Ivanti EPM Credential Coercion

This is a proof of concept exploit for Ivanti EPM vulnerabilities that allow for unauthenticated coercion of the Ivanti EPM machine credential for use in relay attacks...

MikroTik RouterOS Username Enumeration

MikroTik RouterOS suffers from a username enumeration vulnerability...

Zabbix SQL Injection / Privilege Escalation

This proof of concept exploit can be used on Zabbix server versions prior to 6.0.32rc1, 6.4.17rc1, and 7.0.1rc1 leverages SQL injection and achieves remote code execution through a reverse shell...

Ghost CMS Arbitrary File Read

Ghost CMS versions prior to 5.59.1 proof of concept arbitrary file read exploit...

LimeSurvey 5.2.4 Shell Upload

LimeSurvey version 5.2.4 proof of concept exploit that upload a malicious PHP plugin to obtain a reverse shell...

Wazuh Unsafe Deserialization / Remote Code Execution

Wazuh versions starting at 4.4.0 and before 4.9.1 suffer from an unsafe deserialization vulnerability that allows for remote code execution...

Web Security Training

This document is aimed at those who want to learn more about web security and application penetration testing. It is coupled with a free course and provides topics with a few bullet points describing what the vulnerability entails, then a screenshot and relevant payload, demonstrating the...

GZDoom 4.13.1 Remote Code Execution

GZDoom versions 4.13.1 and below suffer from a vulnerability involving array sizes in ZScript, the game engine's primary scripting language. It is possible to dynamically allocate an array of 1073741823 dwords, permitting access to the rest of the heap from the start of the array and causing a...

CISA: Eliminating Buffer Overflows

This Secure by Design Alert is part of an ongoing series aimed at advancing industry-wide best practices to eliminate entire classes of vulnerabilities during the design and development phases of the product lifecycle. This paper focuses on buffer overflows...

The DEF CON 32 Hackers' Almanack

The DEF CON 32 Hackers' Almanack is a novel first cut at bridging the chasm between policy makers and technologists. Through a new initiative, dubbed "Franklin," the Almanack will elevate the most interesting, impactful and cutting edge talks, research, and vulnerabilities identified across the D...

WordPress Bit File Manager 6.5.5 Race Condition / Remote Code Execution

WordPress Bit File Manager plugin versions 6.0 through 6.5.5 suffer from a remote code execution vulnerability via a race condition...

GNU Transport Layer Security Library 3.8.9

GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols, as well as APIs to parse and write X.509, PKCS 12, OpenPGP, and other...

Backdrop CMS 1.29.2 Cross Site Scripting / Cross Site Request Forgery

Backdrop CMS version 1.29.2 remote exploit that chains a persistent cross site scripting vulnerability with a cross site request forgery payload to achieve privilege escalation form the role of Editor to Administrator...

Sensaphone WEB600 Monitoring System Cross Site Scripting

The Sensaphone WEB600 Monitoring System was found to suffer from multiple persistent cross site scripting vulnerabilities...

Botan C++ Crypto Algorithms Library 3.7.1

Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS 10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to...

Packet Storm New Exploits for January, 2025

This archive contains all of the 101 exploits added to Packet Storm in January, 2025...

Linux ax88179_rx_fixup() Out-Of-Band Access

drivers/net/usb/ax88179178a.c contains multiple out-of-bounds accesses in ax88179rxfixup, the function responsible for taking a buffer received over USB and splitting it up into ethernet packets. This can be abused by a malicious USB device to leak and probably also corrupt out-of-bounds kernel...

CISA: Contec CMS8000 Contains a Backdoor

This fact sheet details an analysis of three firmware package versions of the Contec CMS8000, a patient monitor used by the U.S. Healthcare and Public Health HPH sector. Analysts discovered that an embedded backdoor function with a hard-coded IP address and functionality that enables patient data...

Interagency Security Committee Compliance Policy and Compliance Benchmarks, 2024 Edition

The Interagency Security Committee Compliance Policy and Compliance Benchmarks, 2024 Edition outlines the ISC Compliance Policy and updates Compliance Benchmarks in alignment with Executive Order 14111 and the updated Risk Management Process Standard of 2024. These updated compliance benchmarks a...

Iconv Arbitrary File Read

This script is designed to exploit a vulnerability in systems that use the iconv library with improper handling of character encoding conversions, as described in CVE-2024-2961. The vulnerability allows an attacker to read arbitrary files on the server by leveraging PHP filter chains and improper...

A Pwn2Own SpiderMonkey JIT Bug

A Pwn2Own SpiderMonkey JIT Bug: From Integer Range Inconsistency to Bound Check Elimination then RCE. This repository contains proof of concept, exploit, and analysis slide for CVE-2024-29943...

7-Zip Mark-of-the-Web Bypass

Proof of concept exploit that allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. All versions before 24.09 are considered vulnerable...

Forescout SecureConnector 11.3.07 Privilege Escalation

Forescout SecureConnector versions 11.3.07 and below privilege escalation proof of concept that makes use of an insecure permissions vulnerability...

WordPress Email Subscribers by Icegram Express 5.7.14 SQL Injection

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress and WooCommerce plugin for WordPress is vulnerable to SQL Injection via the run function of the IGESSubscribersQuery class in all versions up to, and including, 5.7.14 due to insufficient escaping on...

CISA: Closing the Software Understanding Gap

CISA document to help close the gap and secure infrastructure with a deep, scalable understanding of software-controlled systems, including AI-systems...

CISA: Microsoft Expanded Cloud Logs Implementation Playbook

This playbook provides a detailed overview of the newly introduced logging capabilities in Microsoft Purview Audit Standard. These capabilities enable organizations to conduct forensic and compliance investigations by accessing critical events...

Ivanti Connect Secure IFT TLS Stack Overflow / Remote Code Execution

This is an Ivanti Connect Secure IFT TLS stack overflow pre-authentication remote code execution proof of concept exploit. It is crippled by default...

Jenkins 2.441 Arbitrary File Read

This proof of concept can be used to exploit CVE-2024-23897 to achieve file-read access on a Jenkins server versions 2.441 and below...

CISA: AI Cybersecurity Collaboration Playbook Fact Sheet

This is the fact sheet for CISA's AI Security Collaboration Playbook...

Paradox Security Systems IPR512 Denial of Service

Paradox Security Systems IPR512 proof of concept denial of service script...

CISA: AI Cybersecurity Collaboration Playbook

The AI Cybersecurity Collaboration Playbook provides guidance to organizations across the AI community – including AI providers, developers, and adopters – for sharing AI-related cybersecurity information voluntarily with the Cybersecurity and Infrastructure Security Agency CISA and other partner...

Report of Special Counsel Smith Volume 1

Special Counsel Jack Smith's January 2025 report concluded that former President Donald Trump engaged in a criminal effort to overturn the 2020 election results, including pressuring officials and inciting the January 6 Capitol riot. Smith asserted that sufficient evidence existed to convict Trum...

Ivanti CVE-2025-0282 Checker

This script allows you to safely scan and test to see if you are vulnerable to CVE-2025-0282, a stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 that allows a...

Palo-Alto Firewall Denial of Service

Simple proof of concept script that aims to attack the firewall on certain vulnerable versions of Palo Alto's PAN OS via malicious DNS queries. A successful attack will force the firewall to crash and enter maintenance mode...

CISA: Secure by Demand: Priority Considerations

This is CISA's Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products. This guide is intended to help owners and operators procure Operational Technology OT products, particularly industrial automation and control system products,...

Netgear Router Password Disclosure

Multiple Netgear routers suffers from remote and local password disclosure vulnerabilities...

HTML Compiler Remote Code Execution

HTML Compiler remote code execution exploit that downloads a malicious file...

PHP 5.x / Bash Shellshock Proof of Concept

This is a proof of concept that demonstrates how the Bash shellshock vulnerability can be used in PHP to bypass disablefunctions, safemode, etc...

IPSwitch IMail 12.4 Cross Site Scripting

IPSwitch IMail server web client versions 12.3 and 12.4 before 12.4.1.15 suffer from a persistent cross site scripting vulnerability...

Cool PDF Reader 3.0.2.256 Buffer Overflow

Cool PDF Reader version 3.0.2.256 buffer overflow exploit...

DataLife Engine 9.7 PHP Code Injection

DataLife Engine version 9.7 suffers from a PHP code injection vulnerability in preview.php...

Cisco TelePresence Cookie Theft / Impersonation / Code Execution

Cisco TelePresensce Series suffers from client-side code execution, denial of service, cookie theft, loss of confidentiality, and impersonation vulnerabilities...

sa2001_02.txt

NSFOCUS Security Advisory SA2001-02 - The nsfocus team has found a vulnerability in filename processing of CGI program in MS IIS4.0/5.0, as discussed in ms01-026. CGI filename is decoded twice by error. Exploitation of this vulnerability leads to intruders being able to run arbitrary system...