WordPress Pie Register 3.7.1.4 Authentication Bypass / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'WordPress Plugin Pie Register Auth Bypass to RCE', 'Description' = %q This module uses an authentication bypass vulnerability i...

Dynojet Power Core 2.3.0 Unquoted Service Path

Exploit Title: Dynojet Power Core 2.3.0 - Unquoted Service Path Exploit Author: Pedro Sousa Rodrigues https://www.0x90.zone/ / @PedroSECR Version: 2.3.0 Build 303 Date: 30.10.2021 Vendor Homepage: https://www.dynojet.com/ Software Link: https://docs.dynojet.com/Document/18762 Tested on: Windows 1...

YouTube Video Grabber 1.9.9.1 Buffer Overflow

Exploit Title: YouTube Video Grabber 1.9.9.1 - Buffer Overflow SEH Date: 01.11.2021 Software Link: https://www.litexmedia.com/ytgrabber.exe Exploit Author: Achilles Tested Version: 1.9.9.1 Tested on: Windows 7 64bit 1.- Run python code : YouTube.py 2.- Open EVIL.txt and copy All content to...

Codiad 2.8.4 Shell Upload

Exploit Title: Codiad 2.8.4 - Remote Code Execution Authenticated 4 Author: P4p4M4n3 Vendor Homepage: http://codiad.com/ Software Links : https://github.com/Codiad/Codiad/releases Type: WebApp ------------------------------------- Proof of Concept: 1- login on codiad 2- go to...

PHPJabbers Simple CMS 5 Cross Site Scripting

Document Title: =============== PHPJabbers Simple CMS v5 - Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2300 Release Date: ============= 2021-10-28 Vulnerability Laboratory ID VL-ID: ====================================...

Trojan.Win32.Phires.zm Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/34fb086a88f3a2506b61a17cced3b476.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Phires.zm Vulnerability: Insecure Permissions Description: The malware creates an dir...

My Movie Collection Sinatra App Movie Cross Site Scripting

Document Title: =============== My Movie Collection Sinatra App - Movie XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2294 Release Date: ============= 2021-11-01 Vulnerability Laboratory ID VL-ID: ====================================...

My Movie Collection Sinatra App Login Cross Site Scripting

Document Title: =============== My Movie Collection Sinatra App - Login XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2293 Release Date: ============= 2021-11-01 Vulnerability Laboratory ID VL-ID: ==================================...

Backdoor.Win32.Agent.sah Heap Corruption

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/3ee7a90b5fc3f2b7ba68911e8220df17.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.sah Vulnerability: Heap Corruption Description: The malware listens on TCP port...

Trojan.Win32.Delf.bna Information Disclosure

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/6bf08611410e3ef7df67d781a2e8efed.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Delf.bna Vulnerability: Information Disclosure Description: The malware listens on TCP...

Trojan.Win32.Pasta.mca Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/4692b129b0034fd53cd76867d9869e49.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Pasta.mca Vulnerability: Insecure Permissions Description: The malware writes an .DLL...

WordPress Hotel Listing 3.x Cross Site Scripting

Document Title: =============== Hotel Listing WP Plugin v3.x - MyAccount XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2277 Release Date: ============= 2021-10-28 Vulnerability Laboratory ID VL-ID: ===================================...

Umbraco 8.14.1 Server-Side Request Forgery

Exploit Title: Umbraco v8.14.1 - 'baseUrl' SSRF Date: July 5, 2021 Exploit Author: NgoAnhDuc Vendor Homepage: https://our.umbraco.com/ Software Link: https://our.umbraco.com/download/releases/8141 Version: v8.14.1 Affect: Umbraco CMS v8.14.1, Umbraco Cloud Vulnerable code:...

WordPress NextScripts: Social Networks Auto-Poster 4.3.20 XSS

Description: Reflected Cross-Site ScriptingXSS Affected Plugin: NextScripts: Social Networks Auto-Poster Plugin Slug: social-networks-auto-poster-facebook-twitter-g Affected Versions: sprintf'Edit',$REQUEST'page','edit',$item-ID, 'delete' = sprintf'Delete',$REQUEST'page','delete',$item-ID, ;...

Mini-XML 3.2 Heap Overflow

Exploit Title: Mini-XML 3.2 - Heap Overflow Google Dork: mxml Mini-xml Mini-XML Date: 2020.10.19 Exploit Author: LIWEI Vendor Homepage: https://www.msweet.org/mxml/ Software Link: https://github.com/michaelrsweet/mxml Version: v3.2 Tested on: ubuntu 18.04.2 1.- compile the Mini-XML code to a...

Movable Type 7 r.5002 XMLRPC API Remote Command Injection

class MetasploitModule "Movable Type XMLRPC API Remote Command Injection", 'Description' = %q This module exploit Movable Type XMLRPC API Remote Command Injection. , 'License' = MSFLICENSE, 'Author' = 'Etienne Gervais', author & msf module, 'Charl-Alexandre Le Brun' author & msf module ,...

WebCTRL OEM 6.5 Cross Site Scripting

Exploit Title: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting XSS Date: 4/07/2021 Exploit Author: 3ndG4me Vendor Homepage: https://www.automatedlogic.com/en/products/webctrl-building-automation-system/ Version: 6.5 and Below CVE : CVE-2021-31682 --Summary-- The login portal for the...

Virus.Win32.Ipamor.c Unauthenticated Reboot

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/b6bfdfe91c3e37865b6a269dc9ff9302.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Virus.Win32.Ipamor.c Vulnerability: Unauthenticated Remote System Reboot Description: The malware...

Backdoor.Win32.Prorat.ntz Man-In-The-Middle

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ab96d7f9e008a0774239be6be0c8e7bb.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Prorat.ntz Vulnerability: Port Bounce Scan Description: The malware runs an FTP serve...

Hostel Management System 2.1 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: PHPGurukul Hostel Management System 2.1 - Cross-site request forgery CSRF to Cross-site Scripting XSS Date: 2021-10-27 Exploit Author: Anubhav Singh Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/hostel-management-system/ Version: V 2.1 Vulnerable...

Backdoor.Win32.Hupigon.afjk Man-In-The-Middle

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/80b0fc8c0657c0ae7971f09af45c706bB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.afjk Vulnerability: Port Bounce Scan Description: The malware runs an FTP...

Backdoor.Win32.Mazben.es Unauthenticated Open Proxy

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/fcd611ccbc756fab43761f4b18372b81.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Mazben.es Vulnerability: Unauthenticated Open Proxy Description: The malware listens ...

Backdoor.Win32.Hupigon.afjk Authentication Bypass / Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/80b0fc8c0657c0ae7971f09af45c706bC.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.afjk Vulnerability: Authentication Bypass RCE Description: The malware runs ...

Microsoft OMI Management Interface Authentication Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCXOperatingSystem' .freeze def initializeinfo = super updateinfo info, 'Name' = 'Microsoft OMI...

Backdoor.Win32.Hupigon.afjk Directory Traversal

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/80b0fc8c0657c0ae7971f09af45c706b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.afjk Vulnerability: Directory Traversal Description: The malware deploys a We...

WordPress Supsystic Contact Form 1.7.18 Cross Site Scripting

Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.18 - 'label' Stored Cross-Site Scripting XSS Date: 10/27/2021 Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: https://supsystic.com/ Software Link: https://wordpress.org/plugins/contact-form-by-supsystic/ Version: 1.7.18...

Trojan.Win32.Akl.bc Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/0b2a0f61a209e24a7d7b2c2d5efb4d68.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Akl.bc Vulnerability: Insecure Permissions Description: The malware creates an dir name...

Backdoor.Win32.Prorat.ntz Weak Hardcoded Password

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ab96d7f9e008a0774239be6be0c8e7bbB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Prorat.ntz Vulnerability: Weak Hardcoded Password Description: The malware runs an F...

Sophos UTM WebAdmin SID Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sophos UTM WebAdmin SID Command Injection', 'Description' = %q This module exploits an SID-based command injection in Sophos UTM's WebAdmin...

Backdoor.Win32.Delf.arjo Unquoted Service Path

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/05177f77f075293ff7d58a7f2915c64f.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Delf.arjo Vulnerability: Insecure Service Path Description: The malware creates a...

HEUR.Backdoor.Win32.Generic Unauthenticated Open Proxy

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/6a96fc226fbe9f0efbcc8a7b2e34b807.txt Contact: [email protected] Media: twitter.com/malvuln Threat: HEUR.Backdoor.Win32.Generic Vulnerability: Unauthenticated Open Proxy Description: The malware liste...

Backdoor.Win32.Antilam.14.o Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/2914f01e65d848655d4f1aac51ff04d1.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Antilam.14.o Vulnerability: Unauthenticated Remote Command Execution Description: The...

Backdoor.Win32.Hupigon.acio Unauthenticated Open Proxy

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/21f324a6a62d8125bc83b8d1865e17f9B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.acio Vulnerability: Unauthenticated Open Proxy Description: The malware...

Backdoor.Win32.Hupigon.acio Unquoted Service Path

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/21f324a6a62d8125bc83b8d1865e17f9.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.acio Vulnerability: Insecure Service Path Description: The malware creates a...

Mult-e-Cart Ultimate 2.4 SQL Injection

Document Title: =============== Mult-e-Cart Ultimate v2.4 - SQL Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2306 Release Date: ============= 2021-10-22 Vulnerability Laboratory ID VL-ID: ====================================...

BMW Online Cross Site Scripting

Document Title: =============== BMW Online Mail - Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2262 Vulnerability Magazine:...

Isshue Shopping Cart 3.5 Cross Site Scripting

Document Title: =============== Isshue Shopping Cart v3.5 - Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2284 Release Date: ============= 2021-10-22 Vulnerability Laboratory ID VL-ID: ====================================...

Sonicwall SonicOS 6.5.4 Cross Site Scripting

Document Title: =============== Sonicwall SonicOS 6.5.4 - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2272 Release Date: ============= 2021-10-18 Vulnerability Laboratory ID VL-ID:...

Vanguard 2.1 Cross Site Scripting

Document Title: =============== Vanguard v2.1 - Search POST Inject Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2283 Release Date: ============= 2021-10-26 Vulnerability Laboratory ID VL-ID: ==================================== 2283...

Simplephpscripts Simple CMS 2.1 Cross Site Scripting

Document Title: =============== Simplephpscripts Simple CMS v2.1 - XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2301 Release Date: ============= 2021-10-18 Vulnerability Laboratory ID VL-ID: ====================================...

SPA Cart CMS 2021 SQL Injection

Document Title: =============== SPA Cart CMS - Multiple SQL Injection Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2304 Release Date: ============= 2021-10-18 Vulnerability Laboratory ID VL-ID: ====================================...

WordPress Filterable Portfolio Gallery 1.0 Cross Site Scripting

Exploit Title: WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting XSS Date: 10/25/2021 Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: http://www.filterable-portfolio.com/ Software Link: https://wordpress.org/plugins/fg-gallery/ Version: 1.0...

PHP Melody 3.0 Cross Site Scripting

Document Title: =============== PHP Melody v3.0 - submitted Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2292 Bulletin: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ Release Date:...

RDP Manager 4.9.9.3 Denial Of Service

Document Title: =============== RDP Manager v4.9.9.3 - Local Denial of Servie Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2309 Release Date: ============= 2021-10-18 Vulnerability Laboratory ID VL-ID: ==================================...

PHP Melody 3.0 SQL Injection

Document Title: =============== PHP Melody v3.0 - vid SQL Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2295 Bulletin: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ Release Date: =============...

Simplephpscripts Simple CMS 2.1 Cross Site Scripting

Document Title: =============== Simplephpscripts Simple CMS v2.1 - Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2302 Release Date: ============= 2021-10-19 Vulnerability Laboratory ID VL-ID: ==================================...

Simplephpscripts Simple CMS 2.1 SQL Injection

Document Title: =============== Simplephpscripts Simple CMS v2.1 - SQL Injection References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2303 Release Date: ============= 2021-10-19 Vulnerability Laboratory ID VL-ID: ==================================== 2303...

Ultimate POS 4.4 Cross Site Scripting

Document Title: =============== Ultimate POS v4.4 - Products Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2296 Release Date: ============= 2021-10-26 Vulnerability Laboratory ID VL-ID: ====================================...

PHP Melody 3.0 Cross Site Scripting

Document Title: =============== PHP Melody v3.0 - Multiple Cross Site Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2290 Bulletin: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ Release Date:...

PHP Melody 3.0 Cross Site Scripting

Document Title: =============== PHP Melody v3.0 - Editor Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2291 Bulletin: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ Release Date: ===========...