Exploits

SCP Client – Multiple Vulnerabilities (SSHtranger Things)

# Exploit Title: SSHtranger Things

Watchr 1.1.0.0 – Denial of Service (PoC)

# Exploit Title: Watchr 1.1.0.0 - Denial of Service (PoC)

One Search 1.1.0.0 – Denial of Service (PoC)

# Exploit Title: One Search 1.1.0.0 - Denial of Service (PoC)

Eco Search 1.0.2.0 – Denial of Service (PoC)

# Exploit Title: Eco Search 1.0.2.0 - Denial of Service (PoC)

7 Tik 1.0.1.0 – Denial of Service (PoC)

# Exploit Title: 7 Tik 1.0.1.0 - Denial of Service (PoC)

VPN Browser+ 1.1.0.0 – Denial of Service (PoC)

# Exploit Title: VPN Browser+ 1.1.0.0 - Denial of Service (PoC)

FastTube 1.0.1.0 – Denial of Service (PoC)

# Exploit Title: FastTube 1.0.1.0 - Denial of Service (PoC)

Joomla! Core 3.9.1 – Persistent Cross-Site Scripting in Global Configuration Textfilter Settings

# Exploit Title: [Joomla Global Configuration Text Filter settings Stored XSS Vulnerability]

Webmin 1.900 – Remote Command Execution (Metasploit)

##

Microsoft Edge Chakra – ‘InlineArrayPush’ Type Confusion

In Chakra, if you add a numeric property to an object having inlined properties, it will start transition to a new ty...

Microsoft Edge Chakra – ‘NewScObjectNoCtor’ or ‘InitProto’ Type Confusion

NewScObjectNoCtor and InitProto opcodes are treated as having no side effects, but actually they can have via the Set...

Microsoft Edge Chakra – ‘InitClass’ Type Confusion

Issue description

Microsoft Edge Chakra – ‘JsBuiltInEngineInterfaceExtensionObject::InjectJsBuiltInLibraryCode’ Use-After-Free

The JsBuiltInEngineInterfaceExtensionObject::InjectJsBuiltInLibraryCode method is used to execute JsBuiltIn.js which ...

Pydio / AjaXplorer < 5.0.4 - (Unauthenticated) Arbitrary File Upload

# Exploit Title: Unauthenticated Arbitrary File Upload Vulnerability In Pydio/AjaXplorer 5.0.3 – 3.3.5

Oracle Reports Developer Component 12.2.1.3 – Cross-site Scripting

# Exploit Title: [Cross-site Scripting (XSS)]

Microsoft Windows CONTACT – Remote Code Execution

[+] Credits: John Page (aka hyp3rlinx)

Check Point ZoneAlarm 8.8.1.110 – Local Privilege Escalation

# Exploit Title: Check Point ZoneAlarm Local Privilege Escalation

Spotify 1.0.96.181 – ‘Proxy configuration’ Denial of Service (PoC)

# Exploit Title: Spotify 1.0.96.181 - "Proxy configuration" Denial of Service (PoC)

Fortinet FortiGate FortiOS < 6.0.3 - LDAP Credential Disclosure

#/usr/bin/python3

Roxy Fileman 1.4.5 – Arbitrary File Download

# Exploit Title: Roxy Fileman 1.4.5 - Arbitrary File Download

doorGets CMS 7.0 – Arbitrary File Download

# Exploit Title: doorGets CMS 7.0 - Arbitrary File Download

ShoreTel / Mitel Connect ONSITE 19.49.5200.0 – Remote Code Execution

# Exploit Title: ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution

NTPsec 1.1.2 – ‘ctl_getitem’ Out-of-Bounds Read (PoC)

#!/usr/bin/env python

NTPsec 1.1.2 – ‘ntp_control’ Out-of-Bounds Read (PoC)

#!/usr/bin/env python

NTPsec 1.1.2 – ‘ntp_control’ (Authenticated) NULL Pointer Dereference (PoC)

#!/usr/bin/env python

NTPsec 1.1.2 – ‘config’ (Authenticated) Out-of-Bounds Write Denial of Service (PoC)

#!/usr/bin/env python

GL-AR300M-Lite 2.27 – (Authenticated) Command Injection / Arbitrary File Download / Directory Traversal

# Exploit Title: GL-AR300M-Lite Authenticated Command injection - Arbitrary file download - Directory Traversal

Coship Wireless Router 4.0.0.48 / 4.0.0.40 / 5.0.0.54 / 5.0.0.55 / 10.0.0.49 – Unauthenticated Admin Password Reset

Google Chrome V8 JavaScript Engine 71.0.3578.98 – Out-of-Memory in Invalid Array Length

Blueimp’s jQuery File Upload 9.22.0 – Arbitrary File Upload Exploit

# Exploit Title: Exploit for Blueimp's jQuery File Upload

WebKit JSC JIT – GetIndexedPropertyStorage Use-After-Free

The doesGC function simply takes a node, and tells if it might cause a garbage collection. This function is used to d...

Microsoft Windows 10 – ‘RestrictedErrorInfo’ Unmarshal Section Handle Use-After-Free

Windows: RestrictedErrorInfo Unmarshal Section Handle UAF EoP

Microsoft Windows 10 – XmlDocument Insecure Sharing Privilege Escalation

Windows: XmlDocument Insecure Sharing Elevation of Privilege

blueman – set_dhcp_handler D-Bus Privilege Escalation (Metasploit)

##

1Password < 7.0 - Denial of Service

############

Microsoft Windows VCF – Remote Code Execution

[+] Credits: John Page (aka hyp3rlinx)

ownDMS 4.7 – SQL Injection

# Exploit Title: ownDMS 4.7 - SQL Injection

Across DR-810 ROM-0 – Backup File Disclosure

#Exploit Title: Across DR-810 ROM-0 Backup - File Disclosure(Sensitive Information)

i-doit CMDB 1.12 – Arbitrary File Download

# Exploit Title: i-doit CMDB 1.12 - Arbitrary File Download

i-doit CMDB 1.12 – SQL Injection

# Exploit Title: i-doit CMDB 1.12 - SQL Injection

Horde Imp – ‘imap_open’ Remote Command Execution

# Exploit Title: Horde Imp Unauthenticated Remote Command Execution

Modern POS 1.3 – Arbitrary File Download

# Exploit Title: Modern POS 1.3 - Arbitrary File Download

Modern POS 1.3 – SQL Injection

# Exploit Title: Modern POS 1.3 - SQL Injection

Twilio WEB To Fax Machine System Application 1.0 – SQL Injection

# Exploit Title: Fax Machine System Application 1.0 - SQL Injection

Live Call Support Widget 1.5 – Cross-Site Request Forgery (Add Admin)

# Exploit Title: Live Call Support 1.5 - Cross-Site Request Forgery (Add Admin)

Live Call Support Widget 1.5 – Remote Code Execution / SQL Injection

# Exploit Title: Live Call Support 1.5 - Remote Code Execution / SQL Injection

xorg-x11-server < 1.20.3 (Solaris 11) - 'inittab Local Privilege Escalation

#!/bin/sh

Hootoo HT-05 – Remote Code Execution (Metasploit)

require 'msf/core'

Craigs Classified Ads CMS Theme 1.0.2 – SQL Injection

# Exploit Title: Craigs CMS 1.0.2 - SQL Injection

Find a Place CMS Directory 1.5 – SQL Injection

# Exploit Title: Locations CMS 1.5 - SQL Injection