PHPFox - Persistent Cross-Site Scripting

PHPFox - Persistent Cross-Site Scripting Exploit Title: PHPFox XSS AdminCP Date: 2014-10-22 Exploit Author: Wesley Henrique Leite aka "spyk2r" Vendor Homepage: http://www.moxi9.com Version: All version CVE : CVE-2014-8469 Response Vendor: fixed 2014-10-23 to v4 Beta + DESCRIPTION The system store...

Microsoft Office 20072010 - OLE Arbitrary Command Execution

Microsoft Office 20072010 - OLE Arbitrary Command Execution Full exploit: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/35216.rar CVE-2014-6352 OLE Remote Code Execution Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Advanced Hacking...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor...

phpMyFAQ 2.8.x - Multiple Vulnerabilities

phpMyFAQ 2.8.x - Multiple Vulnerabilities Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specif...

Collabtive 1.2 - Persistent Cross-Site Scripting

Collabtive 1.2 - Persistent Cross-Site Scripting Vulnerability title: Stored XSS vulnerability in Collabtive application CVE-2014-3247 CVE: CVE-2014-3247coordinated with cve assigning team and vendor Vendor: Collabtive Product: Collabtive Open Source Project Management Software Affected version:...

Collabtive 1.2 - SQL Injection

Collabtive 1.2 - SQL Injection Vulnerability title: SQL Injection / SQL Error message in Collabtive application CVE-2014-3246 CVE: CVE-2014-3246 cordinated with Vendor: Collabtive Product: Collabtive Open Source Project Management Software Affected version: 1.12 Fixed version: 2.0 Reported by:...

Microsoft Internet Explorer 10 - CMarkup Use-After-Free (MS14-012)

Microsoft Internet Explorer 10 - CMarkup Use-After-Free MS14-012 mxmlc.exe AsXploit.as -o AsXploit.swf Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/32851-AsXploit.as -- var garr = ; var arrLen = 0x250; function dword2datadword var d =...

ZTE ZXV10 W300 Router - Hard-Coded Credentials

ZTE ZXV10 W300 Router - Hard-Coded Credentials Exploit Title: ZTE ZXV10 W300 router contains hardcoded credentials Date: 03 Feb 2014 Exploit Author: Cesar Neira Vendor Homepage: http://wwwen.zte.com.cn/ Version: ZTE ZXV10 W300 v2.1 CVE : CVE-2014-0329 Dork Shodan: Basic realm="index.htm"...

davfs2 1.4.61.4.7 - Local Privilege Escalation

davfs2 1.4.61.4.7 - Local Privilege Escalation davfs2 1.4.6/1.4.7 local privilege escalation exploit Bug Description: davfs2 is a Linux utility which allows OS users to mount a remote webdav server as a local partition. The bug is well documented at...

Oracle Hyperion 11 - Directory Traversal

Oracle Hyperion 11 - Directory Traversal ======= Summary ======= Name: Oracle Hyperion 11 - Directory Traversal Release Date: 30 July 2013 Reference: NGS00434 Discoverer: Richard Warren Vendor: Oracle Vendor Reference: S0318807 Systems Affected: Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier,...

Ettercap 0.7.5.1 - Stack Overflow

Ettercap 0.7.5.1 - Stack Overflow Title: Ettercap Stack overflow CWE-121 References: CVE-2012-0722 Discovered by: Sajjad Pourali Vendor: http://www.ettercap.sourceforge.net/ Vendor contact: 13-01-01 21:20 UTC No response Solution: Using the patch Patch:...

ManageEngine Security Manager Plus 5.5 build 5505 - Remote SYSTEM SQL Injection (Metasploit)

ManageEngine Security Manager Plus 5.5 build 5505 - Remote SYSTEM SQL Injection Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...

am4ss Support System 1.2 - PHP Code Injection

am4ss Support System 1.2 - PHP Code Injection 10/2011 , Vulnerability discovered till now , i haven't reported the vendor , why!!! The idiot backdoored it by himself + the official site is fucked up ; 19/07/2012 , Public Disclosured C:\labphp am4ss.php localhost /lab/am4ss/...

Symantec pcAnywhere 12.5.0 - Login Password Remote Buffer Overflow

Symantec pcAnywhere 12.5.0 - Login Password Remote Buffer Overflow !/usr/bin/python Exploit Title: Symantec PcAnywhere login and password field buffer overflow Date: 2012.06.27 Author: S2 Crew Hungary Software Link: symantec.com Version: 12.5.0 Tested on: Windows XP SP2 CVE: CVE-2011-3478 EDB Not...

GNUBoard 4.33.02 - tp.php?PATH_INFO SQL Injection

GNUBoard 4.33.02 - tp.php?PATHINFO SQL Injection Exploit Title: Gnuboard = 4.33.02 PATHINFO SQL INJECTION Vulnerability Google Dork: inurl:gnuboard4/bbs/board.php Date: 2011-2-14 Author: flyh4t Software Link: http://sir.co.kr/main/gnuboard4/ Version: Gnuboard = 4.33.02 Tested on: linux+apache CVE...

Microsoft Windows - TCPIP Stack Denial of Service (MS11-064)

Microsoft Windows - TCPIP Stack Denial of Service MS11-064 Exploit Title: MS11-064 : Vulnerabilities in TCP/IP Stack Could Allow Denial of Service Date: 10/12/2011 Author: Byoungyoung Lee, http://www.cc.gatech.edu/blee303/ Version: Windows 7 32bit, fully patched until Aug 2011 Tested on: Windows ...

Kahf Poems 1.0 - Multiple Vulnerabilities

Kahf Poems 1.0 - Multiple Vulnerabilities + Title : Kahf Poems V1.0 guestbook.php SQL Injection + Name : Kahf Poems + Affected Version : v1.0 + Software Link : http://www.traidnt.net/vb/traidnt19736/ + Tested on : L:Vista & Windows Xp and Windows 7 + Date : 13/08/2011 + Dork : "intitle:Kahf Poems...

Cisco Security Agent Management Console - st_upload Remote Code Execution

Cisco Security Agent Management Console - stupload Remote Code Execution !/usr/bin/env python Exploits Cisco Security Agent Management Console ‘stupload’ CVE-2011-0364 gerry eisenhaur import httplib import mimetools import StringIO boundary = mimetools.chooseboundary hostuid =...

Ruby on Rails 3.0.5 - WEBrick::HTTPRequest Module HTTP Header Injection

Ruby on Rails 3.0.5 - WEBrick::HTTPRequest Module HTTP Header Injection source: https://www.securityfocus.com/bid/46423/info Ruby on Rails is prone to a vulnerability that allows attackers to inject arbitrary content into the 'X-Forwarded-For', 'X-Forwarded-Host' and 'X-Forwarded-Server' HTTP...

UMI CMS 2.8.1.2 - Multiple Cross-Site Scripting Vulnerabilities

UMI CMS 2.8.1.2 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/46280/info UMI CMS is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

J-Integra 2.11 - ActiveX SetIdentity() Buffer Overflow

J-Integra 2.11 - ActiveX SetIdentity Buffer Overflow //payload is windows/exec cmd=calc.exe shellcode = unescape '%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+...

Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow

Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow Finding 1: Buffer Overflow in ActiveX Control CVE: CVE-2010-4230 The CMNC-200 IP Camera ActiveX control identified by CLSID DD01C8CA-5DA0-4B01-9603-B7194E561D32 is vulnerable to a stack overflow on the first argument of the connect method. The...

Adobe Flash - ActionIf Integer Denial of Service

Adobe Flash - ActionIf Integer Denial of Service Adobe Flash Integer Overflow Author: Matthew Bergin Date: June 15, 2010 Versions Affected: Flash10e.ocx v10.0.45.2 Flash10c.ocx v10.0.32.18 r32 Root Cause: ActionScript, "ActionIf" Affect: Denial-of-Service, possible Command Execution CVE:...

PreProject Multi-Vendor Shopping Malls - SQL Injection

PreProject Multi-Vendor Shopping Malls - SQL Injection Source: Pre Multi-Vendor Shopping Malls SQL Injection Vulnerability Download: http://preproject.com/products.asp Dork: inurl:Powered by: PreProjects + detail.php?prodid=694 Author: [email protected] Exploit :...

HP Operations Manager 8.16 - srcvw4.dll LoadFile()SaveFile() Remote Unicode Stack Overflow (PoC)

HP Operations Manager 8.16 - srcvw4.dll LoadFileSaveFile Remote Unicode Stack Overflow PoC !-- |------------------------------------------------------------------| | | | / / / / | | / / / / / / / \ / / / / \ | | / // // / / / / / // / / / / / // / // / / / / / / | | /// //,// // //,// //...

Joomla! Component com_rwcards - Local File Inclusion

Joomla! Component comrwcards - Local File Inclusion Author : altbta [email protected] Team : Sec Attack Team Home : www.v4-team.com/cc Script : Joomla Component comrwcards Bug Type : Local File Inclusion LFI Dork : inurl:"comrwcards" === Exploit ===...

Azadi Network - page SQL Injection

Azadi Network - page SQL Injection | | | Azadi Network page Remote SQL Injection Vulnerability | |-------------------- Hussin X ------------------- | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email : darkangelg85atYahooDoTcom | | | | script : www.azadinet.net | | DorK : "Powered By Azadi...

SitioOnline - SQL Injection

SitioOnline - SQL Injection - cvs -vrew ! SitioOnline SQL Injection Vulnerability ! Author : 4lG3r14n0-t3r0 ! MAIL : [email protected] / Software Information + Vendor : http://www.SitioOnline.cl + script : SitioOnline + Download : + Vulnerability : php SQL injection + Dork...

WordPress Plugin WP-Polls 2.x - Incorrect Flood Filter

WordPress Plugin WP-Polls 2.x - Incorrect Flood Filter Exploit Title: WP-Polls 2.x Incorrect Flood Filter Date: 30/11/2009 Author: Jbyte jbyte-security.blogspot.com Software Link: http://lesterchan.net/wordpress/readme/wp-polls.html Version: 2.x Tested on: Windows 7/windows xp/ ubuntu 9.04/ ubunt...

Wyse Rapport Hagent Fake Hserver - Command Execution (Metasploit)

Wyse Rapport Hagent Fake Hserver - Command Execution Metasploit $Id: hagentuntrustedhsdata.rb 10998 2010-11-11 22:43:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

pam-krb5 3.13 - Local Privilege Escalation

pam-krb5 3.13 - Local Privilege Escalation / cve-2009-0360.c pam-krb5 http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0360 pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which...

DMXReady Registration Manager 1.1 - Contents Change

DMXReady Registration Manager 1.1 - Contents Change Title : DMXReady Registration Manager http://target/path//applications/RegistrationManager/incregistrationmanager.asp Edit - http://target/path//admin/RegistrationManager/addcategory.asp : milw0rm.com 2009-01-14...

ICONICS Vessel Gauge Switch 8.02.140 - ActiveX Buffer Overflow (Metasploit)

ICONICS Vessel Gauge Switch 8.02.140 - ActiveX Buffer Overflow Metasploit $Id: iconicsdlgwrapper.rb 1 2008-09-21 22:43:00Z kf $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

jPORTAL 2 - humor.php SQL Injection

jPORTAL 2 - humor.php SQL Injection . . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z - beenu -QKrun1x-P47tr1ck - FeDeReR -MAGE...

OpenBSD 4.0 - vga Local Privilege Escalation

OpenBSD 4.0 - vga Local Privilege Escalation / A PRODUCTION OF LUL-DISLCOSURE INC. PROUDLY PRESENTS... 888 888 888 888 888 888 .d88b. 88888b. .d88b. 88888b. 88888b. .d8888b .d88888 d88""88b 888 "88b d8P Y8b 888 "88b 888 "88b 88K d88" 888 888 888 888 888 88888888 888 888 888 888 "Y8888b. 888 888...

Dovecot IMAP 1.0.10 1.1rc2 - Remote Email Disclosure

Dovecot IMAP 1.0.10 1.1rc2 - Remote Email Disclosure lame Dovecot IMAP 1.0.10 - 1.1rc3 Exploit Here's an exploit for the recent TAB vulnerability in Dovecot. It's nothing special since in the wild there are few to none targets because of the special option which has to be set. see CVE Entry...

PHP Webquest 2.6 - Get Database Credentials

PHP Webquest 2.6 - Get Database Credentials --==+================================================================================+==-- --==+ PHP Webquest 2.6 Get Database's Credential +==-- --==+================================================================================+==-- Author: MhZ91...

Move Media Player 1.0 Quantum Streaming - ActiveX Control Multiple Buffer Overflow Vulnerabilities

Move Media Player 1.0 Quantum Streaming - ActiveX Control Multiple Buffer Overflow Vulnerabilities source: https://www.securityfocus.com/bid/25529/info Move Media Player is prone to multiple remote buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplie...

vBulletin Mod RPG Inferno 2.4 - inferno.php SQL Injection

vBulletin Mod RPG Inferno 2.4 - inferno.php SQL Injection --==+================================================================================+==-- --==+ RPG Inferno v2.4 SQL Injection Vulnerability +==-- --==+================================================================================+==--...

Vivotek Motion Jpeg Control - MjpegDecoder.dll 2.0.0.13 Remote Overflow

Vivotek Motion Jpeg Control - MjpegDecoder.dll 2.0.0.13 Remote Overflow ' metasploit one, alpha2... add a user 'sun' with pass 'tzu' FRAGMENT =...

Buzlas 2006-1 Full - Archive_Topic.php Remote File Inclusion

Buzlas 2006-1 Full - ArchiveTopic.php Remote File Inclusion source: https://www.securityfocus.com/bid/20511/info Buzlas is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the...

X11R6 6.4 XKEYBOARD (SolarisSPARC) - Local Buffer Overflow (2)

X11R6 6.4 XKEYBOARD SolarisSPARC - Local Buffer Overflow 2 / $Id: raptorxkb.c,v 1.1 2006/09/13 16:18:36 raptor Exp $ raptorxkb.c - XKEYBOARD Strcmp, Solaris/SPARC 8/9/10 Copyright c 2006 Marco Ivaldi Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and...

Simple Machines Forum (SMF) 1.1 rc2 - Lock Topics

Simple Machines Forum SMF 1.1 rc2 - Lock Topics !/usr/bin/php -q -d shortopentag=on 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i;...

Microsoft Internet Explorer - createTextRang Remote (Metasploit)

Microsoft Internet Explorer - createTextRang Remote Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core...

Mall23 - AddItem.asp SQL Injection

Mall23 - AddItem.asp SQL Injection source: https://www.securityfocus.com/bid/14898/info Mall23 is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of t...

Ethereal 10.x - AFP Protocol Dissector Remote Format String

Ethereal 10.x - AFP Protocol Dissector Remote Format String / etherealv0.10.: AFP remote format string exploit. by: vade79/v9 [email protected] fakehalo/realhalo compile: gcc xethereal-afp-fmt.c -o xethereal-afp-fmt ethereal homepage/url: http://www.ethereal.com syntax: ./xethereal-afp-fmt -spSrPanc...

osTicket 1.21.3 - Multiple Input Validation Remote Code Injection Vulnerabilities

osTicket 1.21.3 - Multiple Input Validation Remote Code Injection Vulnerabilities source: https://www.securityfocus.com/bid/13478/info osTicket is affected by multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input...

OpenFTPd 0.30.1 - message system Remote Shell

OpenFTPd 0.30.1 - message system Remote Shell / shouts to mitakeet :D exploit for openftpd format string bug. tested on most current version only. -infamous42md AT hotpop DOT com is real email only tricky part is find a place to stick the shell, as there isn't enough room to send it with the form...

Coppermine Photo Gallery 1.2.0 RC4 - init.inc.php Remote File Inclusion

Coppermine Photo Gallery 1.2.0 RC4 - init.inc.php Remote File Inclusion source: https://www.securityfocus.com/bid/10253/info Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because t...

Laurent Adda Les Commentaires 2.0 - PHP Script derniers_commentaires.php Remote File Inclusion

Laurent Adda Les Commentaires 2.0 - PHP Script dernierscommentaires.php Remote File Inclusion source: https://www.securityfocus.com/bid/9536/info It has been reported that Les Commentaires may be prone to a file include vulnerability in various modules, that may allow an attacker to include...