GitLab 12.9.0 - Arbitrary File Read Exploit

Exploit for ruby platform in category web applications Exploit Title: GitLab 12.9.0 - Arbitrary File Read Exploit Author: KouroshRZ Vendor Homepage: https://about.gitlab.com Software Link: https://about.gitlab.com/install Version: tested on gitlab version 12.9.0 Tested on: Ubuntu 18.04 but it's O...

Car Park Management System 1.0 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Car Park Management System 1.0 - Authentication Bypass Exploit Author: Tarun Sehgal Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

TrixBox CE 2.8.0.4 Command Execution Exploit

This Metasploit module exploits an authenticated OS command injection vulnerability found in Trixbox CE versions 1.2.0 through 2.8.0.4 inclusive in the network POST parameter of the /maint/modules/endpointcfg/endpointdevicemap.php page. Successful exploitation allows for arbitrary command executi...

Booked Scheduler 2.7.7 - Authenticated Directory Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: Booked Scheduler 2.7.7 - Authenticated Directory Traversal Author: Besim ALTINOK Vendor Homepage: https://www.bookedscheduler.com Software Link: https://sourceforge.net/projects/phpscheduleit/ Version: v2.7.7 Tested on: Xampp...

Saltstack 3000.1 Remote Code Execution Exploit

Exploit Title: Saltstack 3000.1 - Remote Code Execution Date: 2020-05-04 Exploit Author: Jasper Lievisse Adriaanse Vendor Homepage: https://www.saltstack.com/ Version: 3000.2, 2019.2.4, 2017., 2018. Tested on: Debian 10 with Salt 2019.2.0 CVE : CVE-2020-11651 and CVE-2020-11652 Discription:...

TP-LINK Cloud Cameras NCXXX Bonjour Command Injection Vulnerability

TP-LINK Cloud Cameras including products NC200, NC210, NC220, NC230, NC250, NC260, and NC450 suffer from a command injection vulnerability. The issue is located in the swSystemSetProductAliasCheck method of the ipcamera binary Called when setting a new alias for the device via /setsysname.fcgi,...

TP-LINK Cloud Cameras NCXXX Hardcoded Encryption Key Vulnerability

TP-LINK Cloud Cameras including products NC200, NC210, NC220, NC230, NC250, NC260, and NC450 suffer from having a hardcoded encryption key. The issue is located in the methods swSystemBackup and sym.swSystemRestoreFile, where a hardcoded encryption key is used in order to encrypt/decrypt a config...

iJoomla AdAgency 6.0.9 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: iJoomla comadagency 6.0.9 - SQL Injection Vulnerabilities Author: Milad Karimi Software Link: Version: 6.0.9 Category : webapps Tested on: windows 10 , firefox CVE : CWE-89 Dork: inurl:index.php?option=comadagency...

TP-LINK Cloud Cameras NCXXX SetEncryptKey Command Injection Vulnerability

TP-LINK Cloud Cameras including products NC260 and NC450 suffer from a command injection vulnerability. The issue is located in the httpSetEncryptKeyRpm method handler for /setEncryptKey.fcgi of the ipcamera binary, where the user-controlled EncryptKey parameter is used directly as part of a...

xt:Commerce 5.4.1 / 6.2.1 / 6.2.2 Improper Access Control Vulnerability

xt:Commerce version 5.4.1, 6.2.1, and 6.2.2 suffer from an improper access control vulnerability. A logged-in customer can create and alter addresses. These addresses are referenced by incrementing IDs. On saving an address, an attacker could change the ID of the address to write the data to. If...

FlashGet 1.9.6 Buffer Overflow PoC Exploit

!/usr/bin/python Exploit Title: FlashGet 1.9.6 0day Remote Buffer Overflow Author: Milad Karimi Testen on: Kali Linux Software Link: http://www.flashget.com/en/download.htm?uid=undefined Version: 1.9.6 CVE : N/A from time import sleep from socket import res = '220 WELCOME!! :x\r\n', '331 Password...

Fishing Reservation System 7.5 - (uid) SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Fishing Reservation System 7.5 - 'uid' SQL Injection Vendor: https://fishingreservationsystem.com/index.html Software: https://fishingreservationsystem.com/features.htm CVE: N/A Technical Details & Description:...

Online Scheduling System 1.0 - (username) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Scheduling System 1.0 - 'username' SQL Injection Exploit Author: Saurav Shukla Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html Software Link:...

SimplePHPGal 0.7 - Remote File Inclusion Vulnerability

Exploit for php platform in category web applications Title: SimplePHPGal 0.7 - Remote File Inclusion Author: h4shur Vendor Homepage: https://johncaruso.ca Software Link: https://johncaruso.ca/phpGallery/ Software Link: https://sourceforge.net/projects/simplephpgal/ Tested on: Windows 10 & Google...

HP Performance Monitoring xglance Privilege Escalation Exploit

This Metasploit module is an exploit that takes advantage of xglance-bin, part of HP's Glance or Performance Monitoring version 11 and subsequent, which was compiled with an insecure RPATH option. The RPATH includes a relative path to -L/lib64/ which can be controlled by a user. Creating librarie...

Veeam ONE Agent .NET Deserialization Exploit

This Metasploit module exploits a .NET deserialization vulnerability in the Veeam ONE Agent before the hotfix versions 9.5.5.4587 and 10.0.1.750 in the 9 and 10 release lines. Specifically, the module targets the HandshakeResult method used by the Agent. By inducing a failure in the handshake, th...

webERP 4.15.1 - Unauthenticated Backup File Access Vulnerability

Exploit for php platform in category web applications Exploit Title: webERP 4.15.1 - Unauthenticated Backup File Access Author: Besim ALTINOK Vendor Homepage: http://www.weberp.org Software Link: https://sourceforge.net/projects/web-erp/ Version: v4.15.1 Tested on: Xampp Credit: İsmail BOZKURT...

PhreeBooks ERP 5.2.5 - Remote Command Execution Vulnerability

Exploit for php platform in category web applications Exploit Title: PhreeBooks ERP 5.2.5 - Remote Command Execution Author: Besim ALTINOK Vendor Homepage: https://www.phreesoft.com/ Software Link: https://sourceforge.net/projects/phreebooks/ Version: v5.2.4, v5.2.5 Tested on: Xampp Credit: İsmai...

BlogEngine 3.3 - (syndication.axd) XML External Entity Injection Vulnerability

Exploit for xml platform in category web applications Title: BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection Author: Daniel Martinez Adan aDoN90 Homepage: https://blogengine.io/ Software Link: https://blogengine.io/support/download/ Affected Versions: 3.3 Vulnerability: XML...

NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Exploit

Exploit for hardware platform in category web applications Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Author: Cold z3ro Homepage: https://www.0x30.cc/ Vendor Homepage: https://www.nec.com Version: 01.03.01 Discription: NEC SL2100 NEC Electra Elite IPK II WebPro Session...

BoltWire 6.03 - Local File Inclusion Vulnerability

Exploit for php platform in category web applications Exploit Title: BoltWire 6.03 - Local File Inclusion Exploit Author: Andrey Stoykov Vendor Homepage: https://www.boltwire.com/ Software Link: https://www.boltwire.com/downloads/go&v=6&r=03 Version: 6.03 Tested on: Ubuntu 20.04 LAMP LFI: Steps t...

Outline Service 1.3.3 - (Outline Service) Unquoted Service Path Vulnerability

Exploit Title: Outline Service 1.3.3 - 'Outline Service ' Unquoted Service Path Discovery by: Minh Tuan - SunCSR Vendor Homepage: https://getoutline.org/vi/home Software Link : https://raw.githubusercontent.com/Jigsaw-Code/outline-releases/master/client/stable/Outline-Client.exe Tested Version:...

Frigate 3.36 - Buffer Overflow (SEH) Exploit

Exploit Title: Frigate 3.36 - Buffer Overflow SEH Exploit Author: Xenofon Vassilakopoulos Version: 3.36 Vendor Homepage: http://www.Frigate3.com/ Software Link Download: http://www.Frigate3.com/download/Frigate3Stdv36.exe Tested on: Windows 7 Professional SP1 x86 Steps to reproduce : 1. generate...

osTicket 1.14.1 - Persistent Authenticated Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: osTicket 1.14.1 - Persistent Authenticated Cross-Site Scripting Author: Mehmet Kelepce / Gais Cyber Security Source Link: https://github.com/osticket/osticket/commit/fc4c8608fa122f38673b9dddcb8fef4a15a9c884 Vendor: http://osticket.com...

addressbook 9.0.0.1 - (id) SQL Injection Exploit

Exploit for php platform in category web applications Title: addressbook 9.0.0.1 - 'id' SQL Injection Author: David Velazquez a.k.a. d4sh&r000 vulnerable application: https://sourceforge.net/projects/php-addressbook/files/latest/download vulnerable version: 9.0.0.1 Discription: addressbook 9.0.0....

Saltstack 3000.1 - Remote Code Execution Exploit

Exploit Title: Saltstack 3000.1 - Remote Code Execution Exploit Author: Jasper Lievisse Adriaanse Vendor Homepage: https://www.saltstack.com/ Version: 3000.2, 2019.2.4, 2017., 2018. Tested on: Debian 10 with Salt 2019.2.0 CVE : CVE-2020-11651 and CVE-2020-11652 Discription: Saltstack authenticati...

Oracle Database 11g Release 2 - (OracleDBConsoleorcl) Unquoted Service Path Vulnerability

Exploit Title: Oracle Database 11g Release 2 - 'OracleDBConsoleorcl' Unquoted Service Path Discovery by: Nguyen Khang - SunCSR Vendor Homepage: https://www.oracle.com/ Software Link: https://www.oracle.com/database/technologies/112010-win64soft.html Tested Version: 11g release 2 Vulnerability Typ...

Apache OFBiz 17.12.03 Cross Site Request Forgery Vulnerability

Exploit for multiple platform in category web applications Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery Account Takeover Exploit Author: Faiz Ahmed Zaidi Vendor Homepage: https://ofbiz.apache.org/security.html Software Link: https://ofbiz.apache.org/download.htmlsecurity...

Super Backup 2.0.5 for iOS - Directory Traversal Vulnerability

Exploit for iOS platform in category web applications Title: Super Backup 2.0.5 for iOS - Directory Traversal Software: https://apps.apple.com/us/app/super-backup-export-import/id1052684097 CVE: N/A Document Title: =============== Super Backup v2.0.5 iOS - Directory Traversal Vulnerability Produc...

HardDrive 2.1 for iOS - Arbitrary File Upload Vulnerability

Exploit for iOS platform in category web applications Title: HardDrive 2.1 for iOS - Arbitrary File Upload Software: https://apps.apple.com/ch/app/harddrive/id383226784 Document Title: =============== HardDrive v2.1 iOS - Arbitrary File Upload Vulnerability Product & Service Introduction:...

VirtualTablet Server 3.0.2 - Denial of Service Exploit

Title: VirtualTablet Server 3.0.2 - Denial of Service PoC Author: Dolev Farhi Vulnerable version: 3.0.2 14 Link: http://www.sunnysidesoft.com/ CVE: N/A from thrift import Thrift from thrift.transport import TSocket from thrift.transport import TTransport from thrift.protocol import TBinaryProtoco...

Online Scheduling System 1.0 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Scheduling System 1.0 - Persistent Cross-Site Scripting Exploit Author: Bobby Cooke Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html Software Link:...

hits script 1.0 - (item_name) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: hits script 1.0 - 'itemname' SQL Injection Exploit Author: SajjadBnd Vendor Homepage: https://hits.ir Software Link: http://dl.persianscript.ir/script/hitsir-script-persian%28PersianScript.ir%29.zip Software Linkmirror:...

Andrea ST Filters Service 1.0.64.7 - (Andrea ST Filters Service) Unquoted Service Path Vulnerability

Exploit Title: Andrea ST Filters Service 1.0.64.7 - 'Andrea ST Filters Service ' Unquoted Service Path Discovery by: Roberto Piña Vendor Homepage: https://andreaelectronics.com/ Software Link : https://andreaelectronics.com/ Tested Version: 1.0.64.7 Vulnerability Type: Unquoted Service Path Teste...

Gigamon GigaVUE 5.5.01.11 Directory Traversal / File Upload Vulnerabilities

Gigamon GigaVUE version 5.5.01.11 suffers from directory traversal and file upload with command execution vulnerabilities. Gigamon has chosen to sunset this product and not offer a patch. Gigamon GigaVUE 5.5.01.11 Directory Traversal / File Upload Vulnerabilities An issue was discovered in Gigamo...

NVIDIA Update Service Daemon 1.0.21 - (nvUpdatusService) Unquoted Service Path Vulnerability

Exploit Title: NVIDIA Update Service Daemon 1.0.21 - 'nvUpdatusService' Unquoted Service Path Discovery by: Roberto Piña Vendor Homepage: https://www.nvidia.com/es-la/ Software Link : https://www.nvidia.com/es-la/ Tested Version: 1.0.21 Vulnerability Type: Unquoted Service Path Tested on OS:...

School ERP Pro 1.0 - (es_messagesid) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: School ERP Pro 1.0 - 'esmessagesid' SQL Injection Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail...

Druva inSync Windows Client 6.5.2 - Local Privilege Escalation Exploit

Exploit Title: Druva inSync Windows Client 6.5.2 - Local Privilege Escalation Exploit Author: Chris Lyne Vendor Homepage: druva.com Software Link: https://downloads.druva.com/downloads/inSync/Windows/6.5.2/inSync6.5.2r99097.msi Version: 6.5.2 Tested on: Windows 10 CVE : CVE-2019-3999 See also:...

School ERP Pro 1.0 - Arbitrary File Read Vulnerability

Exploit for php platform in category web applications Exploit Title: School ERP Pro 1.0 - Arbitrary File Read Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail BOZKURT...

ChemInv 1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ChemInv - Authenticated Persistent Cross-Site Scripting Exploit Author: Bobby Cooke Software Link: https://github.com/tmorrell/cheminv Software Info: "Cheminv is a web-based chemical inventory system. This responsive database...

Open-AudIT Professional 3.3.1 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution Exploit Author: Askar CVE: CVE-2020-8813 Vendor Homepage: https://opmantek.com/ Version: v3.3.1 Tested on: Ubuntu 18.04 / PHP 7.2.24 !/usr/bin/python3 import requests import...

School ERP Pro 1.0 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications Exploit Title: School ERP Pro 1.0 - Remote Code Execution Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail BOZKUR...

EmEditor 19.8 - Insecure File Permissions Vulnerability

Exploit Title: EmEditor 19.8 - Insecure File Permissions Exploit Author: SajjadBnd Vendor Homepage: https://www.emeditor.com/ Software Link: https://support.emeditor.com/en/downloads/suggested Version: 19.8 Tested on: Win10 Professional x64 Description EmEditor is a fast, lightweight, yet...

CloudMe 1.11.2 - Buffer Overflow Exploit

Exploit Title: CloudMe 1.11.2 - Buffer Overflow PoC Exploit Author: Andy Bowden Vendor Homepage: https://www.cloudme.com/en Software Link: https://www.cloudme.com/downloads/CloudMe1112.exe Version: CloudMe 1.11.2 Tested on: Windows 10 x86 Instructions: Start the CloudMe service and run the script...

Apache Shiro 1.2.4 Remote Code Execution Exploit

This Metasploit module exploits a vulnerability that allows remote attackers to execute arbitrary code on vulnerable installations of Apache Shiro version 1.2.4. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Geeklog 2.2.1 SQL Injection Vulnerability

Exploit for php platform in category web applications Information -------------------- Advisory by Netsparker Name: Blind SQL Injection Vulnerability in Geeklog Affected Software: Geeklog Affected Versions: 2.2.1 Vendor Homepage: https://www.geeklog.net/ Vulnerability Type: Blind SQL Injection...

Geeklog 2.2.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Information -------------------- Advisory by Netsparker Name: Cross-Site Scripting Vulnerability in Geeklog Affected Software: Geeklog Affected Versions: 2.2.1 Vendor Homepage: https://www.geeklog.net/ Vulnerability Type: Cross-Site Scripting...

jQuery <= 3.5 html() Cross Site Scripting Exploit

Exploit for jsp platform in category web applications jquery-xss-in-html jQuery 3.5 Cross-Site Scripting XSS in html Timmy Willison recently released a new version of jQuery. jQuery 3.5 fixes a cross-site scripting XSS vulnerability found in the jQuery’s HTML parser. The Snyk open source security...

Linux/x86 Dynamic MMX+FPU Encoded Add Root User Shellcode (155 bytes)

155 bytes small Linux/x86 shellcode that has a MMX stub decoder that dynamically decodes the payload in memory. The FPU GetPC technique is used to determine the offset from EIP dynamically in running memory. Once decoded. this shellcode adds the user 'ctl' with the password 'ctl' to the /etc/pass...

Linux/x64_86 ROL Encoded Execve Shellcode (57 bytes)

57 bytes small Linux/x6486 /bin/bash shellcode. The stub decodes the ROL Encoded shellcode. When the stub has finished decoding the payload, execution control is passed to the payload. // Shellcode Title: Linux/x64 - ROL Encoded Execve Shellcode 57 bytes // Shellcode Author: Bobby Cooke // Tested...