SolarView Compact 6.0 - OS Command Injection Vulnerability

Exploit Title: SolarView Compact 6.0 - OS Command Injection Exploit Author: Ahmed Alroky Author Company : AIactive Version: ver.6.00 Vendor home page : https://www.contec.com/ Authentication Required: No CVE : CVE-2022-29303 Tested on: Windows Exploit HTTP Request : POST /confmail.php HTTP/1.1...

IpMatcher 1.0.4.1 Server-Side Request Forgery Vulnerability

IpMatcher versions 1.0.4.1 and below for .NET Core 2.0 and .NET Framework 4.5.2 incorrectly validates octal and hexadecimal input data which can lead to indeterminate server-side request forgery, local file inclusion, remote file inclusion, and denial of service vectors. Exploit Title: SSRF in .N...

Toll Tax Management System v1.0 SQL injection Vulnerability

Title: Toll Tax Management System v1.0 SQLi Author: nu11secur1ty Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15304/toll-tax-management-system-phpoop-free-source-code.html Reference:...

Torrent Video Cutter V1.93 Build 114 Denial of Service Exploit

Exploit Title: Torrent Video Cutter V1.93 Build 114 Denial of Service Exploit Date: 20.4.2022 Vendor Homepage:http://www.torrentrockyou.com Software Link: https://down10.software/download-torrent-video-cutter/post-download/ Exploit Author: Achilles Tested Version: V1.93 Build 114 Tested on: Windo...

SAP Information System 1.0 Shell Upload Exploit

Title: SAP Information System 1.0 Shell Upload Author: Hejap Zairy Date: 05.04.2022 Vendor: https://www.sourcecodester.com/php/15262/sap-information-system-using-phppdo-oop.html Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/SAPInformationSystem.zip Reference:...

ImpressCMS 1.4.2 Authentication Bypass Vulnerability

----------------------------------------------------------------------- ImpressCMS stripSlashesGPC$autologinName; 46. $pass = $myts-stripSlashesGPC$autologinPass; 47. if empty$uname || isnumeric$pass 48. $user = false ; 49. else 50. // V3 51. $uname4sql = addslashes$uname; 52. $criteria = new...

WOW21 5.0.1.9 - (Service WOW21_Servic) Unquoted Service Path Vulnerability

Exploit Title: WOW21 5.0.1.9 - 'Service WOW21Service' Unquoted Service Path Exploit Author: Antonio Cuomo arkantolo Vendor : ilwebmaster21 Version : WOW21Service 5.0.1.9 Vendor Homepage : https://wow21.life/ Tested on OS: Windows 10 Pro x64 PoC : ============== C:\sc qc WOW21Service SC...

Cobian Backup 0.9 - Unquoted Service Path Vulnerability

Exploit Title: Cobian Backup 0.9 - Unquoted Service Path Date: 06/03/2022 Exploit Author: Hejap Zairy Vendor Homepage: https://www.cobiansoft.com// Software Link: https://www.cobiansoft.com/download.php/ Version:0.9.93 Tested: Windows 10 Pro x64 es C:\Users\Hejapsc qc CobianReflectorService SC...

Oracle WebLogic Server Administration Console Handle Remote Code Execution Exploit

This Metasploit module exploits a path traversal and a Java class instantiation in the handle implementation of WebLogic's Administration Console to execute code as the WebLogic user. Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 are known to be affected. Tested against...

Jira 8.3.4 - Information Disclosure (Username Enumeration) Exploit

Exploit for java platform in category web applications Exploit Title: Jira 8.3.4 - Information Disclosure Username Enumeration Exploit Author: Mufeed VH Vendor Homepage: https://www.atlassian.com/ Software Link: https://www.atlassian.com/software/jira Version: 8.3.4 Tested on: Pop!OS 19.10 CVE :...

Windows Kernel - Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File

We have encountered a Windows kernel crash in CI!CipFixImageType while trying to load a malformed PE image into the process address space as a data file i.e. LoadLibraryExLOADLIBRARYASDATAFILE | LOADLIBRARYASIMAGERESOURCE. An example crash log generated after triggering the bug is shown below: --...

Windows/x86 - Start iexplore.exe (http://192.168.10.10/) Shellcode (191 Bytes)

191 bytes small Windows/x86 start iexplore.exe shellcode. / Title: start iexplore.exe Author: Joseph McDonagh Shellcode length 191 Could be smaller if the app your are exploiting loads msvcrt. Purpose: Use the start command to open internet explorer and connect to a malicious web server The comma...

Thunderbird ESR < 60.7.XXX - icalmemorystrdupanddequote Heap-Based Buffer Overflow Vulnerability

Heap-based buffer overflow in Thunderbird ========================================= Severity Rating: High Confirmed Affected Versions: All versions affected Confirmed Patched Versions: Thunderbird ESR 60.7.XXX Vendor: Thunderbird Vendor URL: https://www.thunderbird.net/ Vendor Reference:...

iServiceOnline 1.0 - r SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: iServiceOnline 1.0 - 'r' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://sourceforge.net/projects/iserviceonline/ Software Link: https://netcologne.dl.sourceforge.net/project/iserviceonline/iServiceEng.zip...

CuteFTP 9.3.0.3 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: CuteFTP 9.3.0.3 - Denial of Service PoC Exploit Author: Ismael Nava Vendor Homepage: https://www.globalscape.com/cuteftp Software Link: https://www.globalscape.com/cuteftp Version: 9.3.0.3 Tested on: Windows 10 Home x64 CVE : n/a...

Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.1 Bypass (MS12-037)

Exploit for windows platform in category remote exploits function strtointstr return str.charCodeAt10x10000 + str.charCodeAt0; var free = "EEEE"; while free.length 500 free += free; var string1 = "AAAA"; while string1.length 500 string1 += string1; var string2 = "BBBB"; while string2.length 500...

e107 Plugin - Tap Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

PHPWebThings <= 1.4 (forum) SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================= PHPWebThings / && print "+ MD5 hash of password is: $1\n"; print "- Unable to retrieve hash of password\n" if!$1; 0day.today 2018-04-08...

Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution Exploit

Exploit Title: Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution RCE Date: 4/23/2023 Author: Or4nG.M4n Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Music Gallery Site v1.0 - Broken Access Control Vulnerability

Exploit Title: Music Gallery Site v1.0 - Broken Access Control Exploit Author: Muhammad Navaid Zafar Ansari CVE Assigned: CVE-2023-0963 mitre.org nvd.nist.org Vendor Homepage: https://www.sourcecodester.com Software Link: Music Gallery Site Version: v 1.0 Tested on: Windows 11 Broken...

D-Link DIR-846 - Remote Command Execution Vulnerability

Exploit Title: D-Link DIR-846 - Remote Command Execution RCE vulnerability Exploit Author: Françoa Taffarel Vendor Homepage: https://www.dlink.com.br/produto/roteador-dir-846-gigabit-wi-fi-ac1200/suportehttps://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip Software...

HotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path Vulnerability

Exploit Title: HotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path Exploit Author : Wim Jaap van Vliet Vendor Homepage: www.clevo.com.tw Software Link: https://enstrong.blob.core.windows.net/en-driver/PDXXPNX1/Others/CC301006.zip Version: 2.1.0.6 Tested on: Windows 11 Pro...

Virtual Reception v1.0 - Web Server Directory Traversal Vulnerability

Exploit Title: Virtual Reception v1.0 - Web Server Directory Traversal Exploit Author: Spinae Vendor Homepage: https://www.virtualreception.nl/ Version: win7sp1rtm.101119-1850 6.1.7601.1.0.65792 running on an Intel NUC5i5RY Tested on: all We discovered the web server of the Virtual Reception...

Joomla JS Jobs Pro 1.3.6 SQL Injection Vulnerability

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ Exploits ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : extensions.joomla.org │ │ Vendor : Joom Sky - joomsky.com │ │...

Telesquare SDT-CW3B1 1.1.0 - OS Command Injection Exploit

!/usr/bin/python3 Exploit Title: Telesquare SDT-CW3B1 1.1.0 - OS Command Injection Date: 24th May 2022 Exploit Author: Bryan Leong Vendor Homepage: http://telesquare.co.kr/ CVE : CVE-2021-46422 Authentication Required: No import requests import argparse import sys from xml.etree import ElementTre...

Microfinance Management System 1.0 Cross Site Scripting Vulnerability

Exploit Title: Microfinance Management System 1.0 - Cross-site scripting stored unauthenticated Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/14822/microfinance-management-system.html Version: 1.0 Tested on: Linux Title: ================ Microfinance Management System...

VIVE Runtime Service - (ViveAgentService) Unquoted Service Path Vulnerability

Exploit Title: VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path Exploit Author: Faisal Alasmari Vendor Homepage: https://www.vive.com/ Software Link: https://developer.vive.com/resources/downloads/ Version: 1.0.0.4 Tested: Windows 10 x64 C:\Users\Usersc qc "VIVE Runtime Service" SC...

OpenBMCS 2.4 Remote Privilege Escalation Vulnerability

OpenBMCS 2.4 Create Admin / Remote Privilege Escalation Vendor: OPEN BMCS Product web page: https://www.openbmcs.com Affected version: 2.4 Summary: Building Management & Controls System BMCS. No matter what the size of your business, the OpenBMCS software has the ability to expand to hundreds of...

Denver Smart Wifi Camera SHC-150 - (Telnet) Remote Code Execution Vulnerability

Exploit Title: Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution RCE Exploit Author: Ivan Nikolsky enty8080 Vendor Homepage: https://denver.eu/products/smart-home-security/denver-shc-150/c-1024/c-1243/p-3824 Version: Denver SHC-150 all firmware versions Tested on: Denver SHC-150...

Shenzhen Skyworth RN510 Information Disclosure Vulnerability

Overview ======== Title:- UnAuthenticated Sensitive information Discloser in RN510 Mesh Extender. CVE-ID :- CVE-2021-25326 Author: Kaustubh G. Padwad Vendor: Shenzhen Skyworth Digital Technology Company Ltd.http://www.skyworthdigital.com/products Products: 1. RN510 with firmware V.3.1.0.4 Tested...

EverSync 0.5 - Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: EverSync 0.5 - Arbitrary File Download Exploit Author: Ihsan Sencan Vendor Homepage: https://phpmassmail.sourceforge.io/ Software Link:...

D-LINK Central WifiManager (CWM 100) 1.03 r0098 Man-In-The-Middle Vulnerability

The FTP Server component of the D-LINK Central WifiManager can be used as a man-in-the-middle machine allowing PORT Command bounce scan attacks. This vulnerability allows remote attackers to abuse your network and discreetly conduct network port scanning. Victims will then think these scans are...

ModSecurity WAF 3.0 for Nginx - Denial of Service Vulnerability

Exploit for linux platform in category dos / poc / 1. Use-After-Free UAF / During one of the engagements my team tested a WAF running in production Nginx + ModSecurity + OWASP Core Rule Set 123. In the system logs I found information about the Nginx worker processes being terminated due to memory...

Oracle E-Business Suite 12.2.3 - IESFOOTPRINT SQL Injection Vulnerability

Exploit for jsp platform in category web applications Application: Oracle E-Business Suite Versions Affected: Oracle EBS 12.2.3 Vendor URL: http://oracle.com Bug: SQL injection Reported: 23.12.2016 Vendor response: 24.12.2016 Date of Public Advisory: 18.04.2017 Reference: Oracle CPU April 2017...

PHP-Fusion 7.02.05 XSS / LFI / SQL Injection Vulnerabilities

PHP-Fusion version 7.02.05 suffers from insecure backup handling, cross site scripting, local file inclusion, and remote SQL injection vulnerabilities. Multiple Vulnerabilities in PHP-Fusion 7.02.05 ===================================================== Author: Janek Vind "waraxe" Date: 27. Februa...

Woltlab Burning Board <= 1.0.2, 2.3.6 search.php SQL Injection Exploit 2

Exploit for unknown platform in category web applications ======================================================================== Woltlab Burning Board = 1.0.2, 2.3.6 search.php SQL Injection Exploit 2 ======================================================================== !/usr/bin/perl Woltla...

NoteMark < 0.13.0 - Stored XSS Vulnerability

Exploit Title: Stored XSS in NoteMark Exploit Author: Alessio Romano sfoffo Vendor Homepage: https://notemark.docs.enchantedcode.co.uk/ Version: 0.13.0 and below Tested on: Linux References: https://notes.sfoffo.com/contributions/2024-contributions/cve-2024-41819,...

ProSysInfo TFTP Server TFTPDWIN 0.4.2 Denial Of Service Exploit

!/usr/bin/perl use IO::Socket::INET; Exploit Title: ProSysInfo TFTP Server TFTPDWIN 0.4.2 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 20 january 2024 Vendor Homepage: N/A Download to demo: https://drive.google.com/file/d/1MLqBkCyu0dA-cNgYxCAO8xbsVcof060Z/view?usp=sharin...

GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution Vulnerability

Exploit Title: GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution Exploit Author: p4r4bellum Vendor Homepage: https://getgreenshot.org Software Link: https://getgreenshot.org/downloads/ Version: 1.2.6.10 Tested on: windows 10.0.19045 N/A build 19045 CVE : CVE-2023-34634 GreenSho...

PHPFusion 9.10.30 - Stored Cross-Site Scripting Vulnerability

Exploit Title: PHPFusion 9.10.30 - Stored Cross-Site Scripting XSS Application: PHPFusion Version: 9.10.30 Bugs: XSS Technology: PHP Vendor URL: https://www.php-fusion.co.uk/home.php Software Link: https://sourceforge.net/projects/php-fusion/ Date of found: 28-04-2023 Author: Mirabbas Ağalarov...

revive-adserver v5.4.1 - Cross-Site Scripting Vulnerability

Exploit Title: revive-adserver v5.4.1 - Cross-Site Scripting XSS Application: revive-adserver Version: 5.4.1 Bugs: XSS Technology: PHP Vendor URL: https://www.revive-adserver.com/ Software Link: https://www.revive-adserver.com/download/ Date of found: 31-03-2023 Author: Mirabbas Ağalarov Tested o...

SuperMailer v11.20 - Buffer overflow DoS Vulnerability

Exploit Title: SuperMailer v11.20 - Buffer overflow DoS Exploit Author: Rafael Pedrero Vendor Homepage: https://int.supermailer.de/downloadnewslettersoftware.htm Software Link : https://int.supermailer.de/smintsw.zip / https://int.supermailer.de/smintswx64.zip Tested Version: v11.20 32bit/64bit...

Joomla Rentalot Plus 19.05 Cross Site Scripting Vulnerability

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ Exploits ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : extensions.joomla.org │ │ Vendor : Les Arbres Design │ │ Software :...

Marval MSM v14.19.0.12476 - Cross-Site Request Forgery Vulnerability

Exploit Title: Marval MSM v14.19.0.12476 - Cross-Site Request Forgery CSRF Exploit Author: Momen Eldawakhly Cyber Guy Vendor Homepage: https://www.marvalnorthamerica.com/ Software Link: https://www.marvalnorthamerica.com/ Version: v14.19.0.12476 Tested on: Windows PoCs:...

Spoofer 1.4.6 Privilege Escalation / Unquoted Service Path Vulnerabilities

Exploit Title: Spoofer 1.4.6 – Local Privilege Escalation via Unquoted Service Path Exploit Author: Asim Sattar @MAsim1 Vendor Homepage: https://www.caida.org/projects/spoofer/ Software Link: https://www.caida.org/projects/spoofer/downloads/Spoofer-1.4.6-win32.exe Version: 1.4.6 Tested: Windows 1...

uDoctorAppointment v2.1.1 - (Multiple) Cross Site Scripting Vulnerability

Exploit Title: uDoctorAppointment v2.1.1 - 'Multiple' Cross Site Scripting XSS Document Title: =============== uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities Product & Service Introduction: =============================== Clinic management, doctor or therapist online medical appointment...

Yellowfin Cross Site Scripting / Insecure Direct Object Reference Vulnerabilities

Yellowfin versions prior to 9.6.1 suffer from persistent cross site scripting and insecure direct object reference vulnerabilities. YELLOWFIN 9.6.1 MULTIPLE VULNERABILITIES ---------------------------------------------------- Vulnerability: ============== Stored Cross-Site Scripting Affected...

Simple Issue Tracker System 1.0 - SQL injection Authentication Bypass Vulnerability

Exploit Title: Simple Issue Tracker System 1.0 - SQLi Authentication Bypass Exploit Author: Bekir Bugra TURKOGLU Vendor Homepage: https://www.sourcecodester.com/php/14938/simple-issue-tracker-system-project-using-php-and-sqlite-free-download.html Software Link:...

Wordpress TheCartPress 1.5.3.6 Plugin - Privilege Escalation Exploit

Exploit Title: Wordpress Plugin TheCartPress 1.5.3.6 - Privilege Escalation Unauthenticated Google Dork: inurl:/wp-content/plugins/thecartpress/ Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugin/thecartpress Version: spacehen www.github.com/spacehen" def printusage:...

QRadar Community Edition 7.3.1.6 Default Credentials Vulnerability

QRadar Community Edition version 7.3.1.6 is deployed with a default password for the ConfigServices account. Using this default password it is possible to download configuration sets containing sensitive information, including encrypted credentials and host tokens. With these host tokens it is...