Exploits

Interspire Email Marketer 6.20 – ‘surveys_submit.php’ Remote Code Execution

# Exploit Title: Interspire Email Marketer 6.20 - Remote Code Execution

Cisco Prime Infrastructure Health Monitor HA TarArchive – Directory Traversal / Remote Code Execution

#!/usr/bin/python

VMware Workstation 15.1.0 – DLL Hijacking

#---------------------------------------------------------

DeepSound 1.0.4 – SQL Injection

===========================================================================================

WeChat for Android 7.0.4 – ‘vcodec2_hls_filter’ Denial of Service

# Exploit Title: DoS Wechat with an emoji

JetAudio jetCast Server 2.0 – ‘Log Directory’ Local SEH Alphanumeric Encoded Buffer Overflow

# Title: JetAudio jetCast Server 2.0 'Log Directory' Local SEH Alphanumeric Encoded Buffer Overflow

ZOC Terminal 7.23.4 – ‘Script’ Denial of Service (PoC)

#Exploit Title: ZOC Terminal v7.23.4 - 'Script' Denial of Service (PoC)

ZOC Terminal v7.23.4 – ‘Private key file’ Denial of Service (PoC)

#Exploit Title: ZOC Terminal v7.23.4 - 'Private key file' Denial of Service (PoC)

ZOC Terminal v7.23.4 – ‘Shell’ Denial of Service (PoC)

#Exploit Title: ZOC Terminal v7.23.4 - 'Shell' Denial of Service (PoC)

Axessh 4.2 – ‘Log file name’ Denial of Service (PoC)

#Exploit Title: Axessh 4.2 'Log file name' - Denial of Service (PoC)

SEL AcSELerator Architect 2.2.24 – CPU Exhaustion Denial of Service

#!/usr/bin/env python

Tomabo MP4 Converter 3.25.22 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

CommSy 8.6.5 – SQL injection

Title:

Legrand BTicino Driver Manager F454 1.0.51 – Cross-Site Request Forgery / Cross-Site Scripting

Microsoft Windows – ‘Win32k’ Local Privilege Escalation

# CVE-2019-0803

PHP-Fusion 9.03.00 – ‘Edit Profile’ Remote Code Execution (Metasploit)

##

Sales ERP 8.1 – Multiple SQL Injection

===========================================================================================

D-Link DWL-2600AP – Multiple OS Command Injection

Document Title:

Selfie Studio 2.17 – ‘Resize Image’ Denial of Service (PoC)

# -*- coding: utf-8 -*-

TwistedBrush Pro Studio 24.06 – ‘Resize Image’ Denial of Service (PoC)

# -*- coding: utf-8 -*-

TwistedBrush Pro Studio 24.06 – ‘Script Recorder’ Denial of Service (PoC)

# -*- coding: utf-8 -*-

TwistedBrush Pro Studio 24.06 – ‘.srp’ Denial of Service (PoC)

# -*- coding: utf-8 -*-

Schneider Electric U.Motion Builder 1.3.4 – ‘track_import_export.php object_id’ Unauthenticated Command Injection

RCE Security Advisory

PasteShr 1.6 – Multiple SQL Injection

===========================================================================================

SpotMSN 2.4.6 – Denial of Service (PoC)

#Exploit Title: SpotMSN 2.4.6 - 'Name/Key' Denial of Service (PoC)

DNSS 2.1.8 – Denial of Service (PoC)

#Exploit Title: DNSS Domain Name Search Software 2.1.8 - Denial of Service (PoC)

SOCA Access Control System 180612 – Information Disclosure

SOCA Access Control System 180612 Information Disclosure

SOCA Access Control System 180612 – SQL Injection

SOCA Access Control System 180612 SQL Injection And Authentication Bypass

SOCA Access Control System 180612 – Cross-Site Request Forgery (Add Admin)

SOCA Access Control System 180612 CSRF Add Admin Exploit

XOOPS 2.5.9 – SQL Injection

[+] Sql Injection on XOOPS CMS v.2.5.9

Google Chrome V8 – Turbofan JSCallReducer::ReduceArrayIndexOfIncludes Out-of-Bounds Read/Write

OpenProject 5.0.0 – 8.3.1 – SQL Injection

SEC Consult Vulnerability Lab Security Advisory < 20190510-0 >

jetCast Server 2.0 – Denial of Service (PoC)

#Exploit Title: jetCast Server 2.0 - Denial of Service (PoC)

Cortex Unshortenlink Analyzer < 1.1 - Server-Side Request Forgery

# Exploit Title: Cortex Unshortenlink Analyzer < 1.1 - Server-Side Request Forgery

SpotIM 2.2 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

SpotPaltalk 1.1.5 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

ASPRunner.NET 10.1 – Denial of Service (PoC)

#Exploit Title: ASPRunner.NET 10.1 - Denial of Service (PoC)

PHPRunner 10.1 – Denial of Service (PoC)

#Exploit Title: PHPRunner 10.1 - Denial of Service (PoC)

dotCMS 5.1.1 – HTML Injection

# Exploit Title: dotCMS 5.1.1 - HTML Injection

RICOH SP 4510DN Printer – HTML Injection

# Exploit Title: RICOH SP 4510DN Printer - HTML Injection

RICOH SP 4520DN Printer – HTML Injection

# Exploit Title: RICOH SP 4520DN Printer - HTML Injection

CyberArk Enterprise Password Vault 10.7 – XML External Entity Injection

# Exploit Title: CyberArk XML External Entity (XXE) Injection in SAML

Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Cross-Site Scripting

[+] Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Multiple Cross-Site Scripting

Lyric Video Creator 2.1 – ‘.mp3’ Denial of Service (PoC)

# -*- coding: utf-8 -*-

Lyric Maker 2.0.1.0 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

Convert Video jetAudio 8.1.7 – Denial of Service (PoC)

# -*- coding: utf-8 -*-

MiniFtp – ‘parseconf_load_setting’ Buffer Overflow

# Exploit Title: MiniFtp parseconf_load_setting local-bufferoverflow (318 bytes)

Lotus Domino 8.5.3 – ‘EXAMINE’ Stack Buffer Overflow DEP/ASLR Bypass (NSA’s EMPHASISMINE)

##########################################################

jetAudio 8.1.7.20702 Basic – ‘Enter URL’ Denial of Service (PoC)

#Exploit Title: jetAudio 8.1.7.20702 Basic - Denial of Service (PoC)

NetNumber Titan ENUM/DNS/NP 7.9.1 – Path Traversal / Authorization Bypass

# Exploit Title: NetNumber Titan ENUM/DNS/NP - Path Traversal - Authorization Bypass