Wolf CMS 0.8.3.1 - Remote Code Execution Vulnerability

Exploit Title: Wolf CMS 0.8.3.1 - Remote Code Execution RCE Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://wolf-cms.readthedocs.io Software Link: https://github.com/wolfcms/wolfcms Version: 0.8.3.1 Tested on: Kali Linux Steps to Reproduce Firstly, go to the "Files" tab. Click on the...

CKEditor 5 35.4.0 - Cross-Site Scripting Vulnerability

Exploit Title: CKEditor 5 35.4.0 - Cross-Site Scripting XSS Exploit Author: Manish Pathak Vendor Homepage: https://cksource.com/ Software Link: https://ckeditor.com/ckeditor-5/download/ Version: 35.4.0 Tested on: Linux / Web CVE : CVE-2022-48110 CKSource CKEditor5 35.4.0 was discovered to contain...

Nacos 2.0.3 - Access Control vulnerability

Exploit Title: Nacos 2.0.3 - Access Control vulnerability Date: 2023-01-17 Exploit Author: Jenson Zhao Vendor Homepage: https://nacos.io/ Software Link: https://github.com/alibaba/nacos/releases/ Version: Up to including2.0.3 Tested on: Windows 10 CVE : CVE-2021-43116 Required before execution: p...

macOS Dirty Cow Arbitrary File Write Local Privilege Escalation Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'macOS Dirty Cow Arbitrary File Write Local Privilege Escalation', 'Description' = %q An app may be able to execute arbitrary code with kernel...

Genesys PureConnect Cross Site Scripting Vulnerability

Product: Genesys PureConnect - Interaction Web Tools Chat Service Description: Interaction Web Tools Chat Service allows XSS within the Printable Chat History via the participant - name JSON POST parameter. Vulnerability Type: XSS Vendor of Product: Genesys PureConnect Affected Product Code Base:...

Library Management System With QR Code 1.0 Cross Site Scripting Vulnerability

Title: Library Management System with QR code Attendance 1.0 Stored Cross-Site Scripting Author: Ashish Kumar https://www.linkedin.com/in/ashish-kumar-0b65a3184 Vendor: https://www.sourcecodester.com/users/kingbhob02 Software:...

Online Sports Complex Booking System 1.0 SQL Injection Vulnerability

Online Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability in Users.php. This is a similar issue as the one discovered by Saud Alenazi in March of 2022 but affects a different file. Title: Online Sports Complex Booking System 1.0 SQL Injection Author:...

aaPanel 6.8.21 Directory Traversal Vulnerability

Exploit Title: aaPanel 6.8.21 - Directory Traversal Authenticated Exploit Author: Fikrat Ghuliev Ghuliev Vendor Homepage: https://www.aapanel.com/ Software Link: https://www.aapanel.com Version: 6.8.21 Tested on: Ubuntu Application vulnerable to Directory Traversal and attacker can get root user...

Zepl Notebook Remote Code Execution Vulnerability

Exploit Title: Zepl Notebook - Remote Code Execution Vendor Homepage: https://zepl.com/ Software Link: https://app.zepl.com/ Version: All previous versions of product to the date of this submission Tested on: The issue affects all versions of the product up to the date of this submission Exploit...

CoreFTP Server build 725 - Directory Traversal (Authenticated) Vulnerability

Exploit Title: CoreFTP Server build 725 - Directory Traversal Authenticated Exploit Author: LiamInfosec Vendor Homepage: http://coreftp.com/ Version: build 725 and below Tested on: Windows 10 CVE : CVE-2022-22836 Description: CoreFTP Server before 727 allows directory traversal for file creation ...

D-Link Central WiFi Manager CWM(100) Remote Code Execution Exploit

This Metasploit module exploits a PHP code injection vulnerability in D-Link Central WiFi Manager CWM100 versions below v1.03R0100BETA6. The vulnerability exists in the username cookie, which is passed to eval without being sanitized. Dangerous functions are not disabled by default, which makes i...

Serv-U FTP Server 15.1.6.25 Local Privilege Escalation Vulnerability

Exploit for multiple platform in category local exploits CVE: CVE-2018-19999 Security researcher: Chris Moberly @ The Missing Link Security Product name: Serv-U FTP Server Product version: Tested on 15.1.6.25 current as of Dec 2018 Fixed in: 15.1.7 Overview The Serv-U FTP Server is vulnerable to...

Light Blog Remote Multiple Vulnerabilities Exploit

Exploit for unknown platform in category web applications ================================================== Light Blog Remote Multiple Vulnerabilities Exploit ================================================== !/usr/bin/php -q -d shortopentag=on \r\n"; echo "Thanks to rgod for the php code and...

Dockwatch Remote Command Execution Exploit

Dockwatch is a container management web UI for docker. It runs by default without authentication, although guidance is available for how to setup credentials for access. It has a Commands feature that allows a user to run docker commands such as inspect, network, ps. Prior to fix, it did not...

SpyCamLizard 1.230 Denial Of Service Exploit

!/usr/bin/perl use IO::Socket::INET; Exploit Title: SpyCamLizard 1.230 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 18 january 2024 Vendor Homepage: http://www.spycamlizard.com Download to demo:...

FreeSWITCH Denial Of Service Exploit

FreeSWITCH versions prior to 1.10.11 remote denial of service exploit that leverages a race condition in the hello handshake phase of the DTLS protocol. include include include include define IP "127.0.0.1" define PORT 5061 int main SSLlibraryinit; SSLloaderrorstrings; OpenSSLaddsslalgorithms;...

ShopSite 14.0 Cross Site Scripting Vulnerability

Exploit Title: ShopSite Version: 14.0 - Stored XSS Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://www.shopsite.com/ Version: 14.0 Tested on: https://www.shopsite.com/demo.html 1 Upload poc.svg file here : https://demo.shopsite.com/cgi-bin/ssdemos/stores/alsdemo/ss/mediam.cgi...

XCMS v1.83 - Remote Command Execution Exploit

Exploit Title: XCMS v1.83 - Remote Command Execution RCE Author: Onurcan Email: email protected Site: ihteam.net Script Download : http://www.xcms.it Date: 26/12/2022 The xcms's footerthat is in "/dati/generali/footer.dtb" is included in each page of the xcms. Taking "home.php" for example: So th...

Auto Dealer Management System 1.0 Privilege Escalation Vulnerability

Auto Dealer Management System - Broken Access Control leads to compromise of all application accounts by accessing the ?page=user/list with low privileged user account Author Email: email protected Vendor Homepage: https://www.sourcecodester.com Software Link: Auto Dealer Management System Versio...

Explore CMS 1.0 SQL Injection Vulnerability

Exploit Title: explore CMS - Boolean Based SQL Injection Exploit Author: Sajibe Kanti Vendor Name : EXPLORE IT Vendor Homepage: https://exploreit.com.bd CVE: On Request POC SQL Injection SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an...

Xerte 3.10.3 - Directory Traversal (Authenticated) Exploit

Exploit Title: Xerte 3.10.3 - Directory Traversal Authenticated Exploit Author: Rik Lutz Vendor Homepage: https://xerte.org.uk Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.9.zip Version: up until 3.10.3 Tested on: Windows 10 XAMP CVE : CVE-2021-44665...

Microsoft Windows Explorer Preview Pane HTML File Link Spoofing Vulnerability

The Windows Explorer Preview Pane feature allows for spoofing of links contained in an HTML based file because upon moving the mouse over the link nothing happens and it cannot be right-clicked to show the actual target. Exploit Title: Windows Explorer Preview Pane HTML File Link Spoofing...

Student Management System 1.0 - SQL injection Authentication Bypass Vulnerability

Exploit Title: Student Management System 1.0 - SQLi Authentication Bypass Exploit Author: Enes Özeser Vendor Homepage: https://www.sourcecodester.com/php/14268/student-management-system.html Version: 1.0 Tested on: Windows & WampServer CVE: CVE-2020-23935 1- Go to following url...

PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting Author: AppleBois Version: 7xx ≤ 746 Homepage: https://pandorafms.org/ Software Link: https://sourceforge.net/projects/pandora/files/Pandora FMS 7.0NG/ CVE-2020-11749 By...

Microsoft Windows VCF Denial Of Service Exploit

Microsoft Windows VCF cards do not properly sanitize email addresses allowing for HTML injection. A corrupt VCF card can cause all the users currently opened files and applications to be closed and their session to be terminated without requiring any accompanying attacker supplied code. + Credits...

Microsoft Windows - AppX Deployment Service Local Privilege Escalation (3) Exploit

Exploit for windows platform in category local exploits Microsoft Windows - AppX Deployment Service Local Privilege Escalation 3 CVE-2019-0841 BYPASS 2 There is a second bypass for CVE-2019-0841. This can be triggered as following: Delete all files and subfolders within...

Joomla Aist 2.0 Component - id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Aist = 2.0 - SQL Injection Vendor Homepage: http://aist.bmstu.ru/ Software Link: http://aist.bmstu.ru/ Version: = 2.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5993 Exploit Author: Ihsan...

Liferay Portal 7.0.x <= 7.0.2 - Pre-Auth RCE Exploit

Exploit for windows platform in category remote exploits !/bin/sh Exploit title: Liferay Portal 7.0 RCE Date: 11/16/2014 Exploit author: drone @dronesec Vendor homepage: http://www.liferay.com/ Software link:...

Supermicro Onboard IPMI Port 49152 Sensitive File Exposure Exploit

This module abuses a file exposure vulnerability accessible through the web interface on port 49152 of Supermicro Onboard IPMI controllers. The vulnerability allows an attacker to obtain detailed device information and download data files containing the clear-text usernames and passwords for the...

Compop Online Mall 3.5.3 Authentication Bypass Vulnerability

Exploit Title: Compop Online Mall Authentication Bypass Google Dork: Terms of Use inurl:compop.vip Exploit Author: dmlino Vendor Homepage: https://www.compop.ca/ Version: 3.5.3 CVE : CVE-2024-48445 Vulnerability Overview: The system uses a Unix timestamp "ts" parameter in URLs for authentication,...

SofaWiki 3.9.2 - Remote Command Execution (Authenticated) Exploit

Exploit Title: SofaWiki 3.9.2 - Remote Command Execution RCE Authenticated Discovered by: Ahmet Ümit BAYRAM Vendor Homepage: https://www.sofawiki.com Software Link: https://www.sofawiki.com/site/files/snapshot.zip Tested Version: v3.9.2 latest Tested on: MacOS import requests import random import...

MobileShop master v1.0 - SQL Injection Vulnerability

Exploit Title: MobileShop master v1.0 - SQL Injection Vuln. + Exploit Author: "HAZIM ARBAŞ" from EMA Security LTD - Siber Güvenlik ve Bilişim Hizmetleri https://emasecurity.com + Vendor Homepage: https://code-projects.org/mobile-shop-in-php-css-javascript-and-mysql-free-download/ + Software Link:...

SecurePoint UTM 12.x Session ID Leak Vulnerability

ADVISORY INFORMATION ======================= Product: SecurePoint UTM Vendor URL: https://www.securepoint.de/en/for-companies/firewall-vpn Type: Exposure of Sensitive Information to an Unauthorized Actor CWE-200 Date found: 2023-01-05 Date published: 2023-04-11 CVSSv3 Score: 9.0...

ClicShopping 3.402 Cross Site Scripting Vulnerability

Title: ClicShoppingV3-Version3.402 XSS-Reflected Author: nu11secur1ty Vendor: https://www.clicshopping.org/forum/ Software: https://github.com/ClicShopping/ClicShoppingV3/releases/tag/version3402 Reference:...

Bookwyrm v0.4.3 - Authentication Bypass Vulnerability

Exploit Title: Bookwyrm v0.4.3 - Authentication Bypass Exploit Author: Akshay Ravi Vendor Homepage: https://github.com/bookwyrm-social/bookwyrm Software Link: https://github.com/bookwyrm-social/bookwyrm/releases/tag/v0.4.3 Version: = 4.0.3 Tested on: MacOS Monterey CVE: CVE-2022-2651 Original...

Simple Payroll System 1.0 - SQL injection Authentication Bypass Vulnerability

Exploit Title: Simple Payroll System 1.0 - SQLi Authentication Bypass Exploit Author: Yash Mahajan Vendor Homepage: https://www.sourcecodester.com/php/14974/simple-payroll-system-dynamic-tax-bracket-php-using-sqlite-free-source-code.html Software Link:...

BSCW Server Remote Code Execution Vulnerability

BSCW Server versions 7.4.2 and below, 7.3.2 and below, 5.2.3 and below, 5.1.9 and below, and 5.0.11 and below suffer from an authenticated remote code execution vulnerability. ======================================================================= title: Authenticated RCE product: BSCW Server...

OpenBSD Dynamic Loader chpass Privilege Escalation Exploit

This Metasploit module exploits a vulnerability in the OpenBSD ld.so dynamic loader CVE-2019-19726. The dlgetenv function fails to reset the LDLIBRARYPATH environment variable when set with approximately ARGMAX colons. This can be abused to load libutil.so from an untrusted path, using...

BitZoom 1.0 - rollno SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: BitZoom 1.0 - 'rollno' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://bitzoom.sourceforge.io/ Software Link: https://excellmedia.dl.sourceforge.net/project/bitzoom/bitzoom-master.zip Version: 1.0 Category:...

Mumsoft Easy Software 2.0 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: Mumsoft Easy Software 2.0 - Denial of Service PoC Exploit Author: Ihsan Sencan Vendor Homepage: https://www.munsoft.com/EasyRARRecovery/ Software Link:...

Webiness Inventory 2.9 Shell Upload Exploit

Exploit for php platform in category web applications Exploit Title: Webiness Inventory 2.9 Arbitrary File Upload Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Software Link: https://github.com/webiness/webinessinventory Version: 2.9 46 foreach $FILES as $file 47 $fileName =...

Seagate GoFlex Satellite Remote Telnet Default Password Vulnerability

Seagate GoFlex Satellite Mobile Wireless Storage devices contain a hardcoded backdoor account. An attacker could use this account to remotely tamper with the underlying operating system when Telnet is enabled. Title: Seagate GoFlex Satellite Remote Telnet Default Password Publication URL:...

DNS Reverse Lookup Shellshock Exploit

DNS reverse lookups can be used as a vector of attack for the bash shellshock vulnerability. DNS Reverse Lookup as a vector for the Bash vulnerability CVE-2014-6271 et.al. CVE-2014-3671 references: CVE-2014-6271, CVE-2014-7169, CVE-2014-6277, CVE-2014-6278 CVE-2014-7186 and, CVE-2014-7187 Summary...

/bin/sh Polymorphic shellcode with printable ASCII characters

Exploit for generator platform in category shellcode ============================================================= /bin/sh Polymorphic shellcode with printable ASCII characters =============================================================...

All Club CMS <= 0.0.2 index.php Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================== All Club CMS No go on the hack attempt."; // log attempt, from IP, etc. if $SYSSET'banattackip' // ban ip if banattackip die; $sth = $dbh-prepare"SELECT FROM accmsmodules...

Akuvox Smart Intercom/Doorphone ServicesHTTPAPI Improper Access Control Vulnerability

The Akuvox Smart Intercom/Doorphone suffers from an insecure service API access control. The vulnerability in ServicesHTTPAPI endpoint allows users with "User" privileges to modify API access settings and configurations. This improper access control permits privilege escalation, enabling...

Wordpress Travelscape v1.0.3 Theme - Arbitrary File Upload Exploit

Exploit Title: Wordpress Theme Travelscape v1.0.3 - Arbitrary File Upload Author: Milad Karimi Ex3ptionaL Category : webapps Tested on: windows 10 , firefox import sys import os.path import requests import re import urllib3 from requests.exceptions import SSLError from multiprocessing.dummy impor...

Firefox 121 / Chrome 120 Denial Of Service Exploit

Minor firefox DoS - semi silently polluting /Downloads with files part 2 Tested on: firefox 121 and chrome 120 on GNU/linux Date: Thu Jan 18 08:38:28 AM UTC 2024 This is barely a DoS, but since it might affect Chrome too we decided to disclose it. If firefox user visits a specially crafted page,...

MCL-Net 4.3.5.8788 - Information Disclosure Vulnerability

Exploit Title: MCL-Net 4.3.5.8788 - Information Disclosure Exploit Author: Victor A. Morales, GM Sectec Inc. Vendor Homepage: https://www.mcl-mobilityplatform.com/net.php Version: 4.3.5.8788 other versions may be affected Tested on: Microsoft Windows 10 Pro CVE: CVE-2023-34834 Description:...

Bludit 4.0.0-rc-2 Privilege Escalation Vulnerability

Bludit version 4.0.0-rc-2 suffers from an account takeover vulnerability due to an API key that can be abused to change the administrative password. Title: Bludit-4.0.0-rc-2 - Release candidate 2 Account takeover: API token vulnerability Author: nu11secur1ty Date: 04.11.2013 Vendor:...