buffer Overflow

Exploit Title: DVD Photo Slideshow Professional 8.07 - 'Key' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-10 Vendor Homepage : http://www.picture-on-tv.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will create ...

OpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution

Exploit Title: OpenSMTPD 6.6.1 - Local Privilege Escalation Date: 2020-02-02 Exploit Author: Marco Ivaldi Vendor Homepage: https://www.opensmtpd.org/ Version: OpenSMTPD 6.4.0 - 6.6.1 Tested on: OpenBSD 6.6, Debian GNU/Linux bullseye/sid with opensmtpd 6.6.1p1-1 CVE: CVE-2020-7247 !/usr/bin/perl...

Disk Sorter Enterprise 12.4.16 - 'Disk Sorter Enterprise' Unquoted Service Path

Exploit Title: Disk Sorter Enterprise 12.4.16 - 'Disk Sorter Enterprise' Unquoted Service Path Exploit Author: boku Date: 2020-02-10 Vendor Homepage: http://www.disksorter.com Software Link: http://www.disksorter.com/setups/disksorterentsetupv12.4.16.exe Version: 12.4.16 Tested On: Windows 10...

Wedding Slideshow Studio 1.36 - 'Name' Buffer Overflow

Exploit Title: Wedding Slideshow Studio 1.36 - 'Name' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-10 Vendor Homepage : http://www.wedding-slideshow-studio.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will...

freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path

Exploit Title: freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path Exploit Author: boku Date: 2020-02-10 Vendor Homepage: http://www.freesshd.com Software Link: http://www.freesshd.com/freeFTPd.exe Version: 1.0.13 Tested On: Windows 10 32-bit C:\Users\nightelfwmic service get name, pathnam...

DVD Photo Slideshow Professional 8.07 - 'Name' Buffer Overflow

Exploit Title: DVD Photo Slideshow Professional 8.07 - 'Name' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-10 Vendor Homepage : http://www.picture-on-tv.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will create...

Sync Breeze Enterprise 12.4.18 - 'Sync Breeze Enterprise' Unquoted Service Path

Exploit Title: Sync Breeze Enterprise 12.4.18 - 'Sync Breeze Enterprise' Unquoted Service Path Exploit Author: boku Date: 2020-02-10 Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv12.4.18.exe Version: 12.4.18 Tested On: Windows 10...

Vanilla Forums 2.6.3 - Persistent Cross-Site Scripting

Exploit Title: Vanilla Forums 2.6.3 - Persistent Cross-Site Scripting Google Dork: N/A Date: 2020-02-10 Exploit Author: Sayak Naskar Vendor Homepage: https://vanillaforums.com/en/ Version: 2.6.3 Tested on: Windows, Linux CVE : CVE-2020-8825 A Stored xss was found in Vanillaforum 2.6.3...

Disk Savvy Enterprise 12.3.18 - Unquoted Service Path

Exploit Title: Disk Savvy Enterprise 12.3.18 - Unquoted Service Path Exploit Author: boku Date: 2020-02-10 Vendor Homepage: http://www.disksavvy.com Software Link: http://www.disksavvy.com/setups/disksavvyentsetupv12.3.18.exe Version: 12.3.18 Tested On: Windows 10 32-bit C:\Users\nightelfwmic...

CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting

Exploit Title: CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting Google Dork: In Shodan search engine, the filter is "CHIYU" Date: 2020-02-11 Exploit Author: Luca.Chiou Vendor Homepage: https://www.chiyu-t.com.tw/en/ Version: BF430 232/485 TCP/IP Converter all versions prior to 1.16.00...

Torrent iPod Video Converter 1.51 - Stack Overflow

Exploit Title: Torrent iPod Video Converter 1.51 - Stack Overflow Exploit Author: boku Date: 2020-02-10 Software Vendor: torrentrockyou Vendor Homepage: http://www.torrentrockyou.com Software Link: http://www.torrentrockyou.com/download/tripodconverter.exe Version: Torrent iPod Video Converter...

Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow

Exploit Title: Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-09 Vendor Homepage : http://www.wedding-slideshow-studio.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will crea...

WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting

Exploit Title: LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting Date: 2020-01-14 Vendor Homepage: https://www.learndash.com Vendor Changelog: https://learndash.releasenotes.io/release/uCskc-version-312 Exploit Author: Jinson Varghese Behanan Author Advisory:...

Dota 2 7.23f - Denial of Service (PoC)

Exploit Title: Dota 2 7.23f - Denial of Service PoC Google Dork: N/A Date: 2020-02-05 Exploit Author: Bogdan Kurinnoy [email protected] bi7s Vendor Homepage: https://www.valvesoftware.com/en/ Software Link: N/A Version: 7.23f Tested on: Windows 10 x64 CVE : CVE-2020-7949 Valve Dota 2...

Forcepoint WebSecurity 8.5 - Reflective Cross-Site Scripting

Exploit Title: Forcepoint WebSecurity 8.5 - Reflective Cross-Site Scripting Exploit Author: Prasenjit Kanti Paul Vendor Homepage: https://www.forcepoint.com/ Software Link: https://www.forcepoint.com/product/cloud-security/web-security Version: Forcepoint Web Security 8.5 Tested on: Windows 7,10...

iOS/macOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()

While investigating possible shared memory issues in AGXCommandQueue::processSegmentKernelCommand, I noticed that the size checks used to parse the IOAccelKernelCommand in IOAccelCommandQueue2::processSegmentKernelCommand are incorrect. The IOAccelKernelCommand contains an 8-byte header consistin...

usersctp - Out-of-Bounds Reads in sctp_load_addresses_from_init

''' usersctp is SCTP library used by a variety of software including WebRTC. There is a vulnerability in the sctploadaddressesfrominit function of usersctp that can lead to a number of out-of-bound reads. The input to sctploadaddressesfrominit is verified by calling...

Ricoh Driver - Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/exe' class MetasploitModule 'Ricoh Driver Privilege Escalation', 'Description' = %q Various Ricoh printer drivers allow escalation of privilege...

D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi', 'Description' = %q D-Link Devices Unauthenticated Remote Command Execution i...

OpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenSMTPD MAIL FROM Remote Code Execution', 'Description' = %q This module exploits a command injection in the MAIL FROM field during SMTP...

ExpertGPS 6.38 - XML External Entity Injection

Exploit Title: ExpertGPS 6.38 - XML External Entity Injection + Date: 2019-12-07 + Exploit Author: Trent Gordon + Vendor Homepage: https://www.topografix.com/ + Software Link: http://download.expertgps.com/SetupExpertGPS.exe + Disclosed at: 7FEB2020 + Version: 6.38 + Tested on: Windows 10 + CVE:...

Google Invisible RECAPTCHA 3 - Spoof Bypass

Exploit Title: Google Invisible RECAPTCHA 3 - Spoof Bypass Date: 2020-02-07 Vendor Homepage: https://developers.google.com/recaptcha/docs/invisible Exploit Git Repo: https://github.com/matamorphosis/Browser-Exploits/tree/master/RECAPTCHABypass Exploit Author: Matamorphosis Tested on: Windows and...

EyesOfNetwork 5.3 - Remote Code Execution

Exploit Title: EyesOfNetwork 5.3 - Remote Code Execution Date: 2020-02-01 Exploit Author: Clément Billac Vendor Homepage: https://www.eyesofnetwork.com/ Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x8664-bin.iso Version: 5.3 CVE : CVE-2020-8654, CVE-2020-8655, CVE-2020-8656...

QuickDate 1.3.2 - SQL Injection

Exploit Title: QuickDate 1.3.2 - SQL Injection Dork: N/A Date: 2020-02-07 Exploit Author: Ihsan Sencan Vendor Homepage: https://quickdatescript.com/ Version: 1.3.2 Tested on: Linux CVE: N/A POC: 1 POST /findmatches HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:55.0...

PackWeb Formap E-learning 1.0 - 'NumCours' SQL Injection

Exploit Title: PackWeb Formap E-learning 1.0 - 'NumCours' SQL Injection Google Dork: intitle: "PackWeb Formap E-learning" Date: 2020-02-07 Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.ediser.com/ Software Link: https://www.ediser.com/98517-formation-en-ligne Version: v1.0...

VehicleWorkshop 1.0 - 'bookingid' SQL Injection

Exploit Title: VehicleWorkshop 1.0 - 'bookingid' SQL Injection Data: 2020-02-06 Exploit Author: Mehran Feizi Vendor HomagePage: https://github.com/spiritson/VehicleWorkshop Tested on: Windows Google Dork: N/A ========= Vulnerable Page: ========= /viewtestdrive.php ========== Vulnerable Source:...

Windscribe - WindscribeService Named Pipe Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windscribe WindscribeService Named Pipe Privilege Escalation', 'Description' = %q The Windscribe VPN client application for Windows makes use of ...

Online Job Portal 1.0 - Cross Site Request Forgery (Add User)

Exploit Title: Online Job Portal 1.0 - Cross Site Request Forgery Add User Dork: N/A Date: 2020-02-06 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html Software Link:...

AbsoluteTelnet 11.12 - "license name" Denial of Service (PoC)

Exploit Title: AbsoluteTelnet 11.12 - "license name" Denial of Service PoC Discovery by: chuyreds Discovery Date: 2020-02-05 Vendor Homepage: https://www.celestialsoftware.net/ Software Link : https://www.celestialsoftware.net/telnet/AbsoluteTelnet11.12.exe Tested Version: 11.12 Vulnerability Typ...

TapinRadio 2.12.3 - 'username' Denial of Service (PoC)

Exploit Title: TapinRadio 2.12.3 - 'username' Denial of Service PoC Discovery by: chuyreds Discovery Date: 2020-02-05 Vendor Homepage: http://www.raimersoft.com/rarmaradio.html Software Link : http://www.raimersoft.com/downloads/tapinradiosetupx64.exe Tested Version: 2.12.3 Vulnerability Type:...

ELAN Smart-Pad 11.10.15.1 - 'ETDService' Unquoted Service Path

Exploit Title: ELAN Smart-Pad 11.10.15.1 - 'ETDService' Unquoted Service Path Exploit Author : ZwX Exploit Date: 2020-02-05 Vendor : ELAN Microelectronics Vendor Homepage : http://www.emc.com.tw/ Tested on OS: Windows 10 v1803 Analyze PoC : ============== C:\Users\ZwXsc qc ETDService SC...

Cisco Data Center Network Manager 11.2.1 - 'LanFabricImpl' Command Injection

!/usr/bin/python """ Cisco Data Center Network Manager LanFabricImpl createLanFabric Command Injection Remote Code Execution Vulnerability Tested on: Cisco DCNM 11.2.1 ISO Virtual Appliance for VMWare, KVM and Bare-metal servers - Release: 11.21 - Release Date: 05-Jun-2019 - FileName:...

Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection

!/usr/bin/python """ Cisco Data Center Network Manager HostEnclHandler getVmHostData SQL Injection Remote Code Execution Vulnerability Tested on: Cisco DCNM 11.2.1 Installer for Windows 64-bit - Release: 11.21 - Release Date: 18-Jun-2019 - FileName: dcnm-installer-x64-windows.11.2.1.exe.zip - Siz...

RarmaRadio 2.72.4 - 'username' Denial of Service (PoC)

Exploit Title: RarmaRadio 2.72.4 - 'username' Denial of Service PoC Discovery by: chuyreds Discovery Date: 2020-02-05 Vendor Homepage: http://www.raimersoft.com/rarmaradio.html Software Link : http://www.raimersoft.com/downloads/rarmaradiosetup.exe Tested Version: 2.72.4 Vulnerability Type: Denia...

VIM 8.2 - Denial of Service (PoC)

Exploit Title: VIM 8.2 - Denial of Service PoC Date: 2019-12-17 Vulnerability: DoS Vulnerability Discovery: Dhiraj Mishra Vulnerable Version: VIM - Vi IMproved 8.2 Included patches: 1-131 Vendor Homepage: https://www.vim.org/ References:...

Online Job Portal 1.0 - 'user_email' SQL Injection

Exploit Title: Online Job Portal 1.0 - 'useremail' SQL Injection Dork: N/A Date: 2020-02-06 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html Software Link:...