7902 matches found
How to Create a Scan for SQL Injection
This whitepaper covers how to create a scan in Perl to identify different types of SQL injection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid SQL injection...
Linux FUSE Use-After-Free
There is a use-after-free read in FUSE, basically hittable without racing, that copies freed kernel memory read through an outdated dname pointer to userspace...
How to Create a Scan to Identify Reflected XSS
This whitepaper covers how to create a scan in Perl to identify reflected cross site scripting in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid reflective cross site...
Packet Storm New Exploits for February, 2025
This archive contains all of the 79 exploits added to Packet Storm in February, 2025...
JSONPath-plus Remote Code Execution
JSONpath-plus versions prior to 10.3.0 are vulnerable to a remote code execution vulnerability due to improper input sanitization. This is due to an incomplete fix for CVE-2024-21534...
WordPress WP Load Gallery 2.1.6 Shell Upload
NgocCode WP Load Gallery plugin version 2.1.6 suffers from a remote shell upload vulnerability...
WordPress ACF City Selector 1.14.0 Shell Upload
WordPress ACF City Selector plugin versions 1.14.0 and below suffer from a remote shell upload vulnerability...
F5 BIG-IP TMSH CLI Command Injection
A command injection vulnerability exists in the F5 tmsh restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and obtain remote code execution as the root user on the target syst...
XOne Web Monitor 02.10.2024.530 SQL Injection
An unauthenticated SQL injection vulnerability has been discovered in the login functionality of XOne Web Monitor version 02.10.2024.530 framework 1.0.4.9. This flaw allows attackers to exploit improper handling of user input during the authentication process to extract all stored usernames and...
Ivanti EPM Credential Coercion
This is a proof of concept exploit for Ivanti EPM vulnerabilities that allow for unauthenticated coercion of the Ivanti EPM machine credential for use in relay attacks...
Zabbix SQL Injection / Privilege Escalation
This proof of concept exploit can be used on Zabbix server versions prior to 6.0.32rc1, 6.4.17rc1, and 7.0.1rc1 leverages SQL injection and achieves remote code execution through a reverse shell...
MikroTik RouterOS Username Enumeration
MikroTik RouterOS suffers from a username enumeration vulnerability...
Ghost CMS Arbitrary File Read
Ghost CMS versions prior to 5.59.1 proof of concept arbitrary file read exploit...
Wazuh Unsafe Deserialization / Remote Code Execution
Wazuh versions starting at 4.4.0 and before 4.9.1 suffer from an unsafe deserialization vulnerability that allows for remote code execution...
LimeSurvey 5.2.4 Shell Upload
LimeSurvey version 5.2.4 proof of concept exploit that upload a malicious PHP plugin to obtain a reverse shell...
Web Security Training
This document is aimed at those who want to learn more about web security and application penetration testing. It is coupled with a free course and provides topics with a few bullet points describing what the vulnerability entails, then a screenshot and relevant payload, demonstrating the...
GZDoom 4.13.1 Remote Code Execution
GZDoom versions 4.13.1 and below suffer from a vulnerability involving array sizes in ZScript, the game engine's primary scripting language. It is possible to dynamically allocate an array of 1073741823 dwords, permitting access to the rest of the heap from the start of the array and causing a...
CISA: Eliminating Buffer Overflows
This Secure by Design Alert is part of an ongoing series aimed at advancing industry-wide best practices to eliminate entire classes of vulnerabilities during the design and development phases of the product lifecycle. This paper focuses on buffer overflows...
The DEF CON 32 Hackers' Almanack
The DEF CON 32 Hackers' Almanack is a novel first cut at bridging the chasm between policy makers and technologists. Through a new initiative, dubbed "Franklin," the Almanack will elevate the most interesting, impactful and cutting edge talks, research, and vulnerabilities identified across the D...
WordPress Bit File Manager 6.5.5 Race Condition / Remote Code Execution
WordPress Bit File Manager plugin versions 6.0 through 6.5.5 suffer from a remote code execution vulnerability via a race condition...
GNU Transport Layer Security Library 3.8.9
GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols, as well as APIs to parse and write X.509, PKCS 12, OpenPGP, and other...
Backdrop CMS 1.29.2 Cross Site Scripting / Cross Site Request Forgery
Backdrop CMS version 1.29.2 remote exploit that chains a persistent cross site scripting vulnerability with a cross site request forgery payload to achieve privilege escalation form the role of Editor to Administrator...
Sensaphone WEB600 Monitoring System Cross Site Scripting
The Sensaphone WEB600 Monitoring System was found to suffer from multiple persistent cross site scripting vulnerabilities...
Botan C++ Crypto Algorithms Library 3.7.1
Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS 10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to...
Packet Storm New Exploits for January, 2025
This archive contains all of the 101 exploits added to Packet Storm in January, 2025...
Linux ax88179_rx_fixup() Out-Of-Band Access
drivers/net/usb/ax88179178a.c contains multiple out-of-bounds accesses in ax88179rxfixup, the function responsible for taking a buffer received over USB and splitting it up into ethernet packets. This can be abused by a malicious USB device to leak and probably also corrupt out-of-bounds kernel...
CISA: Contec CMS8000 Contains a Backdoor
This fact sheet details an analysis of three firmware package versions of the Contec CMS8000, a patient monitor used by the U.S. Healthcare and Public Health HPH sector. Analysts discovered that an embedded backdoor function with a hard-coded IP address and functionality that enables patient data...
Interagency Security Committee Compliance Policy and Compliance Benchmarks, 2024 Edition
The Interagency Security Committee Compliance Policy and Compliance Benchmarks, 2024 Edition outlines the ISC Compliance Policy and updates Compliance Benchmarks in alignment with Executive Order 14111 and the updated Risk Management Process Standard of 2024. These updated compliance benchmarks a...
A Pwn2Own SpiderMonkey JIT Bug
A Pwn2Own SpiderMonkey JIT Bug: From Integer Range Inconsistency to Bound Check Elimination then RCE. This repository contains proof of concept, exploit, and analysis slide for CVE-2024-29943...
Iconv Arbitrary File Read
This script is designed to exploit a vulnerability in systems that use the iconv library with improper handling of character encoding conversions, as described in CVE-2024-2961. The vulnerability allows an attacker to read arbitrary files on the server by leveraging PHP filter chains and improper...
7-Zip Mark-of-the-Web Bypass
Proof of concept exploit that allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. All versions before 24.09 are considered vulnerable...
Forescout SecureConnector 11.3.07 Privilege Escalation
Forescout SecureConnector versions 11.3.07 and below privilege escalation proof of concept that makes use of an insecure permissions vulnerability...
WordPress Email Subscribers by Icegram Express 5.7.14 SQL Injection
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress and WooCommerce plugin for WordPress is vulnerable to SQL Injection via the run function of the IGESSubscribersQuery class in all versions up to, and including, 5.7.14 due to insufficient escaping on...
CISA: Closing the Software Understanding Gap
CISA document to help close the gap and secure infrastructure with a deep, scalable understanding of software-controlled systems, including AI-systems...
Ivanti Connect Secure IFT TLS Stack Overflow / Remote Code Execution
This is an Ivanti Connect Secure IFT TLS stack overflow pre-authentication remote code execution proof of concept exploit. It is crippled by default...
CISA: Microsoft Expanded Cloud Logs Implementation Playbook
This playbook provides a detailed overview of the newly introduced logging capabilities in Microsoft Purview Audit Standard. These capabilities enable organizations to conduct forensic and compliance investigations by accessing critical events...
Jenkins 2.441 Arbitrary File Read
This proof of concept can be used to exploit CVE-2024-23897 to achieve file-read access on a Jenkins server versions 2.441 and below...
CISA: AI Cybersecurity Collaboration Playbook
The AI Cybersecurity Collaboration Playbook provides guidance to organizations across the AI community – including AI providers, developers, and adopters – for sharing AI-related cybersecurity information voluntarily with the Cybersecurity and Infrastructure Security Agency CISA and other partner...
Report of Special Counsel Smith Volume 1
Special Counsel Jack Smith's January 2025 report concluded that former President Donald Trump engaged in a criminal effort to overturn the 2020 election results, including pressuring officials and inciting the January 6 Capitol riot. Smith asserted that sufficient evidence existed to convict Trum...
Paradox Security Systems IPR512 Denial of Service
Paradox Security Systems IPR512 proof of concept denial of service script...
CISA: AI Cybersecurity Collaboration Playbook Fact Sheet
This is the fact sheet for CISA's AI Security Collaboration Playbook...
Ivanti CVE-2025-0282 Checker
This script allows you to safely scan and test to see if you are vulnerable to CVE-2025-0282, a stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 that allows a...
CISA: Secure by Demand: Priority Considerations
This is CISA's Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products. This guide is intended to help owners and operators procure Operational Technology OT products, particularly industrial automation and control system products,...
Palo-Alto Firewall Denial of Service
Simple proof of concept script that aims to attack the firewall on certain vulnerable versions of Palo Alto's PAN OS via malicious DNS queries. A successful attack will force the firewall to crash and enter maintenance mode...
Netgear Router Password Disclosure
Multiple Netgear routers suffers from remote and local password disclosure vulnerabilities...
HTML Compiler Remote Code Execution
HTML Compiler remote code execution exploit that downloads a malicious file...
PHP 5.x / Bash Shellshock Proof of Concept
This is a proof of concept that demonstrates how the Bash shellshock vulnerability can be used in PHP to bypass disablefunctions, safemode, etc...
IPSwitch IMail 12.4 Cross Site Scripting
IPSwitch IMail server web client versions 12.3 and 12.4 before 12.4.1.15 suffer from a persistent cross site scripting vulnerability...