HC10 HC.Server Service 10.14 - Remote Invalid Pointer Write Vulnerability

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/HC10-HC.SERVER-10.14-REMOTE-INVALID-POINTER-WRITE.txt + ISR: ApparitionSec Vendor www.hostingcontroller.com Product HC10 HC.Server Service 10.14 HC10 is a unified hosting...

Adobe Coldfusion 11 CKEditor Arbitrary File Upload Exploit

A file upload vulnerability exists in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Adobe ColdFusion CKEditor unrestricted file...

Surreal ToDo 0.6.1.2 - Local File Inclusion Vulnerability

Exploit for php platform in category web applications Exploit Title: Surreal ToDo 0.6.1.2 - Local File Inclusion Exploit Author: Ihsan Sencan Vendor Homepage: http://getsurreal.com/surrealtodo Software Link:...

TikiWiki <= 1.9 Sirius (jhot.php) Remote Command Execution Exploit

Exploit for unknown platform in category web applications ================================================================== TikiWiki 126 $result.=" .";...

Wondershare Dr.Fone 12.9.6 Weak Permissions / Privilege Escalation Vulnerability

Executive Summary: Product Name: Wondershare Dr. Fone Vendor Home Page: https://drfone.wondershare.com Affected Versions: Dr Fone version 12.9.6 Vulnerability Type: Execution with Unnecessary Privileges CWE-250 CVE Reference: CVE-2023-27010. Credit: Thurein Soe Vendor Description: Wondershare Dr...

Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root Exploit

Schneider Electric SpaceLogic C-Bus Home Controller 5200WHC2 versions 1.31.460 and below suffer from an authenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user via the name GET parameter in delsnap.pl Perl/CGI script...

SeedDMS < 5.1.11 - (out.UsrMgr.php) Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Persistent Cross-Site Scripting or Stored XSS in out/out.UsrMgr.php in SeedDMS before 5.1.11 Exploit Author: Nimit Jainhttps://secfolks.blogspot.com Vendor Homepage: https://www.seeddms.org Software Link:...

Invision Community 4.7.16 Remote Code Execution Vulnerability

------------------------------------------------------------------------------ Invision Community = 4.7.16 toolbar.php Remote Code Execution Vulnerability ------------------------------------------------------------------------------ - Software Link: https://invisioncommunity.com - Affected...

Lost and Found Information System v1.0 - ( IDOR ) leads to Account Take over Exploit

Exploit Title: Lost and Found Information System v1.0 - idor leads to Account Take over Exploit Author: OR4NG.M4N Category : webapps CVE : CVE-2023-38965 Python p0c : import argparse import requests import time parser = argparse.ArgumentParserdescription='Send a POST request to the target server'...

IBM AIX 7.2 inscout Privilege Escalation Exploit

This Metasploit module exploits a command injection vulnerability in IBM AIX invscout set-uid root utility present in AIX 7.2 and earlier. The undocumented -rpm argument can be used to install an RPM file; and the undocumented -o argument passes arguments to the rpm utility without validation,...

Sanitization Management System 1.0 SQL Injection Vulnerability

Title: SMS - PHP by: oretnom23 v1.0 SQLi Author: nu11secur1ty Vendor: https://github.com/oretnom23, https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/download-code?nid=15770&title=Sanitization+Management+System+Project+in+PHP+and+MySQL+Free+Source+Code Reference...

Build Your Own Botnet 2.0.0 Remote Code Execution Exploit

Build Your Own Botnet BYOB version 2.0.0 exploit that works by spoofing an agent callback to overwrite the sqlite database and bypass authentication and exploiting an authenticated command injection in the payload builder page. Exploit Title: BYOB Build Your Own Botnet v2.0.0 Unauthenticated RCE...

QNAP QTS / QuTS Hero Unauthenticated Remote Code Execution Exploit

There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage NAS devices, and QuTS hero is a core part of the firmware for numerous QNAP...

Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation Vulnerability

Exploit Title: Filmora 12 version Build 1.0.0.7 - Unquoted Service Paths Privilege Escalation Exploit Author: Thurein Soe Vendor Homepage: https://filmora.wondershare.com Software Link: https://mega.nz/file/tQNGGZTQE1u20rdbT4R3pgSoUBG93IPAXqesJ5yyn6T8RlMFxaE Version: Filmora 12 Build 1.0.0.7 Test...

Feberr 12.7 Shell Upload Vulnerability

Exploit Title: Feberr - Multivendor Digital Products Marketplace arbitrary file upload Version 12.7 Google Dork: N/A Exploit Author: Sohel Yousef - email protected Software Link: https://www.codester.com/items/14224/feberr-multivendor-digital-products-marketplace Software link 2...

Maian-Cart 3.8 - Remote Code Execution (Unauthenticated) Exploit

Exploit title: Maian-Cart 3.8 - Remote Code Execution RCE Unauthenticated Tested on: Ubuntu 20.04 LTS Exploit Authors: DreyAnd, purpl3 Software Link: https://www.maiancart.com/download.html Vendor homepage: https://www.maianscriptworld.co.uk/ Version: Maian Cart 3.8 CVE: CVE-2021-32172...

WordPress Delightful Downloads Jquery File Tree 1.6.6 Plugin - Path Traversal Exploit

Exploit Title: WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal Exploit Author: Nicholas Ferreira Vendor Homepage: https://github.com/A5hleyRich/delightful-downloads Version: =1.6.6 Tested on: Debian 11 CVE : CVE-2017-1000170 PHP version exploit: 7.3.27 POC: curl --da...

Microsoft Windows - (WizardOpium) Local Privilege Escalation Exploit

include include extern "C" NTSTATUS NtUserMessageCallHWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, ULONGPTR ResultInfo, DWORD dwType, BOOL bAscii; int main HINSTANCE hInstance = GetModuleHandleNULL; WNDCLASSEX wcx; ZeroMemory&wcx, sizeofwcx; wcx.hInstance = hInstance; wcx.cbSize = sizeofwcx;...

Adaware Web Companion version 4.8.2078.3950 - (WCAssistantService) Unquoted Service Path

Exploit Title: Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path Exploit Author: Mariela L Martínez Hdez Vendor Homepage: https://webcompanion.com/en/ Software Link: https://webcompanion.com/en/ Version: Adaware Web Companion version 4.8.2078.3950 Tested on:...

Instagram Auto Follow - Authentication #Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Instagram Auto Follow - Autobot Instagram - Authentication Bypass Exploit Author: Veyselxan Vendor Homepage: https://codecanyon.net/item/instagram-auto-follow-autobot-instagram/23720743?srank=4 Tested on: Linux...

Hitachi NAS SMU 14.8.7825 Information Disclosure Vulnerability

Exploit Title: Hitachi NAS HNAS System Management Unit SMU 14.8.7825 - Information Disclosure CVE: CVE-2023-6538 Exploit Author: Arslan Masood @arszilla Vendor: https://www.hitachivantara.com/ Version: --id --sso " Create --host argument: parser.addargument "--host", required=True, type=str,...

Textpattern 4.8.8 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Textpattern 4.8.8 - Remote Code Execution RCE Authenticated Exploit Author: Alperen Ergel Contact: @alpernae IG/TW Software Homepage: https://textpattern.com/ Version : 4.8.8 Tested on: windows 11 xammp | Kali linux Category: WebApp Google Dork: intext:"Published with Textpattern...

Linux SO_PEERCRED / SO_PEERGROUPS Race Condition / Use-After-Free Exploit

Linux suffered from a use-after-free read vulnerability related to an SOPEERCRED and SOPEERGROUPS race with listen and connect. This has been addressed in stable versions 5.14.10, 5.10.71, 5.4.151, 4.19.209, 4.14.249, 4.4.288, and 4.9.286. Linux: UAF read: SOPEERCRED and SOPEERGROUPS race with...

Pentaho Business Analytics / Pentaho Business Server 9.1 Filename Bypass Vulnerability

Pentaho allows users to upload various files of different file types. The upload service is implemented under the /pentaho/UploadService endpoint. The file types allowed by the application are csv, dat, txt, tar, zip, tgz, gz, gzip. When uploading a file with an extension other than the allowed...

ABB Cylon Aspect 3.08.02 webServerUpdate.php Configuration Poisoning Vulnerability

ABB Cylon Aspect version 3.08.02 suffers from improper input validation on the port POST parameter in the webServerUpdate.php script. This input is not validated on the server side and relies on bypassable client-side checks using the inString.js script to verify that the port parameter contains...

Hospital Management System Project In ASP.Net MVC 1 SQL Injection Vulnerability

Hospital Management System Project in ASP.Net MVC version 1 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Exploit Title: Hospital Management System Project in ASP.Net MVC - SQL Injection / Authentication Bypass Date: 07/16/2024 Exploit Author: 0xMykull...

Monitorr 1.7.6m / 1.7.7d Remote Code Execution Exploit

This Metasploit module exploits an arbitrary file upload vulnerability and achieves remote code execution in the Monitorr application. Using a specially crafted request, custom PHP code can be uploaded and injected through endpoint upload.php because of missing input validation. Any user privileg...

Lucee Authenticated Scheduled Job Code Execution Exploit

This Metasploit module can be used to execute a payload on Lucee servers that have an exposed administrative web interface. It's possible for an administrator to create a scheduled job that queries a remote ColdFusion file, which is then downloaded and executed when accessed. The payload is...

OpenClinic GA 5.247.01 - Path Traversal (Authenticated) Vulnerability

Exploit Title: OpenClinic GA 5.247.01 - Path Traversal Authenticated Vendor Homepage: https://sourceforge.net/projects/open-clinic/ Software Link: https://sourceforge.net/projects/open-clinic/ Version: OpenClinic GA 5.247.01 Tested on: Windows 10, Windows 11 CVE: CVE-2023-40279 Details An issue w...

WebCalendar 1.3.0 Cross Site Scripting Vulnerability

Exploit Title: WebCalendar Version: 1.3.0 - Stored XSS - Reflected XSS Exploit Author: tmrswrr Vendor Homepage: http://www.k5n.us/webcalendar.php Version: 1.3.0 Tested on: https://www.softaculous.com/apps/calendars/WebCalendar Stored XSS 1 Write Events Add New Events Brief Description :...

Cisco IOX XE Unauthenticated Remote Code Execution Chain Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco IOX XE Unauthenticated RCE Chain', 'Description' = %q This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable...

F5 BIG-IP iControl Cross Site Request Forgery Exploit

This Metasploit module exploits a cross-site request forgery CSRF vulnerability in F5 Big-IP's iControl interface to write an arbitrary file to the filesystem. While any file can be written to any location as root, the exploitability is limited by SELinux; the vast majority of writable locations...

Moodle 3.11.4 - SQL Injection Vulnerability

Exploit Title: Moodle 3.11.4 - SQL Injection Exploit Author: lavclash75 Vendor Homepage: https://moodle.org/ Version: Moodle 3.11 to 3.11.4 CVE: CVE-2022-0332 POC GET...

Openfire Authentication Bypass / Remote Code Execution Exploit

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...

Eibiz i-Media Server Digital Signage 3.8.0 Authentication Bypass Exploit

Eibiz i-Media Server Digital Signage version 3.8.0 suffers from unauthenticated privilege escalation and arbitrary user creation vulnerability that allows authentication bypass. Once serialized, an AMF encoded object graph may be used to persist and retrieve application state or allow two endpoin...

Roxy Fileman 1.4.5 For .NET Directory Traversal Vulnerability

Exploit for php platform in category web applications =========================== Exploit Title: Roxy Fileman 1.4.5 for .NET - Directory Traversal Software: Roxy Fileman Version: 1.4.5 Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-net...

Rails 5.2.1 - Arbitrary File Content Disclosure Exploit

Exploit for multiple platform in category web applications ''' Exploit Title: File Content Disclosure on Rails Date: CVE disclosed 3/16 today's date is 3/20 Exploit Author: NotoriousRebel Vendor Homepage: https://rubyonrails.org/ Software Link: https://github.com/rails/rails Version: Versions...

WinPower 4.9.0.4 - Privilege Escalation Exploit

Exploit for windows platform in category local exploits Exploit Title: WinPower V4.9.0.4 Privilege Escalation Date: 29-11-2016 Software Link: http://www.ups-software-download.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category:...

vBulletin 5.5.2 PHP Object Injection Exploit

vBulletin versions 5.5.2 and below suffers from an issue where user input passed through the "messageids" request parameter to /ajax/api/vb4private/movepm is not properly sanitized before being used in a call to the unserialize PHP function. This can be exploited by malicious users to inject...

WordPress Duplicator 1.4.6 Plugin - Unauthenticated Backup Download Vulnerability

Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download Exploit Author: SecuriTrust Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: 1.4.7 Tested on: Linux, Windows CVE : CVE-2022-2551 Reference:...

Fortinet FortiOS / FortiProxy / FortiSwitchManager Authentication Bypass Exploit

This Metasploit module exploits an authentication bypass vulnerability in the Fortinet FortiOS, FortiProxy, and FortiSwitchManager API to gain access to a chosen account and then adds an SSH key to the authorizedkeys file of the chosen account, allowing you to login to the system with the chosen...

Mantis Bug Tracker 1.3.0/2.3.0 - Password Reset Exploit

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org...

WordPress eTemplates 0.2.1 SQL Injection Vulnerability

CVE-2024-55972 eTemplates = 0.2.1 - Unauthenticated SQL Injection Description The eTemplates plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 0.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

GaatiTrack Courier Management System 1.0 Cross Site Scripting Vulnerability

Exploit Title: GaatiTrack Courier Management System v1.0 - Multiple Cross-site scripting Exploit Author: BugsBD Security Researcher Rahad Chowdhury Vendor Homepage: https://www.mayurik.com/ Software Link: https://www.mayurik.com/source-code/P0998/best-courier-management-system-project-in-php...

Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Modification Vulnerability

Cisco ThousandEyes Enterprise Agent Virtual Appliance version thousandeyes-va-64-18.04 0.218 suffers from an unpatched vulnerability in sudoedit, allowed by sudo configuration, which permits a low-privilege user to modify arbitrary files as root and subsequently execute arbitrary commands as root...

Osprey Pump Controller 1.0.1 Unauthenticated Remote Code Execution Exploit

!/usr/bin/env python Osprey Pump Controller 1.0.1 Unauthenticated Remote Code Execution Exploit Vendor: ProPump and Controls, Inc. Product web page: https://www.propumpservice.com | https://www.pumpstationparts.com Affected version: Software Build ID 20211018, Production 10/18/2021 Mirage App:...

Centreon 22.04.0 Cross Site Scripting Vulnerability

Exploit Title: Stored XSS in servicealias parameter in Centreon version 22.04.0 Exploit Author: syad Vendor Homepage: Centreon Software Link: https://download.centreon.com/ Version: 22.04.0 CVE ID : CVE-2022-39988 Tested on: Centos 7 Centreon 22.04.0 is vulnerable to Stored Cross Site Scripting X...

Wavlink WN530HG4 - Password Disclosure Vulnerability

Exploit Title: Wavlink WN530HG4 - Password Disclosure Exploit Author: Ahmed Alroky Author Company : AIactive Version: M30HG4.V5030.191116 Vendor home page : wavlink.com Authentication Required: No CVE : CVE-2022-34047 Tested on: Windows Exploit view-source:http://IPaddress/setsafety.shtml?r=52300...

Pharmacy Management System 1.0 Shell Upload Vulnerability

Exploit Title: Pharmacy management system - Remote Code Execution RCE Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15281/multi-language-pharmacy-management-system-project-source-code.html Version: 1.0 Tested on:...

Employee Record Management System 1.1 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Employee Record Management SystemERMS 1.1 - Authentication Bypass Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...