Microsoft Exchange ProxyNotShell Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Exchange ProxyNotShell RCE', 'Description' = %q This module chains two vulnerabilities on Microsoft Exchange Server that, when combined...

SaltStack Salt REST API Arbitrary Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SaltStack Salt REST API Arbitrary Command Execution', 'Description' = %q This module exploits an authentication bypass and command injection in...

RiteCMS 3.1.0 Arbitrary File Deletion

Exploit Title: RiteCMS 3.1.0 - Arbitrary File Deletion Authenticated Date: 25/07/2021 Exploit Author: faisalfs10x https://github.com/faisalfs10x Vendor Homepage: https://ritecms.com/ Software Link: https://github.com/handylulu/RiteCMS/releases/download/V3.1.0/ritecms.v3.1.0.zip Version: = 3.1.0...

Mobile Shop System 1.0 SQL Injection

Title: Mobile Shop System v1.0 - SQLi lead to authentication bypass Exploit Author: Moaaz Taha 0xStorm Date: 2020-09-08 Vendor Homepage: https://www.sourcecodester.com/php/14412/mobile-shop-system-php-mysql.html Software Link:...

UltimatePHPBoard.txt

Ultimate PHP Board UPB Security Advisory By : Morinex e-mail : morinexatmarocmafia com date : 13-05-2k5 shoutz : w00pie.nl Target : Ultimate PHP Board UPB Vulnerable Versions: v. 1.8 until v 1.9.6 URL : http://www.myupb.com - http://www.myupb.com/forum/ Tested Localhost , Myupb.com. UPB is a...

Tiki Wiki CMS Groupware 25.0 Cross Site Request Forgery

------------------------------------------------------------------------------ Tiki Wiki CMS Groupware = 25.0 Two Cross-Site Request Forgery Vulnerabilities ------------------------------------------------------------------------------ - Software Link: https://tiki.org - Affected Versions: Versio...

Obehotel CMS Denial Of Service / SQL Injection

OBEHOTEL Spanish CMS Blind SQLinjection / Apache httpd Remote Denial of Service / Directory Listing / Insecure transition from HTTPS to HTTP in form post I-VULNERABILITY ------------------------- Title: OBEHOTEL CMS Blind SQLinjection / Apache httpd Remote Denial of Service / Directory Listing /...

IDT PC Audio 1.0.6499.0 Unquoted Service Path

Exploit Title: IDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service Path Discovery by: Diego Cañada Software link: https://www.pconlife.com/download/otherfile/20566/90674cffc8658c4f2bf58d43bb9b7ccb/ Discovery Date: 2020-12-03 Tested Version: 1.0.6499.0 Vulnerability Type: Unquoted Service Path...

TP-Link TL-WR841N Command Injection

Exploit Title: TP-Link TL-WR841N - Command Injection Date: 2020-12-13 Exploit Author: Koh You Liang Vendor Homepage: https://www.tp-link.com/ Software Link: https://static.tp-link.com/TL-WR841NJPV13161028.zip Version: TL-WR841N 0.9.1 4.0 Tested on: Windows 10 CVE : CVE-2020-35575 import requests...

ISPConfig 3.2.11 PHP Code Injection

------------------------------------------------------------------------ ISPConfig = 3.2.11 languageedit.php PHP Code Injection Vulnerability ------------------------------------------------------------------------ - Software Link: https://www.ispconfig.org - Affected Versions: Version 3.2.11 and...

Microsoft Windows Local Spooler Bypass

Windows: Local Spooler CVE-2020-1337 Bypass One way of exploiting this on Windows 10 2004 is to understand that FileNormalizedNameInformation will fail if the new path after the mount point is not under the root directory of the server. For example the admin$ share points to c:\windows. If you se...

ZoneMinder Snapshots Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ZoneMinder Snapshots Command Injection', 'Description' = %q This module exploits an unauthenticated command injection in zoneminder that can be...

PHP-FPM 7.x Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PHP-FPM Underflow RCE', 'Description' = %q This module exploits an underflow vulnerability in versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and...

📄 Flask 3.0.0 Remote Code Execution

Flask version 3.0.0 suffers from multiple remote code execution vulnerabilities. Exploit Title: Flask 3.0.0 CookApp - Multiple Unauthenticated RCE Vulnerabilities Date: 2024-12-05 Exploit Author: nu11secur1ty Vendor Homepage: https://flask.palletsprojects.com/ Software Link:...

WordPress Slider Revolution 4.x.x Shell Upload

================================================================================================= | Title : WordPress - Slider Revolution 4.x.x WordPress - arbitrary file upload exploit | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.064-bit | |...

Postfix SMTP Shellshock

!/bin/python Exploit Title: Shellshock SMTP Exploit Date: 10/3/2014 Exploit Author: fattymcwopr Vendor Homepage: gnu.org Software Link: http://ftp.gnu.org/gnu/bash/ Version: 4.2.x " argc = lensys.argv ifargc 3: usage sys.exit0 rport = 25 rhost = sys.argv1 cmd = sys.argv2 headers = "To",...

Linux 6.6 Race Condition

Summary I found a security-relevant race between mremap and THP code. Reaching the buggy code typically requires the ability to create unprivileged namespaces. The bug leads to installing physical address 0 as a page table, which is likely exploitable in several ways: For example, triggering the...

CMS Made Simple 2.2.15 Cross Site Scripting

Exploit Title: CMS Made Simple 2.2.15 - Stored Cross-Site Scripting via SVG File Upload Authenticated Date: 04/12/2020 Exploit Author: Eshan Singh Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads Version: cmsms v2.2.15 Tested on: Windows/Kali...

📄 Microsoft SQL Server 2016 / 2017 / 2019 / 2022 Privilege Escalation

Microsoft SQL Server versions 2016, 2017, 2019, and 2022 suffer from a database privilege escalation vulnerability from ALTER ANY LOGIN To SYSADMIN. Title: MSSQL Database Privilege Elevation From ALTER ANY LOGIN To SYSADMIN Product: Microsoft SQL Server Vendor: Microsoft Affected Versions: SQL...

ZoneMinder XSS / CSRF / File Disclosure / Authentication Bypass

========================================================================== Product: ZoneMinder Versions: Multiple versions - see inline Vulnerabilities: File disclosure, XSS, CSRF, Auth bypass & Info disclosure CVE-IDs: CVE-2017-5595, CVE-2017-5367, CVE-2017-5368, CVE-2016-10140 Author: John...

SIGE 3.4.1 / 3.5.3 Pro Cross Site Scripting / Remote File Inclusion

Document Title: =============== SIGE Joomla 3.4.1 & 3.5.3 Pro - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2265 Release Date: ============= 2020-11-11 Vulnerability Laboratory ID VL-ID: ====================================...

Xmind 2020 Cross Site Scripting / Code Execution

Exploit Title: Xmind 2020 XSS to RCE Exploit Author: TaurusOmar Twitter:@TaurusOmar HomePage:taurusomar.com Date: May 4th, 2021 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Risk: High 8.8 Vendor Homepage: https://www.xmind.net/ Version: 2020 Tested on: Windows, Linux, MacOs Software Description:...

Tableau Server Open Redirection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-032 Product: Tableau Server Manufacturer: Tableau Software, LLC, a Salesforce Company Affected Versions: 2019.4-2019.4.17, 2020.1-2020.1.13, 2020.2-2020.2.10, 2020.3-2020.3.6, 2020.4-2020.4.2 Tested Versions: 2020.2.1...

MS12-020 Microsoft Remote Desktop Checker

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MS12-020 Microsoft Remote Desktop Checker', 'Description' = %q This module checks a range of hosts for the MS12-020 vulnerability. This does not...

MobileIron Log4Shell Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MobileIron Core Unauthenticated JNDI Injection RCE via Log4Shell', 'Description' = %q MobileIron Core is affected by the Log4Shell vulnerability...

Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution', 'Description' = %q This module exploits a series of vulnerabilities to...

Qualcomm Adreno/KGSL Data Leakage

Qualcomm Adreno/KGSL: pages can be freed to page pool while having GPU references on !CONFIGQCOMKGSLUSESHMEM Tested on a Pixel 4 again with a slightly outdated version of KGSL. I ordered a Pixel 5a but don't have it yet... On KGSL builds where CONFIGQCOMKGSLUSESHMEM is not set or on older KGSL...

Android Binder Use-After-Free

CVE-2019-2215 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=414885 Samsung S7 and S7 Edge with Kernel 3.18.x seem not vulnerable could be however, with more work with PoC adjustments. Could not see more,...

PHP CGI Argument Injection Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PHP CGI Argument Injection Remote Code Execution', 'Description' = %q This module exploits a PHP CGI argument injection vulnerability affecting P...

VMware vRealize Operations Manager Server-Side Request Forgery / Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMware vRealize Operations vROps Manager SSRF RCE', 'Description' = %q This module exploits a pre-auth SSRF CVE-2021-21975 and post-auth file wri...

Redis Lua Sandbox Escape

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Redis Lua Sandbox Escape', 'Description' = %q This module exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The vulnerability was...

ipTIME DHCP Remote Command Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: 127 ipTIME router models vulnerable to an unauthenticated RCE by sending a crafted DHCP request Advisory URL: https://pierrekim.github.io/advisories/2015-iptime-0x02.txt Blog URL:...

Krpano Panorama Viewer 1.20.8 Cross Site Scripting

Exploit Title: XSS in krpano Panorama Viewer Google Dork: inurl:krpano.html Date: 10/05/2020 Exploit Author: Adriano Marcio Monteiro @adrianomarcmont Exploit Author Site: https://www.brztec.com Exploit Author E-mail: [email protected] Exploit Author Packetstorm Bio:...

Phoenix Contact TC Router / TC Cloud Client Command Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authenticated Command Injection product: Phoenix Contact TC Router & TC Cloud Client vulnerable version: =2.05.3 & =2.03.17 & =1.03.17 fixed version: 2.05.4 & 2.03.18 &...

Navy Federal Cross Site Scripting

Vendor ------------------------------------------------- Navy Federal - https://www.navyfederal.org/ Product ------------------------------------------------- Front pubic facing application Credit ------------------------------------------------- Arthrocyber http://arthrocyber.com/research/findin...

BeyondTrust Remote Code Execution

This exploit achieves unauthenticated remote code execution against BeyondTrust Privileged Remote Access PRA and Remote Support RS, with the privileges of the site user of the targeted BeyondTrust product site. This exploit targets PRA and RS versions 24.3.1 and below. This module requires...

Maltrail 0.53 Remote Code Execution

Exploit Title: Maltrail v0.53 - Unauthenticated Remote Code Execution RCE Exploit Author: Iyaad Luqman K init6 Application: Maltrail v0.53 Tested on: Ubuntu 22.04 CVE: CVE-2023-27163 PoC import sys; import os; import base64; def main: listeningIP = None listeningPORT = None targetURL = None if...

Elasticsearch ECE 7.13.3 Database Disclosure

Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump Date: 2021-07-21 Exploit Author: Joan Martinez @magichk Vendor Homepage: https://www.elastic.co/ Software Link: https://www.elastic.co/ Version: = 7.10.0 to = 7.13.3 Tested on: Elastic ECE Cloud CVE : CVE-2021-22146 Reference:...

TP-Link Cloud Cameras NCXXX Bonjour Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TP-Link Cloud Cameras NCXXX Bonjour Command Injection', 'Description' = %q TP-Link cloud cameras NCXXX series NC200, NC210, NC220, NC230, NC250,...

Zontal Arcade HTML 5 Game Portal PHP Script SQL Injection

Zontal Arcade HTML 5 Game Portal PHP Script suffers from a remote SQL injection vulnerability. This software does not list a version but was reported as of March 05, 2025 to be vulnerable. Exploit Title: Zontal Arcade HTML 5 Game Portal PHP Script - SQL Injection Date: 05-03-2025 Exploit Author:...

sudo 1.9.12p1 Privilege Escalation

!/usr/bin/env bash Exploit Title: sudo 1.8.0 to 1.9.12p1 - Privilege Escalation Exploit Author: n3m1.sys CVE: CVE-2023-22809 Date: 2023/01/21 Vendor Homepage: https://www.sudo.ws/ Software Link: https://www.sudo.ws/dist/sudo-1.9.12p1.tar.gz Version: 1.8.0 to 1.9.12p1 Tested on: Ubuntu Server 22.0...

Huawei HedEx Lite (DM) Path Traversal

Document Title: =============== Huawei HedEx Lite DM - Path Traversal Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2268 Release Date: ============= 2020-11-24 Vulnerability Laboratory ID VL-ID: ====================================...

Glibc Tunables Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 561, '3602eac894717d56555552c84fc6b0e4d6a4af72' = 561, 'a99db3715218b641780b04323e4ae5953d68a927' = 561, 'a8daca28288575ffc8c7641d40901b0148958fb1...

Dirty Pipe Local Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Dirty Pipe Local Privilege Escalation via CVE-2022-0847', 'Description' = %q This exploit targets a vulnerability in the Linux kernel since 5.8,...

MariaDB 10.2 Command Execution

Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through...

Microsoft Windows WebDAV BSoD Proof Of Concept

/ Source: https://github.com/koczkatamas/CVE-2016-0051 Proof-of-concept BSoD Blue Screen of Death code for CVE-2016-0051 MS-016. Full Proof of Concept: https://github.com/koczkatamas/CVE-2016-0051/archive/master.zip...

WordPress WPtouch Pro 3.3.4 Open Redirection

==================================================================================================================================== | Title : WordPress - WPtouch Pro: 3.3.4 Open Redirect Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

VestaCP 0.9.8-26 Token Session

Document Title: =============== VestaCP v0.9.8-26 - LoginAs Token Session Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2240 Release Date: ============= 2020-11-26 Vulnerability Laboratory ID VL-ID: ====================================...

FortiLogger Arbitrary File Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FortiLogger Arbitrary File Upload Exploit', 'Description' = %q This module exploits an unauthenticated arbitrary file upload via insecure POST...

Microsoft Exchange Server DlpUtils AddTenantDlpPolicy Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE', 'Description' = %q This vulnerability allows remote attackers to execute arbitrary co...