Microfinance Management System 1.0 SQL Injection Vulnerability

Microfinance Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can be used to escalate privileges and execute code. Title: Microfinance Management System 1.0 SQLi To Rce Author: Hejap Zairy Vendor:...

Apache APISIX 2.12.1 - Remote Code Execution Exploit

Exploit Title: Apache APISIX 2.12.1 - Remote Code Execution RCE Exploit Author: Ven3xy Vendor Homepage: https://apisix.apache.org/ Version: Apache APISIX 1.3 – 2.12.1 Tested on: CentOS 7 CVE : CVE-2022-24112 import requests import sys class color: HEADER = '\03395m' IMPORTANT = '\3335m' NOTICE =...

Tdarr 2.00.15 - Command Injection Vulnerability

Exploit Title: Tdarr 2.00.15 - Command Injection Exploit Author: Sam Smith Vendor Homepage: https://tdarr.io Software Link: https://f000.backblazeb2.com/file/tdarrs/versions/2.00.15/linuxarm64/TdarrServer.zip Version: 2.00.15 likely also older versions Tested on: 2.00.15 Exploit: The Help tab...

Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion Vulnerability

Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion Exploit Author: Jonah Tan @picar0jsu Vendor Homepage: https://www.oracle.com Software Link: https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0...

Grandstream UCM62xx IP PBX sendPasswordEmail Remote Code Execution Exploit

This Metasploit module exploits an unauthenticated SQL injection vulnerability and a command injection vulnerability affecting the Grandstream UCM62xx IP PBX series of devices. The vulnerabilities allow an unauthenticated remote attacker to execute commands as root. This module requires Metasploi...

MTPutty 1.0.1.21 - SSH Password Disclosure Vulnerability

Exploit Title: MTPutty 1.0.1.21 - SSH Password Disclosure Exploit Author: Sedat Ozdemir Version: 1.0.1.21 Date: 06/12/2021 Vendor Homepage: https://ttyplus.com/multi-tabbed-putty/ Tested on: Windows 10 Proof of Concept ================ Step 1: Open MTPutty and add a new SSH connection. Step 2:...

Pentaho Business Analytics / Pentaho Business Server 9.1 Remote Code Execution Vulnerability

Pentaho allows users to create and run Pentaho Report Bundles .prpt. Users can create PRPT reports by utilizing the Pentaho Designer application and can include BeanShell Script functions to ease the production of complex reports. However, the BeanShell Script functions can allow for the executio...

Cacti v1.2.8 - Unauthenticated Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Cacti v1.2.8 - Unauthenticated Remote Code Execution Metasploit Exploit Author: Lucas Amorim sh286s CVE: CVE-2020-8813 Vendor Homepage: https://cacti.net/ Version: v1.2.8 Tested on: Linux This module requires Metasploit:...

Microsoft Windows (x84/x64) - Error Reporting Discretionary Access Control List / Local Privilege

Exploit for windows platform in category local exploits Microsoft Windows x84/x64 - 'Error Reporting' Discretionary Access Control List / Local Privilege Escalation EDIT: Apparently this was patched earlier this month.. so whatever. Windows Error Reporting Arbitrary DACL write It can take upwards...

Android Futex Requeue Kernel Exploit

This Metasploit module exploits a bug in futexrequeue in the linux kernel. Any android phone with a kernel built before June 2014 should be vulnerable. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web sit...

BBClone 0.31 (selectlang.php) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================= BBClone 0.31 selectlang.php Remote File Inclusion Vulnerability =================================================================...

AWStats 5.7 - 6.2 Multiple Remote Exploit (extra)

Exploit for cgi platform in category web applications ================================================= AWStats 5.7 - 6.2 Multiple Remote Exploit extra ================================================= / Awstats exploit "shell" code by omin0us omin0us208 at gmail dot com dtors security group .:...

WordPress Share Buttons - Social Media 1.0.2 SQL Injection Vulnerability

CVE-2024-55982 Share Buttons – Social Media = 1.0.2 - Unauthenticated SQL Injection Description The Share Buttons – Social Media plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of...

WordPress Admin Bar And Dashboard Access Control 1.28 XSS Vulnerability

WordPress Admin Bar and Dashboard Access Control plugin version 1.28 suffers from a persistent cross site scripting vulnerability. Exploit Title: WordPress Plugin Admin Bar & Dashboard Access Control Version: 1.2.8 - "Dashboard Redirect" field Stored Cross-Site Scripting XSS Exploit Author: Rachi...

Credit Lite 1.5.4 SQL Injection Vulnerability

Exploit Title: Credit Lite 1.5.4 - SQL Injection Exploit Author: CraCkEr Vendor: Hobby-Tech Vendor Homepage: https://codecanyon.net/item/credit-lite-micro-credit-solutions/39554392 Software Link: https://credit-lite.appshat.xyz/ Tested on: Windows 10 Pro Impact: Database Access CVE: CVE-2023-4407...

mooSocial 3.1.8 - Reflected XSS Vulnerability

Exploit Title: mooSocial 3.1.8 - Reflected XSS Exploit Author: CraCkEr Vendor: mooSocial Vendor Homepage: https://moosocial.com/ Software Link: https://travel.moosocial.com/ Version: 3.1.8 Tested on: Windows 10 Pro Impact: Manipulate the content of the site CVE: CVE-2023-4173 Greetings ThePitBull...

Osprey Pump Controller 1.0.1 Cross Site Request Forgery Vulnerability

!-- Osprey Pump Controller 1.0.1 Cross-Site Request Forgery Vendor: ProPump and Controls, Inc. Product web page: https://www.propumpservice.com | https://www.pumpstationparts.com Affected version: Software Build ID 20211018, Production 10/18/2021 Mirage App: MirageAppManager, Release 1.0.1 Mirage...

PrestaShop Ap Pagebuilder 2.4.4 SQL Injection Vulnerability

Exploit Title: AP PAGEBUILDER Prestashop module = 2.4.4 'productalloneimg' , 'imageproduct' Blind SQL Injection Exploit Author: Mohamed Ali Hammami Vendor Homepage: https://apollotheme.com/ Software Link : https://apollotheme.com/products/ap-pagebuilder-prestashop-module Version: 2.4.4 Tested on:...

macOS RawCamera Out-Of-Bounds Write Vulnerability

There is an out-of-bounds write vulnerability when decoding a certain flavor of RAW image files on macOS. The vulnerability has been confirmed on macOS 12.3.1. Although the advisory notes an attached poc, Google did not have one attached. MacOS: Out-of-bounds write in RawCamera There is an...

Aimeos Laravel ecommerce platform 2021.10 LTS - (sort) SQL injection Vulnerability

Exploit Title: Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection Exploit Author: Ilker Burak ADIYAMAN Vendor Homepage: https://aimeos.org Software Link: https://aimeos.org/laravel-ecommerce-package Version: Aimeos 2021.10 LTS Tested on: MacOSX Description: The Aimeos E-Commerce...

Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated) Exploit

Title: Grav CMS 1.7.10 - Server-Side Template Injection SSTI Authenticated Author: enox Vendor: https://getgrav.org/ Software Link: https://getgrav.org/download/core/grav-admin/1.7.10 Vulnerable Versions: Grav CMS 1.7.10 CVE: CVE-2021-29440 Credits:...

SteelCentral Aternity Agent 11.0.0.120 Privilege Escalation Vulnerability

======================================================================= title: Privilege Escalation Vulnerability product: SteelCentral Aternity Agent vulnerable version: 11.0.0.120 fixed version: CVE number: CVE-2020-15592, CVE-2020-15593 impact: Critical homepage: https://www.riverbed.com/gb/ b...

Broadcom CA Privilged Access Manager 2.8.2 - Remote Command Execution Exploit #RCE

Exploit for windows platform in category web applications Title: Broadcom CA Privilged Access Manager 2.8.2 - Remote Command Execution Author: Peter Lapp Vendor:...

MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass

MikroTik RouterOS 6.43.12 stable / 6.42.12 long-term - Firewall and NAT Bypass CVE-2019-3924 A remote, unauthenticated attacker can proxy traffic through RouterOS via probes sent to the agent binary. This PoC demonstrates how to exploit a LAN host from the WAN. A video demonstrating the attack ca...

File Upload Manager v1.3 exploit

Exploit for unknown platform in category web applications...

Peel Shopping 2.x Cross Site Scripting / SQL Injection Exploit

Peel Shopping versions 2.x and below 3.1 suffer from cross site scripting and remote SQL injection vulnerabilities. This was already noted discovery in 2012 by Cyber-Crystal but this data provides more details. Exploit Title: Peel Shopping "catid=" SQL injection Google Dork:...

Numbas < v7.3 - Remote Code Execution Exploit

Exploit Title: Numbas v7.3 - Remote Code Execution Exploit Author: Matheus Boschetti Vendor Homepage: https://www.numbas.org.uk/ Software Link: https://github.com/numbas/Numbas Version: 7.2 and below Tested on: Linux CVE: CVE-2024-27612 import sys, requests, re, argparse, subprocess, time from bs...

GL.iNet AR300M v3.216 Remote Code Execution Exploit

!/usr/bin/env python3 Exploit Title: GL.iNet = 3.216 Remote Code Execution via OpenVPN Client Google Dork: intitle:"GL.iNet Admin Panel" Date: XX/11/2023 Exploit Author: Michele 'cyberaz0r' Di Bonaventura Vendor Homepage: https://www.gli-net.com Software Link:...

LightFTP 1.1 Denial Of Service Exploit

!/usr/bin/perl use Net::FTP; Exploit Title: LightFTP 1.1 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 15 january 2024 Vendor Homepage: N/A Notification vendor: No reported Tested Version: LightFTP 1.1 Tested on: Window XP Professional - Service Pack 2 and 3 - English...

TYPO3 11.5.24 Path Traversal Vulnerability

Exploit Title: TYPO3 11.5.24 Path Traversal Vulnerability Authenticated Exploit Author: Saeed reza Zamanian Software Link: https://get.typo3.org/release-notes/11.5.24 Version: 11.5.24 Tested on: Kali 2022.3 CVE : CVE-2023-30451 In TYPO3 11.5.24, the filelist component allows attackers with access...

Zyxel Firewall SUID Binary Privilege Escalation Exploit

This Metasploit module exploits CVE-2022-30526, a local privilege escalation vulnerability that allows a low privileged user e.g. nobody escalate to root. The issue stems from a suid binary that allows all users to copy files as root. This module overwrites the firewall's crontab to execute an...

Algorithmia MSOL Remote Code Execution Vulnerability

Exploit Title: Algorithmia MSOL - Remote Code Execution Vendor Homepage: https://algorithmia.com/ Software Link: https://algorithmia.com/product Version: Affects all versions of the product up to the date of this submission Tested on: The issue affects all versions of the product up to the date o...

WordPress WP Symposium Pro 2021.10 Plugin - (wps_admin_forum_add_name) XSS Vulnerability

Exploit Title: WordPress Plugin WP Symposium Pro 2021.10 - 'wpsadminforumaddname' Stored Cross-Site Scripting XSS Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: http://www.wpsymposiumpro.com/ Software Link: https://wordpress.org/plugins/wp-symposium-pro/ Version: 2021.10 Tested o...

zlog 1.2.15 - Buffer Overflow Exploit

Exploit Title: zlog 1.2.15 - Buffer Overflow Exploit Author: LIWEI Vendor Homepage: https://github.com/HardySimpson/zlog Software Link: https://github.com/HardySimpson/zlog Version: v1.2.15 Tested on: ubuntu 18.04.2 1.- compile the zlogv1.2.15 code to a library. 2.- Use the "zloginit" API to pars...

Avaya IP Office 11 Insecure Transit / Password Disclosure Vulnerability

Avaya IP Office versions 9.1.8.0 through 11 suffer from an insecure transit vulnerability that allows for password disclosure. + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

FaceTime - VCPDecompressionDecodeFrame Memory Corruption Exploit

Exploit for macOS platform in category dos / poc FaceTime - VCPDecompressionDecodeFrame Memory Corruption Exploit There is a heap corruption vulnerability in VCPDecompressionDecodeFrame which is called by FaceTime. This bug can be reached if a user accepts a call from a malicious peer. The issue...

Microsoft Office Equation Editor Code Execution Exploit

This Metasploit module exploits a flaw in how the Equation Editor handles OLE objects in memory to execute arbitrary code using RTF files without interaction. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Workout Journal App 1.0 - Stored XSS Vulnerability

Exploit Title: Workout Journal App 1.0 - Stored XSS Exploit Author: MURAT CAGRI ALIS Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/17088/workout-journal-app-using-php-and-mysql-source-code.html Version: 1.0 Tested on: Windows / MacOS / Linux CVE...

WordPress IDonate Blood Request Management System 1.8.1 Cross Site Scripting Vulnerability

Exploit Title: IDonate – blood request management system XSS in Recaptcha secret key and in Recaptcha Site key 3- Click on save changes. 4- While clicking on the payload text, XSS will trigger. Vulnerable Code: public function idonaterecaptchasecretkeycallback if isset...

ManageEngine Access Manager Plus 4.3.0 - File-path-traversal Vulnerability

Exploit Title: ManageEngine Access Manager Plus 4.3.0 - File-path-traversal Author: nu11secur1ty Vendor: https://www.manageengine.com/ Software: https://www.manageengine.com/privileged-session-management/download.html Reference:...

WordPress Profile Builder 3.9.0 Missing Authorization Vulnerability

WordPress Profile Builder plugin versions 3.9.0 and below suffer from a missing authorization vulnerability in wppbtoolboxusermetahandler. Description: Profile Builder – User Profile & User Registration Forms get’. Finally, the function returns the value of the retrieved ‘key’ for the given...

Emporium eCommerce Online Shopping CMS 1.2 SQL Injection Vulnerability

┌┌────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable...

Sourcegraph Gitserver 3.36.3 - Remote Code Execution Exploit

Exploit Title: Sourcegraph Gitserver 3.36.3 - Remote Code Execution RCE Exploit Author: Altelus Vendor Homepage: https://about.sourcegraph.com/ Version: 3.63.3 Tested on: Linux CVE : CVE-2022-23642 Docker Container: sourcegraph/server:3.36.3 Sourcegraph prior to 3.37.0 has a remote code execution...

WordPress LayerSlider 7.1.2 Cross Site Scripting Vulnerability

Tittle: WordPress Plugin LayerSlider 5. Exit 6. Save Project 7. XSS will trigger when accessing the project again for example there seem to be other place when its triggered as well, like in the Project's settings POC2 via file,json 1. Add new post & Create Blank Project 2. Import Projects 3. Loa...

WAGO 750-8xxx PLC Denial Of Service / User Enumeration Vulnerability

WAGO 750-8xxx PLC versions prior to Firmware 20 Patch 1 v03.08.08 suffer from denial of service and user enumeration vulnerabilities. ======================================================================= title: Denial of service & User Enumeration product: WAGO 750-8xxx PLC vulnerable version:...

Reprise License Manager 14.2 Buffer Overflow Vulnerability

Product: Reprise License Manager 14.2 Vendor: Reprise Software CVE ID: CVE-2021-44154 Vulnerability Title: Authenticated Buffer Overflow Severity: High Authors: Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard Introduction: By using an...

Alchemy CMS 6.0.0 Arbitrary File Upload Vulnerability

Exploit Title: AlchemyCMS 2.x to 6.0.0 - Unrestricted File Upload authenticated Exploit Author: Abdulrahman https://twitter.com/infosec90 Vendor Homepage: https://alchemy-cms.com Software Link: https://github.com/AlchemyCMS/alchemycms Version: from 2.0 to 6.0.0 Tested on: Linux ruby 2.6.8p205 rai...

FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation Exploit

This Metasploit module exploits a race and use-after-free vulnerability in the FreeBSD kernel IPv6 socket handling. A missing synchronization lock in the IPV62292PKTOPTIONS option handling in setsockopt permits racing ip6setpktopt access to a freed ip6pktopts struct. This exploit overwrites the...

Cayin xPost 2.5 SQL Injection / Remote Code Execution Exploit

This Metasploit module exploits an unauthenticated remote SQL injection vulnerability in Cayin xPost versions 2.5 and below. The wayfindermeetinginput.jsp file's wayfinderseqid parameter can be injected blindly. Since this app bundles MySQL and Apache Tomcat the environment is pretty static and...

Windows Defender Antivirus 4.18.1908.7-0 File Extension Spoofing Vulnerability

David Haintz ======================================================================= title: File Extension Spoofing product: Windows Defender Antivirus vulnerable version: 4.18.1908.7-0 fixed version: Virus Definition Update of 2019/09/30 CVE number: - impact: High homepage:...