Multiple CPUs - Spectre Information Disclosure (PoC) Exploit

Exploit for multiple platform in category local exploits include include include ifdef MSCVER include / for rdtscp and clflush / pragma optimize"gt",on else include / for rdtscp and clflush / endif / Victim code. / unsigned int array1size = 16; uint8t unused164; uint8t array1160 =...

Zervit Webserver 0.4 Directory Traversal / Memory Corruption PoC

Exploit for windows platform in category remote exploits ================================================================ Zervit Webserver 0.4 Directory Traversal / Memory Corruption PoC ================================================================ Zervit webserver 0.4 Directory Traversal &...

SOPlanning 1.52.00 SQL Injection Vulnerability

Exploit Title: SOPlanning v1.52.00 'projets.php' SQLi Application: SOPlanning Version: 1.52.00 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE: Not yet assigned Description:...

ESET Service 16.0.26.0 - (Service ekrn) Unquoted Service Path Vulnerability

Exploit Title: ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path Exploit Author: Milad Karimi Ex3ptionaL Vendor : https://www.eset.com Version : 16.0.26.0 Tested on OS: Microsoft Windows 11 pro x64 PoC : ============== C:\sc qc ekrn SC QueryServiceConfig SUCCESS SERVICENAME: ekrn TYPE...

Kimai 1.30.10 - SameSite Cookie session hijacking Exploit

Exploit Title: Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking Author: nu11secur1ty Vendor: https://www.kimai.org/ Software: https://github.com/kimai/kimai/releases/tag/1.30.10 Reference: https://www.thesslstore.com/blog/the-ultimate-guide-to-session-hijacking-aka-cookie-hijacking...

WordPress Stafflist 3.1.2 SQL Injection Vulnerability

Exploit Title: WordPress Plugin stafflist 3.1.2 - SQL Injection Authenticated Exploit Author: Hassan Khan Yusufzai - Splint3r7 Vendor Homepage: https://wordpress.org/plugins/stafflist/ Version: 3.1.2 Tested on: Firefox Contact me: h at spidersilk.com Vulnerable Code: $w = isset$GET'search' &&...

WordPress Security Audit 1.0.0 Plugin - Stored Cross Site Scripting Vulnerability

Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting XSS Exploit Author: Shweta Mahajan Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/ Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/ Tested on Windows CVE...

Archeevo 5.0 - Local File Inclusion Vulnerability

Exploit Title: Archeevo 5.0 - Local File Inclusion Google Dork: intitle:"archeevo" Exploit Author: Miguel Santareno Vendor Homepage: https://www.keep.pt/ Software Link: https://www.keep.pt/produtos/archeevo-software-de-gestao-de-arquivos/ Version: 5.0 Tested on: windows 1. Description...

WordPress Media-Tags 3.2.0.2 Plugin - Stored Cross-Site Scripting Vulnerability

Exploit Title: WordPress Plugin Media-Tags 3.2.0.2 - Stored Cross-Site Scripting XSS Exploit Author: Akash Rajendra Patil Vendor Homepage: https://wordpress.org/plugins/media-tags/ Software Link: www.codehooligans.com/projects/wordpress/media-tags/ Version: 3.2.0.2 Tested on Windows How to...

WordPress Advanced Order Export For WooCommerce 3.1.7 Plugin - Reflected XSS Vulnerability

Exploit Title: WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting XSS Author: 0xB9 Software Link: https://wordpress.org/plugins/woo-order-export-lite/ Version: 3.1.7 Tested on: Windows 10 CVE: CVE-2021-24169 1. Description: This plugin helps you to easil...

Microsoft Internet Explorer 11 32-bit - Use-After-Free Exploit

Exploit Title: Microsoft Internet Explorer 11 32-bit - Use-After-Free Exploit Author: deadlock Forrest Orr Vendor Homepage: https://www.microsoft.com/ Software Link: https://www.microsoft.com/en-gb/download/internet-explorer.aspx Version: IE 8, 9, 10, and 11 Tested on: Windows 7 x64 and Windows 7...

Client Management System 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Client Management System 1.0 - 'searchdata' SQL Injection Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Prime95 Version 29.8 build 6 - Buffer Overflow (SEH) Exploit

Exploit Title: Prime95 Version 29.8 build 6 - Buffer Overflow SEH Vendor Homepage: https://www.mersenne.org Software Link: http://www.mersenne.org/ftproot/gimps/p95v298b6.win32.zip Exploit Author: Achilles Tested Version: 29.8 build 6 Tested on: Windows 7 x64 1.- Run python code:Prime95.py 2.- Op...

SeedDMS < 5.1.11 - (out.GroupMgr.php) Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Persistent Cross-Site Scripting or Stored XSS in out/out.GroupMgr.php in SeedDMS before 5.1.11 Exploit Author: Nimit Jainhttps://secfolks.blogspot.com Vendor Homepage: https://www.seeddms.org Software Link:...

Cisco Prime Infrastructure Unauthenticated Remote Code Execution Exploit

Cisco Prime Infrastructure CPI contains two basic flaws that when exploited allow an unauthenticated attacker to achieve remote code execution. The first flaw is a file upload vulnerability that allows the attacker to upload and execute files as the Apache Tomcat user; the second is a privilege...

Joomla com_propiedades Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Joomla comcompropiedades Multiple Vulnerabilities Date: 23.06.2011 Author: z0mbyak Vendor or Software Link: find by yourself Version: Don't know Category: remote, webapps. Google dork: inurl:"index.php?option=com propiedades"...

PHP Login Script v 2.3 SQL Injection vulnerability

Exploit for php platform in category web applications ================================================== PHP Login Script v 2.3 SQL Injection vulnerability ================================================== Exploit Title: PHP Login Script v 2.3 SQL Injection vulnerability. Date: 23/7 2010 Author:...

ABB Cylon Aspect 3.08.01 persistenceManagerAjax.php Directory Traversal Vulnerability

ABB Cylon Aspect version 3.08.01 has a directory traversal vulnerability that can be exploited by an unauthenticated attacker to list the contents of arbitrary directories without reading file contents, leading to information disclosure of directory structures and filenames. This may expose...

Perch v3.2 - Remote Code Execution Exploit

Exploit Title: Perch v3.2 - Remote Code Execution RCE Application: Perch Cms Version: v3.2 Bugs: RCE Technology: PHP Vendor URL: https://grabaperch.com/ Software Link: https://grabaperch.com/download Date of found: 21.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC...

WBCE CMS 1.6.1 - Open Redirect & CSRF Vulnerability

Exploit Title: WBCE CMS 1.6.1 - Open Redirect & CSRF Version: 1.6.1 Bugs: Open Redirect + CSRF = CSS KEYLOGGING Technology: PHP Vendor URL: https://wbce-cms.org/ Software Link: https://github.com/WBCE/WBCECMS/releases/tag/1.6.1 Date of found: 03-07-2023 Author: Mirabbas Ağalarov Tested on: Linux ...

PCProtect Endpoint 5.17.470 Tampering / Privilege Escalation Vulnerability

PCProtect Endpoint version 5.17.470 fails to provide sufficient anti-tampering protection that can be leveraged to achieve SYSTEM privileges. + Credits: Yehia Elghaly aka Mrvar0x + Website: https://mrvar0x.com/ + Source: https://mrvar0x.com/2022/07/21/pcprotect-endpoint-tampering-exploit/ Vendor:...

WordPress Blue Admin 21.06.01 Plugin - Cross-Site Request Forgery Vulnerability

Exploit Title: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery CSRF Exploit Author : WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery CSRF Vendor Homepage : https://wpscan.com/plugin/blue-admi Version : alert/XSS/' /...

Home Clean Service System v1.0 - 2022 SQL injection Vulnerability

Title: Home Clean Service System v1.0 - 2022 SQLi Author: nu11secur1ty Vendor: https://www.sourcecodester.com/users/acetech Software: https://www.sourcecodester.com/php/15293/home-clean-service-free-source-code.html Reference:...

Online Project Time Management System 1.0 - SQL injection Vulnerability (2)

Exploit Title: Online Project Time Management System 1.0 - SQLi Authenticated Exploit Author: Felipe Alcantara Filiplain Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15136/online-project-time-management-system-phpoop-free-source-code.html...

Codiad 2.8.4 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Codiad 2.8.4 - Remote Code Execution Authenticated Discovery by: WangYihang Vendor Homepage: http://codiad.com/ Software Links : https://github.com/Codiad/Codiad/releases Tested Version: Version: 2.8.4 CVE: CVE-2018-14009 ​ !/usr/bin/env python encoding: utf-8 ​ import requests...

Bolt CMS 3.7.0 XSS / CSRF / Shell Upload Vulnerabilities

Bolt CMS versions 3.7.0 and below suffer from cross site request forgery, cross site scripting, and remote shell upload vulnerabilities that when combined can achieve remote code execution in one click. Bolt CMS = 3.7.0 Multiple Vulnerabilities Author - Sivanesh Ashok | @sivaneshashok | stazot.co...

OpenSMTPD - MAIL FROM Remote Code Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenSMTPD MAIL FROM Remote Code Execution', 'Description' = %q This module exploits a command injection in the MAIL FROM field during SMTP...

Linux/x86 - Reposition + INC encoder with execve(/bin/sh) Shellcode (66 bytes)

Title: Linux/x86 - Reposition + INC encoder with execve/bin/sh Shellcode 66 bytes Author: Jonathan So Purpose: decode and spawn a /bin/sh shell Tested On: Linux kali 4.19.0-kali4-686 1 SMP Debian 4.19.28-2kali1 2019-03-18 i686 GNU/Linux Arch: x86 Size: 66 bytes Write-up Link:...

Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal Exploit

Exploit for windows platform in category web applications Exploit Title: Directory traversal in Oracle Business Intelligence Exploit Author: @vah13 Vendor Homepage: http://oracle.com Software Link: https://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/index.html Version:...

phpMyAdmin 4.8.1 Code Execution / Local File Inclusion Vulnerabilities

Exploit for php platform in category web applications Exploit Title: phpMyAdmin 4.8.1 - Local File Inclusion to Remote Code Execution Exploit Author: VulnSpy Vendor Homepage: http://www.phpmyadmin.net Software Link: https://github.com/phpmyadmin/phpmyadmin/archive/RELEASE481.tar.gz Version: 4.8.0...

Microsoft Windows Kernel - IOCTL 0x120007 (NsiGetParameter) nsiproxy/netio Pool Memory Disclosure

Exploit for windows platform in category dos / poc / We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys \.\Nsi device discloses portions of uninitialized pool memory to user-mode clients, likely due to output structure alignment holes. On our test Windows 7 32-bit...

WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated Remote Code Execution Exploit

Exploit Title: WIMAX SWC-5100W Firmware V1.11.0.1 :1.9.9.4 - Authenticated RCE Vulnerability Name: Ballin' Mada Exploit Author: Momen Eldawakhly Cyber Guy Vendor Homepage: http://www.seowonintech.co.kr/eng/main Version: Bootloader1.18.19.0 , HW 0.0.7.0, FW1.11.0.1 : 1.9.9.4 Tested on: Unix CVE :...

Online Shopping System Advanced 1.0 SQL Injection Vulnerability

Title: online-shopping-system-advanced-1.0 SQLi Author: nu11secur1ty Vendor: https://github.com/PuneethReddyHC/online-shopping-system-advanced Software: https://github.com/PuneethReddyHC/online-shopping-system-advanced/archive/refs/heads/master.zip Reference:...

Multi Store Inventory Management System 1.0 Account Takeover Vulnerability

Exploit Title: Multi Store Inventory Management System - Account Takeover Unauthenticated Exploit Author: Saud Alenazi Vendor Homepage: https://www.bdtask.com/ Software Link: https://www.campcodes.com/projects/php/complete-multi-store-inventory-management-system-in-php-mysql/ Version: 1.0 Tested...

ProtonVPN 1.26.0 - Unquoted Service Path Vulnerability

Exploit Title: ProtonVPN 1.26.0 - Unquoted Service Path Exploit Author: gemreda @gemredax Vendor Homepage: https://protonvpn.com/ Software Link: https://protonvpn.com/ Version: 1.26.0 Tested: Windows 10 x64 Contact: email protected PS C:\Users\Emre sc.exe qc "ProtonVPN Wireguard" SC...

WordPress CP Blocks 1.0.14 Plugin - Stored Cross Site Scripting Vulnerability

Exploit Title: WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting XSS Exploit Author: Shweta Mahajan Vendor Homepage: https://wordpress.org/plugins/cp-blocks/ Software Link: https://wordpress.org/plugins/cp-blocks/ Tested on Windows CVE: CVE-2022-0448 Reference:...

Zivif Camera 2.3.4.2103 iptest.cgi Blind Remote Command Execution Exploit

This Metasploit module exploits a remote command execution vulnerability in Zivif webcams. This is known to impact versions prior to and including 2.3.4.2103. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Exploit

Exploit for java platform in category web applications Exploit Title: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Exploit Author: hongphukt Vendor Homepage: https://www.jinfonet.com/ Software Link: https://www.jinfonet.com/product/download-jreport/ Version: JReport 15.6 Tested on...

WordPress Plainview Activity Monitor 20161228 Remote Command Execution Exploit

WordPress Plainview Activity Monitor plugin is vulnerable to OS command injection which allows an attacker to remotely execute commands on the underlying system. Application passes unsafe user supplied data to ip parameter into activitiesoverview.php. Privileges are required in order to exploit...

Linux/ARM64 - execve("/bin/sh", NULL, NULL) Shellcode (40 Bytes)

/ Title: Linux/ARM64 - execve"/bin/sh", NULL, NULL Shellcode 40 Bytes Date: 2019-06-30 Tested: Ubuntu 16.04 aarch64 Author: Ken Kitahara Compilation: gcc -o loader loader.c ubuntu@ubuntu:/works$ lsbrelease -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu Xenial Xerus...

Shopware - createInstanceFromNamedArguments PHP Object Instantiation Remote Code Execute Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE", 'Description' = %q This module exploits a php object instantiation...

Cisco ASA - Crash PoC Exploit

Exploit for hardware platform in category dos / poc Cisco ASA CVE-2018-0101 Crash PoC We basically just read: https://www.nccgroup.trust/globalassets/newsroom/uk/events/2018/02/reconbrx2018-robin-hood-vs-cisco-asa.pdf @zerosum0x0, @jennamagius, @alephnaught import requests, sys headers =...

Invision Power Board 4.x.x Uploading Shell Exploit

Uploading Shell Using PHP Injection Vulnerability This is private exploit. You can buy it at https://0day.today...

the GoNC Network(view.php)Blind Sql Injection Vulnerability

Exploit for php platform in category web applications Exploit Title:the GoNC Networkview.phpBlind Sql Injection Vulnerability Date: 16/8/2011 Author: Angel Injection home Page: http://www.club-h.co.cc ,http://www.sec-krb.org Email: Angel-InjectionathotmailDotcom Vendor or Software Link:...

PHPWind <= 5.0.1 (AdminUser) Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications =============================================================== PHPWind = 5.0.1 AdminUser Remote Blind SQL Injection Exploit =============================================================== ?php printr'...

phpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool (updated)

Exploit for unknown platform in category web applications ================================================================== phpBB Note: Host the php script and replace the line 34 Php script for the email option because win32 don't support Mail::Mailer Changelog: Bruteforce option | Starting...

phpBB <= 2.0.12 Change User Rights Authentication Bypass (c code)

Exploit for unknown platform in category web applications ================================================================= phpBB include include //Taken from VeNoMouS's love cow code char searchandreplace char text, char find, char replace char found,newtext; int...

Roundcube Webmail Stored XSS Exploit

Description: The CVE-2024-37383 vulnerability was discovered in the Roundcube Webmail email client. This is a stored XSS vulnerability that allows an attacker to execute JavaScript code on the user's page. To exploit the vulnerability, all attackers need to do is open a malicious email using a...

FusionInvoice 2023-1.0 - Cross-Site Scripting Vulnerability

Exploit Title: FusionInvoice 2023-1.0 - Stored XSS Cross-Site Scripting Exploit Author: Andrea Intilangelo Vendor Homepage: https://www.squarepiginteractive.com Software Link: https://www.fusioninvoice.com/store Version: 2023-1.0 Tested on: Latest Version of Desktop Web Browsers ATTOW: Firefox...

Lavalite 9.0.0 XSRF TOKEN cookie File path traversal Vulnerability

Title: Lavalite-9.0.0 XSRF-TOKEN cookie File path traversal Author: nu11secur1ty Vendor: https://lavalite.org/ Software: https://github.com/LavaLite/cms/releases/tag/v9.0.0 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite Description: The XSRF-TOKEN cookie is...