VLC media player 2.2.8 - Arbitrary Code Execution (PoC)

VLC media player 2.2.8 - Arbitrary Code Execution PoC Exploit Title: VLC media player 2.2.8 - Arbitrary Code Execution PoC Date: 2018-06-06 Exploit Author: Eugene Ng Vendor Homepage: https://www.videolan.org/vlc/index.html Software Link:...

EasyService Billing 1.0 - Cross-Site Scripting

EasyService Billing 1.0 - Cross-Site Scripting !-- Exploit Title: EasyService Billing 1.0 Cross-Site Scripting in 'q' Parameter Date: 25-05-2018 Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 Exploit Author: Divya Jain Versio...

Apache CouchDB 1.7.0 2.x 2.1.1 - Remote Privilege Escalation

Apache CouchDB 1.7.0 2.x 2.1.1 - Remote Privilege Escalation !/usr/bin/env python ''' @author: r4wd3r @license: MIT License @contact: [email protected] ''' import argparse import re import sys import requests parser = argparse.ArgumentParser description='Exploits the Apache CouchDB JSON Remote...

D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting

D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting Exploit Title: D-Link DIR-615 Wireless Router - Persistent Cross Site Scripting XSS Date: 14.04.2018 Exploit Author: Sayan Chatterjee Vendor Homepage: http://www.dlink.co.in Hardware Link: http://www.dlink.co.in/products/?pid=678...

WordPress Plugin File Upload 4.3.2 - Stored Cross-Site Scripting

WordPress Plugin File Upload 4.3.2 - Stored Cross-Site Scripting Exploit Title: WordPress Plugin WordPress File Upload 4.3.2 - Stored XSS Date: 31/03/2018 Exploit Author: ManhNho Vendor Homepage: https://www.iptanus.com/ Software Link: https://downloads.wordpress.org/plugin/wp-file-upload.zip...

WebRTC - Private IP Leakage (Metasploit)

WebRTC - Private IP Leakage Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Private IP Leakage to WebPage using WebRTC Function.", 'Description' = %q This module exploits a...

MikroTik RouterOS 6.38.4 (MIPSBE) - Chimay Red Stack Clash Remote Code Execution

MikroTik RouterOS 6.38.4 MIPSBE - Chimay Red Stack Clash Remote Code Execution !/usr/bin/env python3 Mikrotik Chimay Red Stack Clash Exploit by BigNerd95 Tested on RouterOS 6.38.4 mipsbe using a CRS109 Used tools: pwndbg, rasm2, mipsrop for IDA I used ropper only to automatically find gadgets ASL...

D-Link DIR-600M Wireless - Cross-Site Scripting

D-Link DIR-600M Wireless - Cross-Site Scripting Exploit Title: D-Link DIR-600M Wireless - Persistent Cross Site Scripting Date: 11.02.2018 Vendor Homepage: http://www.dlink.co.in Hardware Link: http://www.dlink.co.in/products/?pid=DIR-600M Category: Hardware Exploit Author: Prasenjit Kanti Paul...

Parallels Remote Application Server 15.5 - Path Traversal

Parallels Remote Application Server 15.5 - Path Traversal Exploit Title: Parallels Remote Application Server RAS 15.5 Path Traversal Date: 22-02-2018 Exploit Author: Nicolas Markitanis - RUNESEC Reviewers: Simon Loizides and Marios Nicolaides - RUNESEC Vendor Homepage: https://www.parallels.com/...

Ability Mail Server 3.3.2 - Cross-Site Scripting

Ability Mail Server 3.3.2 - Cross-Site Scripting Exploit Title: Ability Mail Server 3.3.2 Persistent Cross Site Scripting XSS CVE: CVE-2017-17752 Date: 19-12-2017 Software Link: http://download.codecrafters.com/ams3.exe Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr...

Ametys CMS 4.0.2 - Password Reset

Ametys CMS 4.0.2 - Password Reset Vulnerability Summary The following advisory describes a password reset vulnerability found in Ametys CMS version 4.0.2 Ametys is “a free and open source content management system CMS written in Java. It is based on JSR-170 for content storage, Open Social for...

HitmanPro 3.7.15 Build 281 - Kernel Pool Overflow

HitmanPro 3.7.15 Build 281 - Kernel Pool Overflow Exploit-CVE-2017-6008 The CVE-2017-6008 is a vulnerability in the HitmanPro scan that allows privilege escalation by exploiting a kernel pool buffer overflow. The exploits here use the Quota Process Pointer Overwrite attack as described in the...

INFOR EAM 11.0 Build 201410 - filtervalue SQL Injection

INFOR EAM 11.0 Build 201410 - filtervalue SQL Injection SQL injection in INFOR EAM V11.0 Build 201410 search fields web/base/.. via filtervalue parameter ------------------- Assigned CVE: CVE-2017-7952 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to any page with ...

D-Link DIR-615 - Cross-Site Request Forgery

D-Link DIR-615 - Cross-Site Request Forgery Title: ==== D-Link DIR 615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery CSRF vulnerability Credit: ====== Name: Pratik S. Shah Reference: ========= CVE Details: CVE-2017-7398. Date: ==== 1-04-2017 Vendor: ====== D-Link wireless router...

Pixie 1.0.4 - Arbitrary File Upload

Pixie 1.0.4 - Arbitrary File Upload Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege Google Dork: no Date: 02-April-2017 Exploit Author: @runggareksya, @dvnrcy, @dickysofficial Vendor Homepage: http://www.getpixie.co.uk Software Link:...

Car Workshop System - SQL Injection

Car Workshop System - SQL Injection Exploit Title: Car Workshop System - SQL Injection Google Dork: N/A Date: 13.03.2017 Vendor Homepage: http://prosoft-apps.com/ Software: https://codecanyon.net/item/car-workshop-system/19562074 Demo: http://workshop.prosoft-apps.com/ Version: N/A Tested on: Win...

Nintendo Switch - WebKit Code Execution (PoC)

Nintendo Switch - WebKit Code Execution PoC CVE-2016-4657 Switch PoC body font-size: 2em; a text-decoration: none; color: 000; a:hover color: f00; font-weight: bold; CVE-2016-4657 Nintendo Switch PoC go! reload waiting... click go. // display JS errors as alerts. Helps debugging. window.onerror =...

Synchronet BBS 3.16c - Denial of Service

Synchronet BBS 3.16c - Denial of Service Exploit Title: Synchronet BBS 3.16c for Windows – Multiple vulnerabilities Date: 2017-02-28 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: ftp://synchro.net/Synchronet/sbbs316c.zip Version: 3.16c for Windows Teste...

F5 BIG-IP 11.6 SSL Virtual Server - Ticketbleed Memory Disclosure

F5 BIG-IP 11.6 SSL Virtual Server - Ticketbleed Memory Disclosure -- coding: utf-8 -- !/usr/bin/python Exploit Title: Ticketbleed Google Dork: n/a Date: Exploit: 02/13/17, Advisory Published: 02/09/17 Exploit Author: @0x00string Vendor Homepage: https://f5.com/ Software Link:...

Crestron AM-100 - Multiple Vulnerabilities

Crestron AM-100 - Multiple Vulnerabilities ================================================================= Crestron AM-100 Multiple Vulnerabilities ================================================================= Date: 2016-08-01 Exploit Author: Zach Lanier Vendor Homepage:...

Oracle BI Publisher 11.1.1.6.011.1.1.7.011.1.1.9.012.2.1.0.0 - XML External Entity Injection

Oracle BI Publisher 11.1.1.6.011.1.1.7.011.1.1.9.012.2.1.0.0 - XML External Entity Injection Exploit Title: Oracle BI Publisher formerly XML Publisher - XML External Entity Injection w/o authentication Date: 20\10\2016 Exploit Author: Jakub Palaczynski CVE : CVE-2016-3473 Vendor Homepage:...

SolarWinds Virtualization Manager - Local Privilege Escalation

SolarWinds Virtualization Manager - Local Privilege Escalation Product: Solarwinds Virtualization Manager Vendor: Solarwinds Vulnerable Versions: 6.3.1 Tested Version: 6.3.1 Vendor Notification: April 25th, 2016 Vendor Patch Availability to Customers: June 1st, 2016 Public Disclosure: June 14th,...

Google Android Broadcom Wi-Fi Driver - Memory Corruption

Google Android Broadcom Wi-Fi Driver - Memory Corruption / Copyright C 2016 by AbdSec Core Team This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, ...

QSEE - PRDiag* Commands Privilege Escalation

QSEE - PRDiag Commands Privilege Escalation Sources: https://bits-please.blogspot.ca/2016/05/qsee-privilege-escalation-vulnerability.html https://github.com/laginimaineb/cve-2015-6639 Qualcomm's Secure Execution Environment QSEE Privilege Escalation Exploit using PRDiag commands CVE-2015-6639 Pro...

glibc - getaddrinfo Stack Buffer Overflow (PoC)

glibc - getaddrinfo Stack Buffer Overflow PoC Sources: https://googleonlinesecurity.blogspot.sg/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html https://github.com/fjserna/CVE-2015-7547 Technical information: glibc reserves 2048 bytes in the stack through alloca for the DNS answer at...

Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (MS16-008) (2)

Microsoft Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux MS16-008 2 Source: https://code.google.com/p/google-security-research/issues/detail?id=589 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux 2 Platform: Windows 8.1, not tested any other OS...

TECO AP-PCLINK 1.094 - .tpc File Handling Buffer Overflow (PoC)

TECO AP-PCLINK 1.094 - .tpc File Handling Buffer Overflow PoC TECO AP-PCLINK 1.094 TPC File Handling Buffer Overflow Vulnerability Vendor: TECO Electric and Machinery Co., Ltd. Product web page: http://www.teco-group.eu Download: http://globalsa.teco.com.tw/supportdownload.aspx?KindID=9 Affected...

FAROL - SQL Injection

FAROL - SQL Injection Exploit Title: Web Application Farol with anauthenticated SQLi injection Date: 2015-09-16 Exploit Author: Thierry Fernandes Faria a.k.a SoiL thierryfariaa at gmail dot com Vendor Homepage:http://www.teiko.com.br/pt/solucoes/infraestrutura-em-ti/farol Version: All CVE :...

Kemp Load Master 7.1.16 - Multiple Vulnerabilities

Kemp Load Master 7.1.16 - Multiple Vulnerabilities Exploit Title: Kemp Load Master - Multiple Vulnerabilities RCE, CSRF, XSS, DoS Date: 01 April 2015 Author: Roberto Suggi Liverani Software Link: http://kemptechnologies.com/load-balancer/ Version: 7.1.16 and previous versions Tested on: Kemp Load...

python-socket.recvfrom_into()

Exploit Author: @sha0coder Vendor Homepage: python.org Version: python2.7 and python3 Tested on: linux 32bit + python2.7 CVE : CVE-2014-1912 import struct def offo: return struct.pack'L',o reverseIP = '\xc0\xa8\x04\x34' '\xc0\xa8\x01\x0a' reversePort = '\x7a\x69' shellcode from exploit-db.com,...

ZTE ZXHN H108L - Authentication Bypass (1)

ZTE ZXHN H108L - Authentication Bypass 1 Exploit Title: ZTE ZXHN H108L Authentication Bypass Date: 14/11/2014 Exploit Author: Project Zero Labs https://projectzero.gr | [email protected] Vendor Homepage: www.zte.com.cn Version: ZXHN H108LV4.0.0dZRQGR4 Tested on: ZTE ZXHN H108L CVE : CVE-2014-84...

glibc - NUL Byte gconv_translit_find Off-by-One

glibc - NUL Byte gconvtranslitfind Off-by-One // // Full Exploit: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/34421.tar.gz CVE-2014-5119.tar.gz // // // --------------------------------------------------- // CVE-2014-5119 glibc gconvtranslitfind exploit //...

ZTE WXV10 W300 - Multiple Vulnerabilities

ZTE WXV10 W300 - Multiple Vulnerabilities Exploit Title: ZTE WXV10 W300 Multiple Vulnerabilities Date: 17-05-2014 Server Version: RomPager/4.07 UPnP/1.0 Tested Routers: ZTE ZXV10 W300 Firmware: W300V1.0.0aZRDLK ADSL Firmware: FwVer:3.11.2.175TC3086 HwVer:T14.F75.0 Tested on: Kali Linux x8664...

Alienvault Open Source SIEM (OSSIM) 4.7.0 - av-centerd get_log_line() Remote Code Execution

Alienvault Open Source SIEM OSSIM 4.7.0 - av-centerd getlogline Remote Code Execution Exploit Title: AlienVault OSSIM uri'AV/CC/Util' - proxy'https://172.26.22.2:40007/av-centerd' - getlogline'All', '423d7bea-cfbc-f7ea-fe52-272ff7ede3d2' ,'172.26.22.1', 'test', '/var/log/auth.log', '1;id;' -...

Skybox Security 6.3.x 6.4.x - Multiple Information Disclosures

Skybox Security 6.3.x 6.4.x - Multiple Information Disclosures Exploit Title: SKYBOX Security – Multiple Information Disclosure Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.1...

GOM Player 2.2.57.5189 - .ogg Crash (PoC)

GOM Player 2.2.57.5189 - .ogg Crash PoC ''' Exploit Title: Gomplayer Memory Corruption vulnerability latest Version 2.2.57.5189 Date: 2014/05/06 Exploit Author: Aryan Bayaninejad Linkedin : https://www.linkedin.com/profile/view?id=276969082 Vendor Homepage: www.gomlab.com Software Link:...

Galil-RIO Modbus - Denial of Service

Galil-RIO Modbus - Denial of Service Exploit Title: Galil RIO-47100 Date: 05-01-2013 Exploit Author: Sapling Vendor Homepage: www.galilmc.com Version: Rio Firmware Prior to 1.1d CVE : CVE-2013-0699 ICSA: ICSA-13-116-01 / There are many different ways to crash this PLC but most of them are...

ASUS RT-AC66U - acsd Remote Command Execution

ASUS RT-AC66U - acsd Remote Command Execution !/usr/bin/env python import signal, struct from time import sleep from socket import from sys import exit, excinfo TitleASUS RT-AC66U Remote Root Shell Exploit - acsd param command Discovered and ReportedJune 2013 Discovered/Exploited ByJacob...

Simple PHP Agenda 2.2.8 - edit_event.php?eventid SQL Injection

Simple PHP Agenda 2.2.8 - editevent.php?eventid SQL Injection ============================================= WEBERA ALERT ADVISORY 02 - Discovered by: Anthony Dubuissez - Severity: high - CVE Request – 05/06/2013 - CVE Assign – 06/06/2013 - CVE Number – CVE-2013-3961 - Vendor notification –...

vBulletin Yet Another Awards System 4.0.2 - SQL Injection

vBulletin Yet Another Awards System 4.0.2 - SQL Injection Exploit Title: vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day Google Dork: inurl:awards.php intext:"powered by vbulletin" Date: 29/08/12 Exploit Author: Backsl@sh/Dan Software Link:...

Microsoft Windows - .fon Kernel-Mode Buffer Overrun (PoC) (MS11-077)

Microsoft Windows - .fon Kernel-Mode Buffer Overrun PoC MS11-077 Exploit Title: MS11-077 .fon buffer overrun kernel-mode drivers exploit Google Dork: if relevant �we will automatically add these to the GHDB Date: 10/12/2011 Author: Byoungyoung Lee, http://www.cc.gatech.edu/blee303/ Software Link:...

HP Data Protector (HP-UX) - Remote Shell

HP Data Protector HP-UX - Remote Shell !/bin/bash Exploit Title: HP Data Protector Remote Shell for HPUX Date: 2011-08-02 Author: Adrian Puente Z. Software Link:http://www8.hp.com/us/en/software/software- product.html?compURI=tcm:245-936920&pageTitle=data-protector Version: 0.9 Tested on: HPUX CV...

ClanSphere 2010 - Multiple Vulnerabilities

ClanSphere 2010 - Multiple Vulnerabilities Exploit Title: Clansphere Multiple vulnerabilities Date: 24/08/2010 Author: Sweet Contact : [email protected] Software Link: Download:http: http://sourceforge.net/projects/clansphere/ Version: all Tested on: WinXp sp3 Risk : HIGHT...

Ucenter Projekt 2.0 - Insecure crossdomain (Cross-Site Scripting)

Ucenter Projekt 2.0 - Insecure crossdomain Cross-Site Scripting ======================================================================================== | Title : Ucenter Projekt 2.0 Insecure crossdomain XSS Vulnerability | Author : indoushka | email : [email protected] | Home :...

Elkagroup - SQL Injection

Elkagroup - SQL Injection Dork : "powered by: elkagroup" + |SadHaCkEr|\ + ||||\ + ||||""|", + ||||""|"||| + " @''@""""""|@@@ +========================================================================================================================================|| About : elkagroup SQL Injection...

ClanWeb 1.4.2 - Remote Change Password Add Admin

ClanWeb 1.4.2 - Remote Change Password Add Admin =-=-remote change password and add admin xpl-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script:ClanWeb 1.4.2 ------------------------------------------------- Author: ahmadbady my site :Coming Soon...

LoudBlog 0.8.0a - ajax.php SQL Injection

LoudBlog 0.8.0a - ajax.php SQL Injection !/usr/bin/perl This Exploit requires a valid user name and password of an account regardless of the permissions Author: Xianur0 Affected: All Versions Bug: SQL Injection Doorks: allintext: "powered by LoudBlog" use HTTP::Request::Common qwPOST; use...

NASM 2.0 - ppscan() Off-by-One Buffer Overflow

NASM 2.0 - ppscan Off-by-One Buffer Overflow source: https://www.securityfocus.com/bid/29656/info NASM is prone to an off-by-one buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue will allow...

Smoothflash - cid SQL Injection

Smoothflash - cid SQL Injection Powered by Smoothflash SQL injection Powered by Newartonline AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 BLOG : http://my.opera.com/SQL-Injection/blog/ MAiL : [email protected] DORK 1 : "Powered by Smoothflash" DORK 2 : allinurl:...

XOOPS Module eEmpregos - cid SQL Injection

XOOPS Module eEmpregos - cid SQL Injection XOOPS Module eEmpregos SQL Injectioncid AUTHOR : S@BUN HOME 1 : http://www.milw0rm.com/author/1334 MAÄ°L : [email protected] DORK 1 : allinurl: "modules/eEmpregos/index.php" DORK 2 : allinurl: cid "modules/eEmpregos" example...