Acronis True Image OEM 19.0.5128 - afcdpsrv Unquoted Service Path

Acronis True Image OEM 19.0.5128 - afcdpsrv Unquoted Service Path Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Date: 2019-11-11 Author: Alejandra Sánchez Vendor Homepage: https://www.acronis.com Software:...

MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting

MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting Exploit Title: MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting Date: 3/8/2019 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1231 Version: 1.32 Tested on: Ubuntu...

NetData 1.13.0 - HTML Injection

NetData 1.13.0 - HTML Injection Author: Marcelo Vázquez aka s4vitar NetData v1.13.0 HTML Injection Vulnerability Exploit Title: NetData v1.13.0 HTML Injection Vulnerability Date: 2019-03-14 Exploit Author: Marcelo Vázquez aka s4vitar Collaborators: Victor Lasa aka vowkin Vendor Homepage:...

Navicat for Oracle 12.1.15 - _Password_ Denial of Service (PoC)

Navicat for Oracle 12.1.15 - Password Denial of Service PoC Exploit Title: Navicat for Oracle 12.1.15 - "Password" Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2019-02-14 Vendor Homepage: https://www.navicat.com/es/ Software Link:...

PrinterOn Enterprise 4.1.4 - Arbitrary File Deletion

PrinterOn Enterprise 4.1.4 - Arbitrary File Deletion Exploit Author: bzyo CVE: CVE-2018-19936 Twitter: @bzyo Exploit Title: PrinterOn Enterprise 4.1.4 - Arbitrary File Deletion Date: 12-07-18 Vulnerable Software: PrinterOn Enterprise 4.1.4 Vendor Homepage: https://www.printeron.com/ Version: 4.1....

Adobe ColdFusion 2018 - Arbitrary File Upload

Adobe ColdFusion 2018 - Arbitrary File Upload Exploit Title: Unrestricted file upload in Adobe ColdFusion 2018 Google Dork: ext:cfm Date: 10-12-2018 Exploit Author: Pete Freitag of Foundeo Reversed: Vahagn vah13 Vardanian Vendor Homepage: adobe.com Version: 2018 Tested on: Adobe ColdFusion 2018 C...

PHP 5.2.3 imap (Debian Based) - imap_open Disable Functions Bypass

PHP 5.2.3 imap Debian Based - imapopen Disable Functions Bypass /tmp/test0001 $server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh"; imapopen''.$server.':143/imapINBOX', '', '' or die"\n\nError: ".imaplasterror;...

School Attendance Monitoring System 1.0 - SQL Injection

School Attendance Monitoring System 1.0 - SQL Injection Exploit Title: School Attendance Monitoring System 1.0 - SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

FLIR Brickstream 3D+ - RTSP Stream Disclosure

FLIR Brickstream 3D+ - RTSP Stream Disclosure FLIR Systems FLIR Brickstream 3D+ Unauthenticated RTSP Stream Disclosure Vendor: FLIR Systems, Inc. Product web page: http://www.brickstream.com Affected version: Firmware: 2.1.742.1842 Api: 1.0.0 Node: 0.10.33 Onvif: 0.1.1.47 Summary: The Brickstream...

Faleemi Desktop Software 1.8.2 - Device alias Local Buffer Overflow (SEH)

Faleemi Desktop Software 1.8.2 - Device alias Local Buffer Overflow SEH Exploit Title: Faleemi Desktop Software 1.8.2 - 'Device alias' Local Buffer Overflow SEH Author: Gionathan "John" Reale Discovey Date: 2018-09-25 Software Link: http://support.faleemi.com/fsc776/Faleemiv1.8.exe Tested Version...

Episerver 7 patch 4 - XML External Entity Injection

Episerver 7 patch 4 - XML External Entity Injection Exploit Title: Episerver 7 patch 4 - XML External Entity Injection Google Dork: N/A Date: 2018-08-28 Exploit Author: Jonas Lejon Vendor Homepage: https://www.episerver.se/ Version: Episerver 7 patch 4 and below CVE : N/A episploit.py - Blind XXE...

Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery (Admin Bypass)

Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery Admin Bypass Exploit Title: Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery Admin Bypass Date: 2018-07-25 Software Link: https://world.trivum-shop.de https://world.trivum-shop.de/ Version: 9.34 build 13381 - 12.07.18...

WUZHI CMS 4.1.0 - Cross-Site Request Forgery

WUZHI CMS 4.1.0 - Cross-Site Request Forgery Exploit Title: WUZHI CMS 4.1.0 - Cross-Site Request Forgery Date: 2018-04-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE:...

CloudMe Sync 1.11.0 - Local Buffer Overflow

CloudMe Sync 1.11.0 - Local Buffer Overflow Exploit Title: Local Buffer Overflow on CloudMe Sync v1.11.0 Date: 08.03.2018 Vendor Homepage: https://www.cloudme.com/en Software Link: https://www.cloudme.com/downloads/CloudMe1110.exe Category: Local Exploit Discovery: Prasenjit Kanti Paul Web:...

Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 170109) - Access Control Bypass

Hikvision IP Camera versions 5.2.0 - 5.3.9 Builds 140721 170109 - Access Control Bypass Exploit Title: Hikvision IP Camera versions 5.2.0 - 5.3.9 Builds: 140721 - 170109 Backdoor Date: 15-03-2018 Vendor Homepage: http://www.hikvision.com/en/ Exploit Author: Matamorphosis Category: Web Apps...

Sony Playstation 4 (PS4) 4.55 5.50 - WebKit Code Execution (PoC)

Sony Playstation 4 PS4 4.55 5.50 - WebKit Code Execution PoC window.didload = 0; window.didpost = 0; window.onload = function window.didload = 1; if window.didpost == 1 window.stage2; window.postExpl = function window.didpost = 1; if window.didload == 1 window.stage2; function makeid var text = "...

EPIC MyChart - X-Path Injection

EPIC MyChart - X-Path Injection Exploit Title: Epic Systems Corporation MyChart X-Path Injection Google Dork: MyChart® licensed from Epic Systems Corporation Date: 8/19/16 Exploit Author: Shayan Sadigh http://threat.tevora.com/author/shayan/ Vendor Homepage: https://www.epic.com/software Software...

Accesspress Anonymous Post Pro 3.2.0 - Arbitrary File Upload

Accesspress Anonymous Post Pro 3.2.0 - Arbitrary File Upload Exploit Title: Unauthenticated Arbitrary File Upload Date: November 12, 2017 Exploit Author: Colette Chamberland Author contact: [email protected] Author homepage: https://defiant.com Vendor Homepage: https://accesspressthemes.com/...

Linux Kernel 4.13 (Ubuntu 17.10) - waitid() SMEPSMAPChrome Sandbox Privilege Escalation

Linux Kernel 4.13 Ubuntu 17.10 - waitid SMEPSMAPChrome Sandbox Privilege Escalation // Proof of concept exploit for waitid bug introduced in Linux Kernel 4.13 // By Chris Salls twitter.com/chrissalls // This exploit can be used to break out out of sandboxes such as that in google chrome // In thi...

WordPress Plugin Participants Database 1.7.5.10 - Cross-Site Scripting

WordPress Plugin Participants Database 1.7.5.10 - Cross-Site Scripting Exploit Title: Wordpress Plugin Participants Database 1.7.5.10 - XSS Google Dork: inurl:wp-content/plugins/participants-database/ Date: 01-Sep-17 Exploit Author: Benjamin Lim Vendor Homepage: https://xnau.com/ Software Link:...

Sungard eTRAKiT3 3.2.1.17 - SQL Injection

Sungard eTRAKiT3 3.2.1.17 - SQL Injection Software: Sungard eTRAKiT3 Version: 3.2.1.17 and possibly lower CVE: CVE-2016-6566 https://www.kb.cert.org/vuls/id/846103 Vulnerable Component: Login page Description ================ The login form is vulnerable to blind SQL injection by an unauthenticat...

Mozilla Firefox 53 - gfxTextRun Out-of-Bounds Read

Mozilla Firefox 53 - gfxTextRun Out-of-Bounds Read .class1 float: left; white-space: pre-line; .class2 border-bottom-style: solid; font-face: Arial; font-size: 7ex; function go menuitem.appendChilddocument.body.firstChild; canvas.toBlobcallback; function callback var s = menu.style;...

Dmitry 1.3a - Local Buffer Overflow (PoC)

Dmitry 1.3a - Local Buffer Overflow PoC Exploit Title: DmitryDeepmagic Information Gathering Tool Local Stack Buffer Overflow CVE: CVE-2017-7938 CWE: CWE-119 Exploit Author: Hosein Askari FarazPajohan Vendor HomePage: http://mor-pah.net/software/dmitry-deepmagic-information-gathering-tool/ Versio...

Evostream Media Server 1.7.1 (x64) - Denial of Service

Evostream Media Server 1.7.1 x64 - Denial of Service Exploit Title: Evostream Media Server 1.7.1 – Built-in Webserver DoS Date: 2017-03-07 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: https://evostream.com/software-downloads/ Version: 1.7.1 Tested on:...

SwiftMailer 5.4.5-DEV - Remote Code Execution

SwiftMailer 5.4.5-DEV - Remote Code Execution 09607 09607 09607 See the full advisory URL for the exploit details. / // Attacker's input coming from untrusted source such as $GET , $POST etc. // For example from a Contact form with sender field $emailfrom = '"attacker" -oQ/tmp/...

PHPMailer 5.2.20 - Remote Code Execution

PHPMailer 5.2.20 - Remote Code Execution !/usr/bin/python intro = """ PHPMailer RCE PoC Exploits PHPMailer " postfields = 'action':...

GNU Wget 1.18 - Access List Bypass Race Condition

GNU Wget 1.18 - Access List Bypass Race Condition ''' ============================================= - Discovered by: Dawid Golunski - dawidatlegalhackers.com - https://legalhackers.com - https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html - CVE-2016-7098 -...

Symantec Messaging Gateway 10.6.1 - Directory Traversal

Symantec Messaging Gateway 10.6.1 - Directory Traversal Title : Symantec Messaging Gateway = 10.6.1 Directory Traversal Date : 28/09/2016 Author : R-73eN Tested on : Symantec Messaging Gateway 10.6.1 Latest Software : https://www.symantec.com/products/threat-protection/messaging-gateway Vendor :...

Joomla! Component com_videogallerylite 1.0.9 - SQL Injection

Joomla! Component comvideogallerylite 1.0.9 - SQL Injection Title: Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla Author: Larry W. Cashdollar, @larry0 Date: 2016-09-15 Download Site: http://huge-it.com/joomla-video-gallery/ Vendor: www.huge-it.com, fixed v1.1.0 Vendor...

ZKTeco ZKAccess Professional 3.5.3 - Insecure File Permissions Privilege Escalation

ZKTeco ZKAccess Professional 3.5.3 - Insecure File Permissions Privilege Escalation ZKTeco ZKAccess Professional 3.5.3 Insecure File Permissions Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.5.3 Build 00...

ADOdb 4.71 - Cross Site Scripting

ADOdb 4.71 - Cross Site Scripting ADOdb Cross Site Scripting Vendor: John Lim Product: ADOdb Version: currpage = $SESSION$currpage; The above code is taken from adodb-pager.inc.php @ lines 72-77 and ultimately set's the $this-currpage variable to unsanitized user supplied input. Later on this...

WordPress Plugin Community Events 1.3.5 - SQL Injection

WordPress Plugin Community Events 1.3.5 - SQL Injection ======================================================================= title: SQL Injection product: WordPress Community Events Plugin vulnerable version: 1.3.5 and probably below fixed version: 1.4 CVE number: CVE-2015-3313 impact: CVSS Ba...

SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities

SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities Document Title: =============== SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1314 Release Date: ============= 2015-03-23 Vulnerability Laboratory I...

Ultra Electronics 7.2.0.197.4.0.7 - Multiple Vulnerabilities

Ultra Electronics 7.2.0.197.4.0.7 - Multiple Vulnerabilities Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities Release Date: 02-Oct-2014 Software: Ultra Electronics - Series A...

Linux Kernel 3.13 - SGID Privilege Escalation

Linux Kernel 3.13 - SGID Privilege Escalation / CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC Vitaly Nikolenko http://hashcrack.org Usage: ./poc filepath where filepath is the file on which you want to set the sgid bit / define GNUSOURCE include include include include include include...

D-Link DSL-2740B - Multiple Cross-Site Request Forgery Vulnerabilities

D-Link DSL-2740B - Multiple Cross-Site Request Forgery Vulnerabilities +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : D-Link DSL-2740B ADSL Router CSRF Vulnerability Date : 09-08-2013 Author : Ivan...

Adobe Reader X 10.1.4.38 - .BMP.RLE Heap Corruption

Adobe Reader X 10.1.4.38 - .BMP.RLE Heap Corruption ''' Title: Adobe Reader X BMP/RLE heap corruption Product: Adobe Reader X Version: 10.x Product Homepage: adobe.com Binary affected: AcroForm.api Binary Version: 10.1.4.38 Binary MD5: 8e0fc0c6f206b84e265cc3076c4b9841 Configuration Requirements...

WordPress Plugin WP-SendSms 1.0 - Multiple Vulnerabilities

WordPress Plugin WP-SendSms 1.0 - Multiple Vulnerabilities ============================================================= \ \ / / | | / \ / | | \ \ V / | | | | | | | | | / \ | ' \ | | | | | | | | | | | | '| | / / . \ | | | | | | || | | | | | | | | | // \ | ./ || / || || |/ || | | ||...

Linux Kernel 3.8.9 (x86-64) - perf_swevent_init Local Privilege Escalation (2)

Linux Kernel 3.8.9 x86-64 - perfsweventinit Local Privilege Escalation 2 / CVE-2013-2094 exploit x8664 Linux include include include include include include include include include define BASE 0x380000000 define BASEJUMP 0x1780000000 define SIZE 0x10000000 define KSIZE 0x2000000 define TMPx...

LiquidXML Studio 2012 - ActiveX Insecure Method Executable File Creation

LiquidXML Studio 2012 - ActiveX Insecure Method Executable File Creation var sofa = "..\..\..\..\..\..\..\..\..\Documents and Settings\All Users\Start Menu\Programs\Startup\thedoctorisin.hta"; var king = "Oh noz, Look what DrIDE did... var x=new ActiveXObject"WScript.Shell";...

mnoGoSearch 3.3.12 (search.cgi) - Arbitrary File Read

mnoGoSearch 3.3.12 search.cgi - Arbitrary File Read ----------------------------------------------------------- PT-2013-17 Positive Technologies Security Advisory Arbitrary Files Reading in mnoGoSearch ----------------------------------------------------------- --- Vulnerable software mnoGoSearch...

glossword 1.8.12 - Multiple Vulnerabilities

glossword 1.8.12 - Multiple Vulnerabilities =================================================== Vulnerable Software: Glossword 1.8.12 Tested version: Glossword 1.8.12 Download: http://sourceforge.net/projects/glossword/files/glossword/1.8.12/ Vulns: XSS && Database Backup Disclosure && CSRF &&...

XnView 1.99.1 - .JLS File Decompression Heap Overflow

XnView 1.99.1 - .JLS File Decompression Heap Overflow SUMMARY XnView Formats PlugIn is prone to an overflow condition. The JLS Plugin xjpegls.dll library fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted JLS compressed image file, a...

Able2Extract and Able2Extract Server 6.0 - Memory Corruption

Able2Extract and Able2Extract Server 6.0 - Memory Corruption Exploit Title: Able2Extract and Able2Extract Server v 6.0 Memory Corruption Date: June 24 2012 Exploit Author: Carlos Mario Penagos Hollmann Vendor Homepage: www.investintech.com Version:6.0 Tested on: Windows 7 CVE : cve-2011-4222...

TORCS 1.3.2 - .xml File Buffer Overflow SafeSEH Evasion

TORCS 1.3.2 - .xml File Buffer Overflow SafeSEH Evasion / Exploit Title: TORCS Research Team Division Author: Andres Gomez and David Mora a.k.a Mighty-D ... Pwn and beans! Software Link: http://torcs.sourceforge.net/ Version: torcs 1.3.2 Vendor notified: 03/02/2012 Tested on: Windows XP Service...

SWAT Samba Web Administration Tool - Cross-Site Request Forgery

SWAT Samba Web Administration Tool - Cross-Site Request Forgery Thanks & Regards, Narendra. Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the...

Native Instruments Massive 1.1.4 - KSD File Handling Use-After-Free

Native Instruments Massive 1.1.4 - KSD File Handling Use-After-Free !/usr/bin/perl Title: Native Instruments Massive 1.1.4 KSD File Handling Use-After-Free Vulnerability Vendor: Native Instruments GmbH Product web page: http://www.native-instruments.com Affected version: 1.1.4 R1901 Summary:...

wpQuiz 2.7 - Authentication Bypass

wpQuiz 2.7 - Authentication Bypass Powered by wpQuiz - Auth bypass Vulnerability My + Author : KnocKout + Greatz : DaiMon Contact : [email protected] Software info Script : wpQuiz Version : 2.7 Download : http://webscripts.softpedia.com/script/Quizz/wpQuiz-41098.html Vulnerability Style : Auth...

APBoard 2.1.0 - board.php?id SQL Injection

APBoard 2.1.0 - board.php?id SQL Injection APBoard 2.1.0 / board.php?id= SQL Injection Author : secret - [email protected] Homepage : http://swissfaking.net/ Date : 05 August, 2010 / // // // \ / // / / // \ / | / |/ / \ \ / / / / / , // / / / / / / , // | / / //// ///||// //////||//...

Joomla! Component cinema - SQL Injection

Joomla! Component cinema - SQL Injection ========================================================= Exploit Title: joomla component cinema SQL injection Vulnerability Date: 09 juny 2010 Author: Suddendeath [email protected] Software Link: N/A Tested on: Windows XP 2 Platform / Tested on:...