ClipperCMS 1.3.3 - Cross-Site Request Forgery (File Upload)

ClipperCMS 1.3.3 - Cross-Site Request Forgery File Upload Exploit Title: ClipperCMS 1.3.3 File Upload CSRF Vulnerability Date: 2018-11-11 Exploit Author: Ameer Pornillos Website: http://ethicalhackers.club Vendor Homepage: http://www.clippercms.com/ Software Link:...

xorg-x11-server 1.20.1 - Local Privilege Escalation

xorg-x11-server 1.20.1 - Local Privilege Escalation Exploit Title: xorg-x11-server bolo console opened Building root shell wait 2 minutes crontab overwritten ... cut Xorg output ... Xorg killed II Server terminated successfully 0. Closing log file. Don't forget to cleanup /etc/crontab and /tmp di...

School Equipment Monitoring System 1.0 - login SQL Injection

School Equipment Monitoring System 1.0 - login SQL Injection Exploit Title: School Equipment Monitoring System 1.0 - 'login' SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

Sentrifugo HRMS 3.2 - deptid SQL Injection

Sentrifugo HRMS 3.2 - deptid SQL Injection Exploit Title: Sentrifugo HRMS 3.2 - 'deptid' SQL Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-08-26 Google Dork: N/A Vendor: http://www.sapplica.com Software Link: http://www.sentrifugo.com/download Affected Version...

JioFi 4G M2S 1.0.2 - Denial of Service (PoC)

JioFi 4G M2S 1.0.2 - Denial of Service PoC Exploit Title: JioFi 4G M2S 1.0.2 - Denial of Service PoC Exploit Author: Vikas Chaudhary Date: 2018-07-26 Vendor Homepage: https://www.jio.com/ Hardware Link:...

TP-Link TL-WR840N - Denial of Service

TP-Link TL-WR840N - Denial of Service Exploit Title:- TP-Link Wireless N Router WR840N - Buffer Overflow Date:- 2018-07-16 Vendor Homepage:- https://www.tp-link.com/ Hardware Link:- https://www.amazon.in/TP-LINK-TL-WR840N-300Mbps-Wireless-External/dp/B01A0G1J7Q Version:- TP-Link Wireless N Router...

Open-AudIT Community 2.1.1 - Cross-Site Scripting

Open-AudIT Community 2.1.1 - Cross-Site Scripting Exploit Title: Open-AudIT Community - 2.1.1 - Cross Site Scripting Vulnerability Google Dork:NA Exploit Author: Ranjeet Jaiswal Vendor Homepage: https://opmantek.com/ Software Link:http://dl-openaudit.opmantek.com/OAE-Win-x8664- release2.2.1.exe...

HRSALE The Ultimate HRM 1.0.2 - (Authenticated) Cross-Site Scripting

HRSALE The Ultimate HRM 1.0.2 - Authenticated Cross-Site Scripting Exploit Title: HRSALE The Ultimate HRM 1.0.2 - Authenticated Cross Site Scripting Date: 2018-04-23 Exploit Author: 8bitsec CVE: CVE-2018-10259 Vendor Homepage: https://codecanyon.net/ Software Link:...

Frog CMS 0.9.5 - Cross-Site Request Forgery (Add User)

Frog CMS 0.9.5 - Cross-Site Request Forgery Add User Exploit Title:​​ Cross Site Request Forgery- Frog CMS Date: 31-03-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://github.com/philippe/FrogCMS Versio...

WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure

WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure Exploit Title: WP Security Audit Log Plugin, Sensitive Information Disclosure CheckDirectory $useruploadpath wpmkdirp $useruploadpath ;...

Cisco node-jos 0.11.0 - Re-sign Tokens

Cisco node-jos 0.11.0 - Re-sign Tokens !/usr/bin/env python3 import base64 from urllib.parse import quoteplus import rsa import sys zi0Black ''' EDB Note: This has been updated https://github.com/offensive-security/exploitdb/pull/139 POC of CVE-2018-0114 Cisco node-jose = 8 return b::-1 def...

Suricata 4.0.4 - IDS Detection Bypass

Suricata 4.0.4 - IDS Detection Bypass ----------------------------------------------------- Vulnerability Type: Detection Bypass Affected Product: Suricata Vulnerable version: SYN Seq=0 Ack= 0 - Evil Server Client ACK Seq=1 Ack= 84 - Evil Server Client - PSH, ACK Seq=1 Ack= 84 - Evil Server IDS...

Joomla! Component JSP Tickets 1.1 - SQL Injection

Joomla! Component JSP Tickets 1.1 - SQL Injection Exploit Title: Joomla! Component JSP Tickets 1.1 - SQL Injection Dork: N/A Date: 04.02.2018 Vendor Homepage: http://joomlaserviceprovider.com/ Software Link:...

Disk Pulse Enterprise 10.1.18 - Denial of Service

Disk Pulse Enterprise 10.1.18 - Denial of Service Exploit Title: Disk Pulse Enterprise Server v10.1.18 - DOS, Date: 2017-10-20 Exploit Author: Ahmad Mahfouz Software Link: http://www.diskpulse.com/setups/diskpulsesrvsetupv10.1.18.exe Version: v10.1.18 Category; Windows Remote DOS CVE:...

PHPMyFAQ 2.9.8 - Cross-Site Scripting (3)

PHPMyFAQ 2.9.8 - Cross-Site Scripting 3 Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vulnerability Date: 28-9-2017 Exploit Author: Nikhil Mittal Payatu Labs Vendor Homepage: http://www.phpmyfaq.de/ Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip Version: 2.9.8 Tested on: MAC OS CVE :...

phpMyFAQ 2.9.8 - Cross-Site Scripting (2)

phpMyFAQ 2.9.8 - Cross-Site Scripting 2 Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vendor Homepage: http://www.phpmyfaq.de/ Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website:...

Subsonic 6.1.1 - Cross-Site Request Forgery

Subsonic 6.1.1 - Cross-Site Request Forgery + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SUBSONIC-PASSWORD-RESET-CSRF.txt + ISR: ApparitionSec Vendor: ================ www.subsonic.org Product: =============== subson...

Microsoft Windows 88.12012 R2 (x64) - EternalBlue SMB Remote Code Execution (MS17-010)

Microsoft Windows 88.12012 R2 x64 - EternalBlue SMB Remote Code Execution MS17-010 !/usr/bin/python from impacket import smb, ntlm from struct import pack import sys import socket ''' EternalBlue exploit for Windows 8 and 2012 by sleepya The exploit might FAIL and CRASH a target system depended o...

Halliburton LogView Pro 10.0.1 - Local Buffer Overflow (SEH)

Halliburton LogView Pro 10.0.1 - Local Buffer Overflow SEH !/usr/bin/python Exploit Title : Halliburton LogView Pro 10.0.1 - Local Buffer Overflow SEH Date : 2017-05-14 Exploit Author : Muhann4d CVE : CVE-2017-8926 Vendor Homepage : http://www.halliburton.com Software Link :...

Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free (PoC)

Linux Kernel 4.4.0 Ubuntu - DCCP Double-Free PoC // // EDB Note: More information http://seclists.org/oss-sec/2017/q1/471 // // A trigger for CVE-2017-6074, crashes kernel. // Tested on 4.4.0-62-generic 83-Ubuntu kernel. // https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074 // //...

Rumba FTP Client 4.x - Remote Stack Buffer Overflow (SEH)

Rumba FTP Client 4.x - Remote Stack Buffer Overflow SEH Exploit Title: Rumba FTP 4.x Client Stackoverflow SEH Date: 29-10-2016 Exploit Author: Umit Aksu Vendor Homepage: http://community.microfocus.com/microfocus/mainframesolutions/rumba/w/knowledgebase/28731.rumba-ftp-4-x-security-update.aspx...

Microsoft Windows - DFS Client Driver Arbitrary Drive Mapping Privilege Escalation (MS16-123)

Microsoft Windows - DFS Client Driver Arbitrary Drive Mapping Privilege Escalation MS16-123 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=885 Windows: DFS Client Driver Arbitrary Drive Mapping EoP Platform: Windows 10 10586, Edge 25.10586.0.0 not tested 8.1 Update 2 or Windo...

Django CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting

Django CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting Document Title: =============== Django CMS v3.3.0 - Editor Snippet Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1869 Security Release:...

NTPd ntp-4.2.6p5 - ctl_putdata() Buffer Overflow (PoC)

NTPd ntp-4.2.6p5 - ctlputdata Buffer Overflow PoC / Ntpd Based on: ntpq client from ntp package Provided for legal security research and testing purposes ONLY PoC DoS Denial of Service PoC. Will crash NTPd. You will need to know the KEY ID and MD5 password, for example put this in you ntp.conf...

TeamSpeak Client 3.0.18.1 - Remote File Inclusion Remote Code Execution

TeamSpeak Client 3.0.18.1 - Remote File Inclusion Remote Code Execution Exploit Title: "PwnSpeak" a 0day Exploit for TeamSpeak Client / 0x6FB30B11 my pgp keyid Vendor Homepage: https://www.teamspeak.com/ Application: TeamSpeak 3 Version: TeamSpeak3 Client 3.0.0 - 3.0.18.1 Platforms: Windows, Mac ...

XPCOM - Race Condition

XPCOM - Race Condition XPCOM Race Condition Vendor: Mozilla Product: XPCOM Version: Website: http://www.mozilla.org/projects/xpcom/ CVE: CVE-2005-2414 OSVDB: 18226 PACKETSTORM: 38837 Description: xpcom, or cross platform component object model is a framework for writing cross-platform, modular...

MiniUPnPd 1.0 (MIPS) - Remote Stack Overflow Remote Code Execution for AirTies RT Series

MiniUPnPd 1.0 MIPS - Remote Stack Overflow Remote Code Execution for AirTies RT Series !/usr/bin/env python Exploit Title: MiniUPnPd 1.0 Stack Overflow RCE for AirTies RT Series Date: 26.04.2015 Exploit Author: Onur ALANBEL BGA Vendor Homepage: http://miniupnp.free.fr/ Version: 1.0 Architecture:...

Microsoft Windows 8.1 (x86x64) - User Profile Service Privilege Escalation (MS15-003)

Microsoft Windows 8.1 x86x64 - User Profile Service Privilege Escalation MS15-003 Source: https://code.google.com/p/google-security-research/issues/detail?id=123 Platform: Windows 8.1 Update 32/64 bit No other OS tested When a user logs into a computer the User Profile Service is used to create...

Gitlist-0.4.0

Date: 06/20/2014 Vendor Homepage: http://gitlist.org/ Software link: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz Fixed in: 0.5.0 Tested on: Debian 7 More information: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/ from commands import getoutput import urllib import sys """ Exploi...

Varnish Cache CLI Interface - Remote Code Execution (Metasploit)

Varnish Cache CLI Interface - Remote Code Execution Metasploit This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Varnish Cache CLI Interface Bruteforce Utility', 'Description' = 'This...

Axway Secure Transport 5.1 SP2 - Arbitrary File Upload (via Cross-Site Request Forgery)

Axway Secure Transport 5.1 SP2 - Arbitrary File Upload via Cross-Site Request Forgery function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://sftp.example.org/api/v1.0/files/", true; xhr.setRequestHeader"Accept", "text/ht...

WordPress Plugin WooCommerce Store Exporter 1.7.5 - Multiple Cross-Site Scripting Vulnerabilities

WordPress Plugin WooCommerce Store Exporter 1.7.5 - Multiple Cross-Site Scripting Vulnerabilities Exploit Title: WooCommerce Store Exporter v1.7.5 Stored XSS Google Dork: inurl:"woocommerce-exporter" Date: 26/08/2014 Exploit Author: Mike Manzotti @ Dionach Vendor Homepage:...

Linux Kernel 3.2.0-233.5.0-23 (Ubuntu 12.0412.04.112.04.2 x64) - perf_swevent_init Local Privilege Escalation (3)

Linux Kernel 3.2.0-233.5.0-23 Ubuntu 12.0412.04.112.04.2 x64 - perfsweventinit Local Privilege Escalation 3 / Ubuntu 12.04 3.x x8664 perfsweventinit Local root exploit by Vitaly Nikolenko [email protected] based on semtex.c by sd Supported targets: 0 Ubuntu 12.04.0 - 3.2.0-23-generic 1 Ubuntu...

IBM Tealeaf CX 8.8 - Remote OS Command Injection

IBM Tealeaf CX 8.8 - Remote OS Command Injection IBM Tealeaf CX v8 release 8 Remote OS Command Injection Date: 11/08/2013 Exploit author: drone More information: http://www-01.ibm.com/support/docview.wss?uid=swg21667630 Vendor homepage: http://www-01.ibm.com/software/info/tealeaf/ Version: Versio...

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting

Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting !/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe...

Opsview pre 4.4.1 - Blind SQL Injection

Opsview pre 4.4.1 - Blind SQL Injection CVE-2013-5694 Blind SQL Injection in Ops View Versions: Opsview pre 4.4.1 Author: J. Oquendo joquendo at e-fensive dot net I. ADVISORY Title: Blind SQL Injection in OpsView Date published: 2013-10-28 Vendor contacted: 2013-09-04 II. BACKGROUND Opsview is a...

Moodle 2.3.82.4.5 - Multiple Vulnerabilities

Moodle 2.3.82.4.5 - Multiple Vulnerabilities Ciaran McNally Application: Moodle http://download.moodle.org/ Versions: parameter in an rss feed is vulnerable to javascript injection. This blog post is viewable by everyone on moodle and you can link to it directly. Upon clicking the "Link to origin...

Zoom Telephonics ADSL ModemRouter - Multiple Vulnerabilities

Zoom Telephonics ADSL ModemRouter - Multiple Vulnerabilities Five models of the Zoom Telephonics ADSL Modem/Router line suffer from multiple critical vulnerabilities, almost all being of a remote access attack vector. Models affected: Zoom X3 ADSL Modem/Router Zoom X4 ADSL Modem/Router Zoom X5 AD...

VMware Virtual Machine Communication Interface (VMCI) - vmci.sys

VMware Virtual Machine Communication Interface VMCI - vmci.sys / CVE-2013-1406 exploitation PoC by Artem Shishkin, Positive Research, Positive Technologies, 02-2013 / void stdcall FireShellDWORD dwSomeParam EscalatePrivilegeshProcessToElevate; // Equate the stack and quit the cycle ifndef AMD64 a...

Cisco DPC2100 - Denial of Service

Cisco DPC2100 - Denial of Service Exploit Title: Cisco DPC2100 Denial of Service Date: 09/01/2010 Author: Daniel Smith Software Link: http://www.cisco.com/ Version: HW:2.1/SW:v2.0.2r1256-060303 Tested on: OSX 10.6/Win7 CVE: CVE-2011-1613 =======================================================...

Elcom CMS 7.4.10 - Community Manager Insecure Arbitrary File Upload

Elcom CMS 7.4.10 - Community Manager Insecure Arbitrary File Upload Elcom CMS - Community Manager Insecure File Upload Vulnerability - Security Advisory - SOS-12-008 Release Date. 24-Aug-2012 Last Update. - Vendor Notification Date. 28-Oct-2011 Product. Elcom CMS - Community Manager Platform...

e-ticketing - SQL Injection

e-ticketing - SQL Injection 'e-ticketing' SQL Injection CVE-2012-1673 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in loginscript.php that allows for SQL injection of the 'username' and 'password' POST parameters. II. TEST...

phpMyAdmin 3.3.x3.4.x - Local File Inclusion via XML External Entity Injection (Metasploit)

phpMyAdmin 3.3.x3.4.x - Local File Inclusion via XML External Entity Injection Metasploit Exploit Title: poc-phpmyadmin-local-file-inclusion-via-xxe-injection Date: 12-01-2012 Author: Marco Batista Blog Link:...

Adobe Reader 5.1 - XFDF Buffer Overflow (SEH)

Adobe Reader 5.1 - XFDF Buffer Overflow SEH Exploit Title: Adobe Reader 5.1 XFDF Buffer Overflow Vulnerability SEH Google Dork: N/A or filtype ".xfdf" Date: 04/01/2011 Author: [email protected] / http://extraexploit.blogspot.com Software Link: http://www.oldversion.com/download/acrobat51.exe...

cubecart 2.0.7 - Multiple Vulnerabilities

cubecart 2.0.7 - Multiple Vulnerabilities Exploit Title: CubeCart 2.0.7 XSS && Remote SQL Injection = Multiple Vulnerabilities Date: June, 14th 2011 GMT +7 Author: Shamus Software Link: http://www.cubecart.com/ Version : CubeCart 2.0.7 Tested on: windows 7, ubuntu 11.04 CVE : -...

Pointter PHP Content Management System - Unauthorized Privilege Escalation

Pointter PHP Content Management System - Unauthorized Privilege Escalation 'Pointter PHP Content Management System' Unauthorized Privilege Escalation CVE-2010-4332 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in the...

Camtron CMNC-200 IP Camera - Denial of Service

Camtron CMNC-200 IP Camera - Denial of Service Finding 5: Camera Denial of Service CVE: CVE-2010-4234 The CMNC-200 IP Camera has a built-in web server that is vulnerable to denial of service attacks. Sending multiple requests in parallel to the web server may cause the camera to reboot. Requests...

LibSMI smiGetNode - Buffer Overflow When Long OID Is Given In Numerical Form

LibSMI smiGetNode - Buffer Overflow When Long OID Is Given In Numerical Form -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ LibSMI smiGetNode Buffer Overflow When Long OID Is Given In Numerical Form 1. Advisory...

JaMP Player 4.2.2.0 - Denial of Service

JaMP Player 4.2.2.0 - Denial of Service Exploit Title: JaMP Player v4.2.2.0 .m3u DoS Date: 12 / 8 / 2010 Author: Oh Yaw Theng Software Link: http://www.topdownloads.net/software/jamp-player2219088.html?hl=&ia=0 Version: v4.2.2.0 Tested on: Windows XP SP 2 CVE : N / A !/usr/bin/python filename =...

vBulletin 3.8.6 - faq.php Information Disclosure

vBulletin 3.8.6 - faq.php Information Disclosure 010101010101010101010101010101010101010101010101010101010 0 0 1 Iranian Datacoders Security Team 2010 0 0 010101010101010101010101010101010101010101010101010101010 Original Advisory:...