Enhanced Mitigation Experience Toolkit (EMET) – XML External Entity Injection
[+] Credits: John Page (aka hyp3rlinx)
Exploits
Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
- 类型
- 漏洞条目
- 总量
- 24,950
- 页码
- 141
SIPp 3.6 – Local Buffer Overflow (PoC)
# Exploit Title: SIPp 3.6 - Local Buffer Overflow (PoC)
Dolibarr ERP/CRM < 7.0.3 - PHP Code Injection
# Exploit Title: Unauthenticated Remote Code Evaluation in Dolibarr ERP CRM =
Delta Industrial Automation COMMGR 1.08 – Stack Buffer Overflow (PoC)
# Exploit Title: Delta Electronics Delta Industrial Automation COMMGR
BEESCMS 4.0 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: A CSRF vulnerability exists in BEESCMS_V4.0: The administrator can be added arbitrarily.
HongCMS 3.0.0 – (Authenticated) SQL Injection
# Exploit Title: HongCMS 3.0.0 - SQL Injection
hycus CMS 1.0.4 – Authentication Bypass
# Exploit Title: hycus Content Management System v1.0.4 Login Page Bypass
DIGISOL DG-HR3400 Wireless Router – Cross-Site Scripting
# Exploit Title: DIGISOL DG-HR3400 Wireless Router - Cross-Site Scripting
WordPress Core < 4.9.6 - (Authenticated) Arbitrary File Deletion
# Exploit Title: Wordpress
Liferay Portal < 7.0.4 - Server-Side Request Forgery
1. ADVISORY INFORMATION
PoDoFo 0.9.5 – Buffer Overflow (PoC)
# Exploit Title: PoDoFo 0.9.5 - Stack-Based Buffer Overflow (PoC)
WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection
# Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection
Ecessa Edge EV150 10.7.4 – Cross-Site Request Forgery (Add Superuser)
# Exploit Title: Ecessa Edge EV150 10.7.4 - Cross-Site Request Forgery (Add Superuser)
Intex Router N-150 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: Intex Router N-150 - Cross-Site Request Forgery (Add Admin)
DIGISOL DG-BR4000NG – Buffer Overflow (PoC)
# Exploit Title: DIGISOL DG-BR4000NG - Buffer Overflow (PoC)
DIGISOL DG-BR4000NG – Cross-Site Scripting
# Exploit Title: DIGISOL DG-BR4000NG - Cross-Site Scripting
Ecessa WANWorx WVR-30 < 10.7.4 - Cross-Site Request Forgery (Add Superuser)
# Exploit title: Ecessa WANWorx WVR-30 < 10.7.4 - Cross-Site Request Forgery (Add Superuser)
AsusWRT RT-AC750GF – Cross-Site Request Forgery (Change Admin Password)
# Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password)
Ecessa ShieldLink SL175EHQ < 10.7.4 - Cross-Site Request Forgery (Add Superuser)
# Exploit Title: Ecessa ShieldLink SL175EHQ 10.7.4 - Cross-Site Request Forgery (Add Superuser)
Intex Router N-150 – Arbitrary File Upload
# Exploit Title: Intex Router N-150 - Arbitrary File Upload
WordPress Plugin Comments Import & Export < 2.0.4 - CSV Injection
# Exploit Title: Wordpress Plugin Comments Import & Export < 2.0.4 - CSV Injection
WordPress Plugin iThemes Security < 7.0.3 - SQL Injection
# Exploit Title: WordPress Plugin iThemes Security(better-wp-security)
KVM (Nested Virtualization) – L1 Guest Privilege Escalation
When KVM (on Intel) virtualizes another hypervisor as L1 VM it does not verify that VMX instructions from the L1 VM (...
GreenCMS 2.3.0603 – Information Disclosure
# Exploit Title: GreenCMS 2.3.0603 - remote obtain sensitive information
QEMU Guest Agent 2.12.50 – Denial of Service
# Exploit Title: QEMU Guest Agent 2.12.50 - Denial of Service
phpLDAPadmin 1.2.2 – ‘server_id’ LDAP Injection (Username)
# Exploit Title: phpLDAPadmin 1.2.2 - 'server_id' LDAP Injection (Username)
Opencart < 3.0.2.0 - Denial of Service
#!/usr/bin/perl -w
phpMyAdmin 4.8.1 – (Authenticated) Local File Inclusion (2)
# Exploit Title: phpMyAdmin 4.8.1 - Local File Inclusion to Remote Code Execution
LFCMS 3.7.0 – Cross-Site Request Forgery (Add User)
# Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: users can be added arbitrarily.
LFCMS 3.7.0 – Cross-Site Request Forgery (Add Admin)
# Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: administrator account can be added arbitrarily.
Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution
# Exploit Title: Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution
Dell EMC RecoverPoint < 5.1.2 - Remote Root Command Execution
# Exploit Title: Dell EMC RecoverPoint < 5.1.2 - Remote Root Command Execution
phpMyAdmin 4.8.1 – (Authenticated) Local File Inclusion (1)
The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip
Mirasys DVMS Workstation 5.12.6 – Path Traversal
# Exploit Title: Path Traversal in Gateway in Mirasys DVMS Workstation
Redis 5.0 – Denial of Service
# Exploit Title: Redis 5.0 Denial of Service
ntp 4.2.8p11 – Local Buffer Overflow (PoC)
# Exploit Title: ntpq and ntpdc 4.2.8p11 Local Buffer Overflow
MaDDash 2.0.2 – Directory Listing
# Exploit Title: MaDDash 2.0.2 - Directory Listing
NewMark CMS 2.1 – ‘sec_id’ SQL Injection
# Exploit Title: NewMark CMS 2.1 - SQL Injection (sec_id)
TP-Link TL-WA850RE – Remote Command Execution
#!/usr/bin/env python
Apache CouchDB < 2.1.0 - Remote Code Execution
# Title: Apache CouchDB < 2.1.0 - Remote Code Execution
Microsoft Windows 10 – Desktop Bridge Activation Arbitrary Directory Creation Privilege Escalation
Windows: Desktop Bridge Activation Arbitrary Directory Creation EoP
Microsoft Windows 10 – Desktop Bridge Virtual Registry CVE-2018-0880 Incomplete Fix Privilege Escalation
Windows: Windows: Desktop Bridge Virtual Registry CVE-2018-0880 Incomplete Fix EoP
VideoInsight WebClient 5 – SQL Injection
# Title: VideoInsight WebClient 5 - SQL Injection