bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2177 commits 1 branch 0 tags 258 MiB
Commit graph

2177 commits

This branch
This branch
All branches
Author SHA1 Message Date
Offensive Security
720fabd066 DB: 2020-07-28 
114 changes to exploits/shellcodes

Notepad++ < 7.7 (x64)  - Denial of Service

winrar 5.80 64bit - Denial of Service
WinRAR 5.80 (x64) - Denial of Service

Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter target_offset Out-of-Bounds Privilege Escalation
Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter 'target_offset' Out-of-Bounds Privilege Escalation

TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change

Microsoft Windows 7 SP1 x86 - GDI Palette Objects Local Privilege Escalation (MS17-017)
Microsoft Windows 7 SP1 (x86) - GDI Palette Objects Local Privilege Escalation (MS17-017)

Microsoft Word 2007 (x86) - Information Disclosure

IKARUS anti.virus 2.16.7 - 'ntguard_x64' Local Privilege Escalation

ASX to MP3 Converter 1.82.50 (Windows 2003 x86) - '.asx' Local Stack Overflow
Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation
Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation

Microsoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution
Microsoft Internet Explorer 11 (Windows 7 x86/x64) - vbscript Code Execution

Linux Kernel 2.6.x / 3.10.x / 4.14.x (RedHat / Debian / CentOS) (x64) - 'Mutagen Astronomy' Local Privilege Escalation

R 3.4.4 (Windows 10 x64) - Buffer Overflow (DEP/ASLR Bypass)

MySQL User-Defined (Linux) (x32/x86_64) - 'sys_exec' Local Privilege Escalation
MySQL User-Defined (Linux) (x86) - 'sys_exec' Local Privilege Escalation

Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH)

Microsoft Windows (x84/x64) - 'Error Reporting' Discretionary Access Control List / Local Privilege Escalation
Microsoft Windows (x86/x64) - 'Error Reporting' Discretionary Access Control List / Local Privilege Escalation

Microsoft Windows (x86) - Task Scheduler' .job' Import Arbitrary Discretionary Access Control List Write / Local Privilege Escalation

R 3.4.4 (Windows 10 x64) - Buffer Overflow SEH (DEP/ASLR Bypass)

Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation
Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Escalation

Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation

Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)

Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path

DEWESoft X3 SP1 (64-bit) - Remote Command Execution
DEWESoft X3 SP1 (x64) - Remote Command Execution

CompleteFTP Professional 12.1.3 - Remote Code Execution

TeamCity Agent XML-RPC 10.0 - Remote Code Execution

eGroupWare 1.14 - 'spellchecker.php' Remote Command Execution

FreeBSD x86 / x64 - execve(/bin/sh) Anti-Debugging Shellcode (140 bytes)
FreeBSD x86/x64 - execve(/bin/sh) Anti-Debugging Shellcode (140 bytes)

Linux/x86 - /usr/bin/head -n99 cat etc/passwd Shellcode (61 Bytes)

Linux/x86 - Kill All Processes Shellcode (14 bytes)
Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)
Linux/x86 - adduser (User) to /etc/passwd Shellcode (74 bytes)
Linux/x86 - execve /bin/sh Shellcode (25 bytes)
Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)
Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)
Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)
Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)
Linux/x86 - adduser (User) to /etc/passwd Shellcode (74 bytes)
Linux/x86 - execve /bin/sh Shellcode (25 bytes)
Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)
Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)
Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)
Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)
Linux/x86 - Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode (114 bytes)
Linux/x86 - Execve() Alphanumeric Shellcode (66 bytes)
Linux/x86 - Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode (114 bytes)
Windows/x86 - Dynamic Bind Shell + Null-Free Shellcode (571 Bytes)
Linux/x86 - Bind Shell Generator Shellcode (114 bytes)
Windows/x86 - Dynamic Bind Shell + Null-Free Shellcode (571 Bytes)
Linux/x86 - Bind Shell Generator Shellcode (114 bytes)
Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)
Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
Linux/x86 - 'reboot' polymorphic Shellcode (26 bytes)
Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)
Linux/x64 - Password (P3WP3Wl4ZerZ) + Bind (0.0.0.0:4444/TCP) Shell (/bin/bash) + Null-free Shellcode (272 Bytes)
Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)
Linux/x64 - Password (P3WP3Wl4ZerZ) + Bind (0.0.0.0:4444/TCP) Shell (/bin/bash) + Null-free Shellcode (272 Bytes)
 2020-07-28 05:01:59 +00:00
Offensive Security
e46d9f65ff DB: 2020-07-27 
32 changes to exploits/shellcodes

Calavera UpLoader 3.5 - 'FTP Logi' Denial of Service (PoC + SEH Overwrite)
Nidesoft DVD Ripper 5.2.18 - Local Buffer Overflow (SEH)
Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow (SEH Egghunter)
DiskBoss 7.7.14 - 'Reports and Data Directory' Buffer Overflow (SEH Egghunter)
Socusoft Photo to Video Converter Professional 8.07 - 'Output Folder' Buffer Overflow (SEH Egghunter)
Port Forwarding Wizard 4.8.0 - Buffer Overflow (SEH)
Free MP3 CD Ripper 2.8 - Stack Buffer Overflow (SEH + Egghunter)
docPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter)
GOautodial 4.0 - Persistent Cross-Site Scripting (Authenticated)
ManageEngine Applications Manager 13 - 'MenuHandlerServlet' SQL Injection
INNEO Startup TOOLS 2018 M040 13.0.70.3804 - Remote Code Execution
UBICOD Medivision Digital Signage 1.5.1 - Cross-Site Request Forgery (Add Admin)
WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
WordPress Plugin Email Subscribers & Newsletters 4.2.2 - 'hash' SQL Injection (Unauthenticated)
Bludit 3.9.2 - Directory Traversal
LibreHealth 2.0.0 - Authenticated Remote Code Execution
Online Course Registration 1.0 - Unauthenticated Remote Code Execution
elaniin CMS - Authentication Bypass
Koken CMS 0.22.24 - Arbitrary File Upload (Authenticated)
PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting
Bio Star 2.8.2 - Local File Inclusion
Webtareas 2.1p - Arbitrary File Upload (Authenticated)
F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion
Sickbeard 0.1 - Cross-Site Request Forgery (Disable Authentication)
Socket.io-file 2.0.31 - Arbitrary File Upload
pfSense 2.4.4-p3 - Cross-Site Request Forgery
Virtual Airlines Manager 2.6.2 - Persistent Cross-Site Scripting
Rails 5.0.1 - Remote Code Execution

Linux/x86 - ASLR deactivation polymorphic Shellcode (124 bytes)
Linux/x86 - Egghunter(0x50905090) + sigaction + execve(/bin/sh) Shellcode (35 bytes)
Windows/x86 - Download using mshta.exe Shellcode (100 bytes)
 2020-07-27 05:02:04 +00:00
Offensive Security
dc7e147e70 DB: 2020-07-24 
3 changes to exploits/shellcodes

FTPDummy 4.80 - Local Buffer Overflow (SEH)
Snes9K 0.09z - 'Port Number' Buffer Overflow (SEH)

UBICOD Medivision Digital Signage 1.5.1 - Authorization Bypass
 2020-07-24 05:02:04 +00:00
Offensive Security
67c1f99f41 DB: 2020-07-23 
4 changes to exploits/shellcodes

NetPCLinker 1.0.0.0 - Buffer Overflow (SEH Egghunter)
Docsify.js 4.11.4 - Reflective Cross-Site Scripting
WordPress Theme NexosReal Estate 1.7 - 'search_order' SQL Injection
Sophos VPN Web Panel 2020 - Denial of Service (Poc)
 2020-07-23 05:02:04 +00:00
Offensive Security
bd3d5964fc DB: 2020-07-18 
5 changes to exploits/shellcodes

Sonar Qube 8.3.1 - 'SonarQube Service' Unquoted Service Path
Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (PoC)

RiteCMS 2.2.1 - Remote Code Execution

CMSUno 1.6 - Cross-Site Request Forgery (Change Admin Password)
 2020-07-18 05:02:04 +00:00
Offensive Security
da1d7301af DB: 2020-07-17 
2 changes to exploits/shellcodes

RiteCMS 2.2.1 - Remote Code Execution
Wing FTP Server 6.3.8 - Remote Code Execution (Authenticated)
 2020-07-17 05:02:11 +00:00
Offensive Security
8bb6bd8fb0 DB: 2020-07-16 
8 changes to exploits/shellcodes

SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery (Add Admin)
Zyxel Armor X1 WAP6806 - Directory Traversal
Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection
Online Polling System 1.0 - Authentication Bypass
Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass
Online Farm Management System 0.1.0 - Persistent Cross-Site Scripting
Infor Storefront B2B 1.0 - 'usr_name' SQL Injection
 2020-07-16 05:02:11 +00:00
Offensive Security
87c306bdc9 DB: 2020-07-15 
2 changes to exploits/shellcodes

BSA Radar 1.6.7234.24750 - Local File Inclusion
Trend Micro Web Security Virtual Appliance 6.5 SP2 Patch 4 Build 1901 - Remote Code Execution (Metasploit)
 2020-07-15 05:02:06 +00:00
Offensive Security
ec0cd21b16 DB: 2020-07-14 
2 changes to exploits/shellcodes

Park Ticketing Management System 1.0  - 'viewid' SQL Injection
Park Ticketing Management System 1.0  - Authentication Bypass
 2020-07-14 05:02:07 +00:00
Offensive Security
c0e7247938 DB: 2020-07-11 
5 changes to exploits/shellcodes

FrootVPN 4.8 - 'frootvpn' Unquoted Service Path

Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution

HelloWeb 2.0 - Arbitrary File Download

Barangay Management System 1.0 - Authentication Bypass
 2020-07-11 05:02:09 +00:00
Offensive Security
3847f7e468 DB: 2020-07-10 
4 changes to exploits/shellcodes

FrootVPN 4.8 - 'frootvpn' Unquoted Service Path
PHP 7.4 FFI - 'disable_functions' Bypass
Wordpress Plugin Powie's WHOIS Domain Check 0.9.31 - Persistent Cross-Site Scripting
Savsoft Quiz 5 - Persistent Cross-Site Scripting
 2020-07-10 05:02:06 +00:00
Offensive Security
ff6e1034eb DB: 2020-07-09 
2 changes to exploits/shellcodes

SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)
BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)
 2020-07-09 05:02:07 +00:00
Offensive Security
8f6367cf98 DB: 2020-07-08 
8 changes to exploits/shellcodes

Sony Playstation 4 (PS4) < 7.02 / FreeBSD 9 / FreeBSD 12 - 'ip6_setpktopt' Kernel Local Privilege Escalation (PoC)

Microsoft Windows mshta.exe 2019 - XML External Entity Injection

BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI'  Remote Code Execution
BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI'  Remote Code Execution (PoC)
Sickbeard 0.1 - Remote Command Injection
Online Shopping Portal 3.1 - 'email' SQL Injection
Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection
BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation
 2020-07-08 05:01:58 +00:00
Offensive Security
1bc852d2af DB: 2020-07-07 
7 changes to exploits/shellcodes

Frigate 2.02 - Denial Of Service (PoC)
Fire Web Server 0.1 - Remote Denial of Service (PoC)
Grafana 7.0.1 - Denial of Service (PoC)
File Management System 1.1 - Persistent Cross-Site Scripting
RiteCMS 2.2.1 - Authenticated Remote Code Execution
RSA IG&L Aveksa 7.1.1 - Remote Code Execution
Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution
 2020-07-07 05:01:57 +00:00
Offensive Security
cf9fbcb5de DB: 2020-07-06 
2 changes to exploits/shellcodes

WhatsApp Remote Code Execution - Paper
 2020-07-06 05:02:10 +00:00
Offensive Security
d6a1f63996 DB: 2020-07-03 
3 changes to exploits/shellcodes

WhatsApp Remote Code Execution - Paper
ZenTao Pro 8.8.2 - Command Injection
OCS Inventory NG 2.7 - Remote Code Execution
 2020-07-03 05:01:59 +00:00
Offensive Security
1e83e1b032 DB: 2020-07-02 
4 changes to exploits/shellcodes

RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (EggHunter) (SEH) (PoC)
e-learning Php Script 0.1.0 - 'search' SQL Injection
PHP-Fusion 9.03.60 - PHP Object Injection
Online Shopping Portal 3.1 - Authentication Bypass
 2020-07-02 05:01:52 +00:00
Offensive Security
8814122a02 DB: 2020-07-01 
2 changes to exploits/shellcodes

Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting
Reside Property Management 3.0 - 'profile' SQL Injection
 2020-07-01 05:01:51 +00:00
Offensive Security
15aca7f469 DB: 2020-06-27 
3 changes to exploits/shellcodes

Windscribe 1.83 - 'WindscribeService' Unquoted Service Path
KiteService 1.2020.618.0 - Unquoted Service Path

OpenEMR 5.0.1 - 'controller' Remote Code Execution
 2020-06-27 05:01:49 +00:00
Offensive Security
c22ad85b57 DB: 2020-06-26 
2 changes to exploits/shellcodes

mySCADA myPRO 7 - Hardcoded Credentials

FHEM 6.0 - Local File Inclusion
 2020-06-26 05:01:58 +00:00
Offensive Security
e48d268df5 DB: 2020-06-25 
1 changes to exploits/shellcodes

BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting
 2020-06-25 05:01:52 +00:00
Offensive Security
b8629afe42 DB: 2020-06-24 
4 changes to exploits/shellcodes

Code Blocks 20.03 - Denial Of Service (PoC)

Lansweeper 7.2 - Incorrect Access Control
Responsive Online Blog 1.0 - 'id' SQL Injection
Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)
 2020-06-24 05:01:53 +00:00
Offensive Security
09b5d3c1b6 DB: 2020-06-23 
6 changes to exploits/shellcodes

Frigate 2.02 - Denial Of Service (PoC)
FileRun 2019.05.21 -  Reflected Cross-Site Scripting
Student Enrollment 1.0 - Unauthenticated Remote Code Execution
Odoo 12.0 - Local File Inclusion
Online Student Enrollment System 1.0 - Unauthenticated Arbitrary File Upload
WebPort 1.19.1 - Reflected Cross-Site Scripting
WebPort 1.19.1 - 'setup' Reflected Cross-Site Scripting
 2020-06-23 05:02:25 +00:00
g0tmi1k
7480caf5bd
Merge pull request #179 from g0tmi1k/fix 
Fix #178
 2020-06-22 22:14:55 +01:00
g0tmi1k
db8a253bfd
Merge branch 'master' into fix 2020-06-22 22:14:47 +01:00
g0tmi1k
7ca0e0c447 Version bump 2020-06-22 22:13:58 +01:00
g0tmi1k
4d077be2a7 Remove conflict with exploitdb-papers 2020-06-22 22:13:28 +01:00
g0tmi1k
09e7d20651 Fix #178 - apt issues 2020-06-22 22:13:02 +01:00
Offensive Security
1979df6cb3 DB: 2020-06-19 
51 changes to exploits/shellcodes

Tor Browser < 0.3.2.10 - Use After Free (PoC)
Notepad++ < 7.7 (x64)  - Denial of Service
SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service
InputMapper 1.6.10 - Denial of Service

SurfOffline Professional 2.2.0.103 - 'Project Name' Denial of Service (SEH)

XnConvert 1.82 - Denial of Service (PoC)

SpotFTP FTP Password Recovery 3.0.0.0 - 'Key' Denial of Service (PoC)

SpotDialup 1.6.7 - 'Key' Denial of Service (PoC)

Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)

FreeBSD 12.0 - 'fd' Local Privilege Escalation
iOS < 12.4.1 - 'Jailbreak' Local Privilege Escalation
Easy File Sharing Web Server 7.2 - 'New User' Local Overflow (SEH)

DeviceViewer 3.12.0.1 - Arbitrary Password Change

Winrar 5.80 - XML External Entity Injection

Microsoft Windows Media Center WMV / WMA 6.3.9600.16384 - Code Execution

Siemens TIA Portal - Remote Command Execution

Android 7 < 9 - Remote Code Execution
CoreFTP 2.0 Build 674 SIZE - Directory Traversal (Metasploit)
CoreFTP 2.0 Build 674 MDTM - Directory Traversal (Metasploit)
CTROMS Terminal OS Port Portal - 'Password Reset' Authentication Bypass (Metasploit)

MyBB < 1.8.21 - Remote Code Execution

Nagios XI 5.6.5 - Remote Code Execution / Root Privilege Escalation

Webmin < 1.920 - 'rpc.cgi' Remote Code Execution (Metasploit)

Wolters Kluwer TeamMate 3.1 - Cross-Site Request Forgery

Publisure Hybrid - Multiple Vulnerabilities

NetGain EM Plus 10.1.68 - Remote Command Execution

Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection

WordPress Plugin ARforms 3.7.1 - Arbitrary File Deletion

DotNetNuke 9.3.2 - Cross-Site Scripting

VehicleWorkshop 1.0 - 'bookingid' SQL Injection
WordPress Plugin Tutor.1.5.3 - Local File Inclusion
WordPress Plugin tutor.1.5.3 - Persistent Cross-Site Scripting
WordPress Plugin Wordfence.7.4.5 - Local File Disclosure
WordPress Plugin contact-form-7 5.1.6 - Remote File Upload

WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion

WordPress Plugin WOOF Products Filter for WooCommerce 1.2.3 - Persistent Cross-Site Scripting

WordPress Plugin WP Sitemap Page 1.6.2 - Persistent Cross-Site Scripting
Joomla! 3.9.0 < 3.9.7 - CSV Injection
PlaySMS 1.4.3 - Template Injection / Remote Code Execution
Wing FTP Server - Authenticated CSRF (Delete Admin)

WordPress Plugin Custom Searchable Data System - Unauthenticated Data M]odification

UADMIN Botnet 1.0 - 'link' SQL Injection

Joomla! Component ACYMAILING 3.9.0 - Unauthenticated Arbitrary File Upload

Wordpress Plugin PicUploader 1.0 - Remote File Upload

PHP-Fusion 9.03.50 - 'panels.php' Remote Code Execution

WordPress Plugin Helpful 2.4.11 - SQL Injection

Prestashop 1.7.6.4 - Cross-Site Request Forgery

WordPress Plugin Simple File List 5.4 - Remote Code Execution

Library CMS Powerful Book Management System 2.2.0 - Session Fixation

Joomla! J2 Store 3.3.11 - 'filter_order_Dir' SQL Injection (Authenticated)
Joomla! J2 Store 3.3.11 - 'filter_order_Dir' Authenticated SQL Injection

Beauty Parlour Management System 1.0 - Authentication Bypass

Linux/x86 - Add User to /etc/passwd Shellcode (59 bytes)

Windows/x64 - WinExec Add-Admin Dynamic Null-Free Shellcode (210 Bytes)
Windows/x64 - WinExec Add-Admin (ROOT/I@mR00T$) Dynamic Null-Free Shellcode (210 Bytes)

Linux/x64 - Password Protected Bindshell + Null-free Shellcode (272 Bytes)
Linux/x64 - Password (P3WP3Wl4ZerZ) + Bind (0.0.0.0:4444/TCP) Shell (/bin/bash) + Null-free Shellcode (272 Bytes)
 2020-06-19 05:02:01 +00:00
Offensive Security
7312a8330d DB: 2020-06-18 
3 changes to exploits/shellcodes

Code Blocks 17.12 - 'File Name' Local Buffer Overflow (Unicode) (SEH) (PoC)
College-Management-System-Php 1.0 - Authentication Bypass
OpenCTI 3.3.1 - Directory Traversal
 2020-06-18 05:01:57 +00:00
Offensive Security
8fc6092de1 DB: 2020-06-17 
4 changes to exploits/shellcodes

NETGEAR SSL312 Router - Denial of Service
Netgear SSL312 Router - Denial of Service

NETGEAR WGR614v9 Wireless Router - Denial of Service
Netgear WGR614v9 Wireless Router - Denial of Service

NETGEAR DG632 Router - Remote Denial of Service
Netgear DG632 Router - Remote Denial of Service

NETGEAR ProSafe 1.x - VPN Firewall Web Interface Login Denial of Service
Netgear ProSafe 1.x - VPN Firewall Web Interface Login Denial of Service

NETGEAR ProSafe - Denial of Service
Netgear ProSafe - Denial of Service

NETGEAR WGR614 - Administration Interface Remote Denial of Service
Netgear WGR614 - Administration Interface Remote Denial of Service

NETGEAR Genie 2.4.32 - Unquoted Service Path Privilege Escalation
Netgear Genie 2.4.32 - Unquoted Service Path Privilege Escalation

Outline Service 1.3.3  - 'Outline Service ' Unquoted Service Path
Outline Service 1.3.3 - 'Outline Service ' Unquoted Service Path

Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path

NETGEAR WG102 - Leaks SNMP Write Password With Read Access
Netgear WG102 - Leaks SNMP Write Password With Read Access

NETGEAR DG632 Router - Authentication Bypass
Netgear DG632 Router - Authentication Bypass

NETGEAR WNR2000 FW 1.2.0.8 - Information Disclosure
Netgear WNR2000 FW 1.2.0.8 - Information Disclosure

NETGEAR WG111v2 Wireless Driver - Long Beacon Overflow (Metasploit)
Netgear WG111v2 Wireless Driver - Long Beacon Overflow (Metasploit)

NETGEAR FM114P Wireless Firewall - File Disclosure
Netgear FM114P Wireless Firewall - File Disclosure

NETGEAR FM114P ProSafe Wireless Router - UPnP Information Disclosure
Netgear FM114P ProSafe Wireless Router - UPnP Information Disclosure

NETGEAR FM114P ProSafe Wireless Router - Rule Bypass
Netgear FM114P ProSafe Wireless Router - Rule Bypass

NETGEAR RP114 3.26 - Content Filter Bypass
Netgear RP114 3.26 - Content Filter Bypass

NETGEAR DGN1000B - 'setup.cgi' Remote Command Execution (Metasploit)
Netgear DGN1000B - 'setup.cgi' Remote Command Execution (Metasploit)

NETGEAR DGN2200B - 'pppoe.cgi' Remote Command Execution (Metasploit)
Netgear DGN2200B - 'pppoe.cgi' Remote Command Execution (Metasploit)

NETGEAR MA521 Wireless Driver 5.148.724 - 'Beacon Probe' Remote Buffer Overflow
Netgear MA521 Wireless Driver 5.148.724 - 'Beacon Probe' Remote Buffer Overflow

NETGEAR WG311v1 Wireless Driver 2.3.1.10 - SSID Heap Buffer Overflow
Netgear WG311v1 Wireless Driver 2.3.1.10 - SSID Heap Buffer Overflow

NETGEAR ReadyNAS - Perl Code Evaluation (Metasploit)
Netgear ReadyNAS - Perl Code Evaluation (Metasploit)

NETGEAR SSL312 PROSAFE SSL VPN-Concentrator 25 - Error Page Cross-Site Scripting
Netgear SSL312 PROSAFE SSL VPN-Concentrator 25 - Error Page Cross-Site Scripting

NETGEAR WNR2000 - Multiple Information Disclosure Vulnerabilities
Netgear WNR2000 - Multiple Information Disclosure Vulnerabilities

NETGEAR WNDAP350 Wireless Access Point - Multiple Information Disclosure Vulnerabilities
Netgear WNDAP350 Wireless Access Point - Multiple Information Disclosure Vulnerabilities

NETGEAR D6300B - '/diag.cgi?IPAddr4' Remote Command Execution
Netgear D6300B - '/diag.cgi?IPAddr4' Remote Command Execution

NETGEAR NMS300 ProSafe Network Management System - Arbitrary File Upload (Metasploit)
Netgear NMS300 ProSafe Network Management System - Arbitrary File Upload (Metasploit)
NETGEAR JNR1010 ADSL Router - (Authenticated) Remote File Disclosure
NETGEAR WNR500/WNR612v3/JNR1010/JNR2010 ADSL Router - (Authenticated) Remote File Disclosure
Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure
Netgear WNR500/WNR612v3/JNR1010/JNR2010 ADSL Router - (Authenticated) Remote File Disclosure

NETGEAR WNR2000v5 - Remote Code Execution
Netgear WNR2000v5 - Remote Code Execution

NETGEAR R7000 / R6400 - 'cgi-bin' Command Injection (Metasploit)
Netgear R7000 / R6400 - 'cgi-bin' Command Injection (Metasploit)

NETGEAR WNR2000v5 - 'hidden_lang_avi' Remote Stack Overflow (Metasploit)
Netgear WNR2000v5 - 'hidden_lang_avi' Remote Stack Overflow (Metasploit)

NETGEAR DGN2200 - 'dnslookup.cgi' Command Injection (Metasploit)
Netgear DGN2200 - 'dnslookup.cgi' Command Injection (Metasploit)

NETGEAR - 'TelnetEnable' Magic Packet (Metasploit)
Netgear - 'TelnetEnable' Magic Packet (Metasploit)

WordPress MU < 1.3.2 - active_plugins option Code Execution
WordPress MU < 1.3.2 - 'active_plugins' Code Execution

NETGEAR Wireless Cable Modem Gateway - Authentication Bypass / Cross-Site Request Forgery
Netgear Wireless Cable Modem Gateway - Authentication Bypass / Cross-Site Request Forgery

NETGEAR SPH200D - Multiple Vulnerabilities
Netgear SPH200D - Multiple Vulnerabilities

NETGEAR DGN1000B - Multiple Vulnerabilities
Netgear DGN1000B - Multiple Vulnerabilities

NETGEAR DGN2200B - Multiple Vulnerabilities
Netgear DGN2200B - Multiple Vulnerabilities

NETGEAR WNR1000 - Authentication Bypass
Netgear WNR1000 - Authentication Bypass

NETGEAR WPN824v3 - Unauthorized Configuration Download
Netgear WPN824v3 - Unauthorized Configuration Download

NETGEAR DGN1000 / DGN2200 - Multiple Vulnerabilities
Netgear DGN1000 / DGN2200 - Multiple Vulnerabilities

NETGEAR ProSafe - Information Disclosure
Netgear ProSafe - Information Disclosure

NETGEAR WNR1000v3 - Password Recovery Credential Disclosure (Metasploit)
Netgear WNR1000v3 - Password Recovery Credential Disclosure (Metasploit)

NETGEAR DGN2200 N300 Wireless Router - Multiple Vulnerabilities
Netgear DGN2200 N300 Wireless Router - Multiple Vulnerabilities

NETGEAR WNDR3400 N600 Wireless Dual Band - Multiple Vulnerabilities
Netgear WNDR3400 N600 Wireless Dual Band - Multiple Vulnerabilities

NETGEAR DGN2200 1.0.0.29_1.7.29_HotS - Persistent Cross-Site Scripting
Netgear DGN2200 1.0.0.29_1.7.29_HotS - Persistent Cross-Site Scripting

NETGEAR DGN2200 1.0.0.29_1.7.29_HotS - Password Disclosure
Netgear DGN2200 1.0.0.29_1.7.29_HotS - Password Disclosure

NETGEAR WNR500 Wireless Router - 'webproc?getpage' Traversal Arbitrary File Access
Netgear WNR500 Wireless Router - 'webproc?getpage' Traversal Arbitrary File Access

NETGEAR ReadyNAS LAN /dbbroker 6.2.4 - Credential Disclosure
Netgear ReadyNAS LAN /dbbroker 6.2.4 - Credential Disclosure

NETGEAR Wireless Management System 2.1.4.15 (Build 1236) - Privilege Escalation
Netgear Wireless Management System 2.1.4.15 (Build 1236) - Privilege Escalation

NETGEAR Voice Gateway 2.3.0.23_2.3.23 - Multiple Vulnerabilities
Netgear Voice Gateway 2.3.0.23_2.3.23 - Multiple Vulnerabilities

NETGEAR WNR1000v4 - Authentication Bypass
Netgear WNR1000v4 - Authentication Bypass

NETGEAR NMS300 ProSafe Network Management System - Multiple Vulnerabilities
Netgear NMS300 ProSafe Network Management System - Multiple Vulnerabilities
NETGEAR R7000 - Command Injection
NETGEAR R7000 - Cross-Site Scripting
Netgear R7000 - Command Injection
Netgear R7000 - Cross-Site Scripting

NETGEAR Routers - Password Disclosure
Netgear Routers - Password Disclosure

NETGEAR DGN2200v1/v2/v3/v4 - 'ping.cgi' Remote Command Execution
Netgear DGN2200v1/v2/v3/v4 - 'ping.cgi' Remote Command Execution

NETGEAR DGN2200v1/v2/v3/v4 - 'dnslookup.cgi' Remote Command Execution
Netgear DGN2200v1/v2/v3/v4 - 'dnslookup.cgi' Remote Command Execution

NETGEAR DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery
Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery

Multiple  WordPress Plugins - Arbitrary File Upload
Multiple WordPress Plugins - Arbitrary File Upload

NETGEAR ReadyNAS Surveillance 1.4.3-16 - Remote Command Execution
Netgear ReadyNAS Surveillance 1.4.3-16 - Remote Command Execution

NETGEAR WiFi Router R6120 - Credential Disclosure
Netgear WiFi Router R6120 - Credential Disclosure

NETGEAR WiFi Router JWNR2010v5 / R6080 - Authentication Bypass
Netgear WiFi Router JWNR2010v5 / R6080 - Authentication Bypass

WordPress Plugin LearnDash  LMS 3.1.2 - Reflective Cross-Site Scripting
WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting

School File Management System 1.0  - 'username' SQL Injection
School File Management System 1.0 - 'username' SQL Injection

ChopSlider3 Wordpress Plugin3.4 - 'id' SQL Injection
WordPress Plugin ChopSlider 3.4 - 'id' SQL Injection

Wordpress Plugin Ajax Load More 5.3.1 - '#1' Authenticated SQL Injection
WordPress Plugin Ajax Load More 5.3.1 - '#1' Authenticated SQL Injection

Wordpress Plugin Form Maker 5.4.1 - 's' SQL Injection (Authenticated)
WordPress Plugin Form Maker 5.4.1 - 's' SQL Injection (Authenticated)

Wordpress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation
WordPress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation

Joomla J2  Store 3.3.11 - 'filter_order_Dir'  SQL Injection (Authenticated)
Joomla! J2 Store 3.3.11 - 'filter_order_Dir' SQL Injection (Authenticated)
Netgear R7000 Router - Remote Code Execution
Gila CMS 1.11.8 - 'query' SQL Injection
 2020-06-17 05:02:00 +00:00
Offensive Security
bb9f12afc7 DB: 2020-06-16 
3 changes to exploits/shellcodes

SOS JobScheduler 1.13.3 - Stored Password Decryption

Linux/ARM - execve /bin/dash Shellcode (32 bytes)
Linux/ARM - Bind (0.0.0.0:1337/TCP) Shell (/bin/sh) + Null-Free Shellcode (100 bytes)
 2020-06-16 05:01:56 +00:00
Offensive Security
d2b3291be5 DB: 2020-06-13 
3 changes to exploits/shellcodes

Joomla J2 Store 3.3.11 - 'filter_order_Dir'  SQL Injection (Authenticated)
Joomla J2  Store 3.3.11 - 'filter_order_Dir'  SQL Injection (Authenticated)
SmarterMail 16 - Arbitrary File Upload
Avaya IP Office 11 - Password Disclosure
Sysax MultiServer 6.90 - Reflected Cross Site Scripting
 2020-06-13 05:01:56 +00:00
Offensive Security
0fc783630a DB: 2020-06-12 
1 changes to exploits/shellcodes

Frigate Professional 3.36.0.9 - 'Find Computer' Local Buffer Overflow (SEH) (PoC)
 2020-06-12 05:01:56 +00:00
Offensive Security
6ec646f7e1 DB: 2020-06-11 
10 changes to exploits/shellcodes

Sync Breeze Enterprise 10.0.28 - Denial of-Service (PoC)
Sync Breeze Enterprise 10.4.18 - Denial of-Service (PoC)
Savant Web Server 3.1 - Denial of-Service (PoC)
ALLPlayer 7.5 - Denial of-Service (PoC)
10-Strike Bandwidth Monitor 3.9 - Buffer Overflow (SEH_DEP_ASLR)
WinGate 9.4.1.5998 - Insecure Folder Permissions

HFS Http File Server 2.3m Build 300 - Buffer Overflow (PoC)
Sistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery (Add Admin)
Joomla J2 Store 3.3.11 - 'filter_order_Dir'  SQL Injection (Authenticated)
Virtual Airlines Manager 2.6.2 - 'id' SQL Injection
 2020-06-11 05:02:06 +00:00
Offensive Security
809b91dc6f DB: 2020-06-10 
2 changes to exploits/shellcodes

Virtual Airlines Manager 2.6.2 - 'airport' SQL Injection
Bludit 3.9.12 - Directory Traversal
 2020-06-10 05:02:06 +00:00
Offensive Security
590364ca2a DB: 2020-06-09 
4 changes to exploits/shellcodes

Frigate 3.36.0.9 - 'Command Line' Local Buffer Overflow (SEH) (PoC)
Quick Player 1.3 - '.m3l' Buffer Overflow (Unicode & SEH)
Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)
Virtual Airlines Manager 2.6.2 - 'notam' SQL Injection
 2020-06-09 05:02:04 +00:00
Offensive Security
d0531a5e12 DB: 2020-06-06 
2 changes to exploits/shellcodes

Online Course Registration 1.0 - Authentication Bypass
Online-Exam-System 2015 - 'feedback' SQL Injection
 2020-06-06 05:01:55 +00:00
Offensive Security
533f33f3f4 DB: 2020-06-05 
17 changes to exploits/shellcodes

IObit Uninstaller 9.5.0.15 - 'IObit Uninstaller Service' Unquoted Service Path
AirControl 1.4.2 - PreAuth Remote Code Execution
Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated)
Clinic Management System 1.0 - Unauthenticated Remote Code Execution
Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated)
Oriol Espinal CMS 1.0 - 'id' SQL Injection
Clinic Management System 1.0 - Authenticated Arbitrary File Upload
Navigate CMS 2.8.7 - Cross-Site Request Forgery (Add Admin)
VMWAre vCloud Director 9.7.0.15498291 - Remote Code Execution
Navigate CMS 2.8.7 - Authenticated Directory Traversal
D-Link DIR-615 T1 20.10 - CAPTCHA Bypass
Online Marriage Registration System 1.0 - Remote Code Execution
Cayin Content Management Server 11.0 - Remote Command Injection (root)
SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)
Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read
Cayin Signage Media Player 3.0 - Remote Command Injection (root)
Cayin Digital Signage System xPost 2.5 - Remote Command Injection
 2020-06-05 05:01:53 +00:00
Offensive Security
dfb79e06a1 DB: 2020-06-04 
1 changes to exploits/shellcodes

vCloud Director 9.7.0.15498291 - Remote Code Execution
 2020-06-04 05:01:55 +00:00
Offensive Security
34b629388a DB: 2020-06-03 
3 changes to exploits/shellcodes

Microsoft Windows - 'SMBGhost' Remote Code Execution
Clinic Management System 1.0 - Authentication Bypass
OpenCart 3.0.3.2 - Stored Cross Site Scripting (Authenticated)
 2020-06-03 05:01:54 +00:00
Offensive Security
b68cd4f38a DB: 2020-06-02 
3 changes to exploits/shellcodes

Wordpress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation
VMware vCenter Server 6.7 - Authentication Bypass
QuickBox Pro 2.1.8 - Authenticated Remote Code Execution
 2020-06-02 05:01:56 +00:00
Offensive Security
326e1cc9df DB: 2020-05-30 
2 changes to exploits/shellcodes

WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)
Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass
 2020-05-30 05:01:57 +00:00
Offensive Security
99dc6c7c33 DB: 2020-05-29 
4 changes to exploits/shellcodes

NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection
Online-Exam-System 2015 - 'fid' SQL Injection
EyouCMS 1.4.6 - Persistent Cross-Site Scripting
QNAP QTS and Photo Station 6.0.3 - Remote Command Execution
 2020-05-29 05:02:05 +00:00
g0tmi1k
e6cbbdf390
Merge pull request #175 from g0tmi1k/#173 
Fix for EDBID: 47041
 2020-05-28 12:15:36 +01:00
g0tmi1k
a24770728d Fix for EDBID: 47041 2020-05-28 12:14:47 +01:00
Offensive Security
d7ce1d69e6 DB: 2020-05-28 
7 changes to exploits/shellcodes

BIND - 'TSIG' Denial of Service
Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting
LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting
osTicket 1.14.1 - 'Ticket Queue' Persistent Cross-Site Scripting
osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting
Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting
OXID eShop 6.3.4 - 'sorting' SQL Injection
 2020-05-28 05:02:11 +00:00
g0tmi1k
a6b8202361 Merge pull request #174 from g0tmi1k/#173 
Fix #173 - Escape backslash
 2020-05-27 10:16:57 +01:00
g0tmi1k
733902a6e6 Fix #173 - Escape backslash 2020-05-27 10:15:53 +01:00
Offensive Security
e031da05b0 DB: 2020-05-27 
7 changes to exploits/shellcodes

StreamRipper32 2.6 - Buffer Overflow (PoC)
OpenEMR 5.0.1 - Remote Code Execution
Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion (Authenticated)
Pi-hole 4.4.0 - Remote Code Execution (Authenticated)
WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution
 2020-05-27 05:02:09 +00:00