Exploits

TP-Link Technologies TL-WA850RE Wi-Fi Range Extender – Remote Reboot

# Exploit Title: TP-Link Technologies TL-WA850RE Wi-Fi Range Extender | Unauthorized Remote Reboot

Frog CMS 0.9.5 – Persistent Cross-Site Scripting

# Exploit Title: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings

Shopy Point of Sale 1.0 – CSV Injection

# Exploit Title: Shopy Point of Sale v1.0 - CSV Injection

Blog Master Pro 1.0 – CSV Injection

# Exploit Title: Blog Master Pro v1.0 - CSV Injection

HRSALE The Ultimate HRM 1.0.2 – CSV Injection

# Exploit Title: HRSALE The Ultimate HRM 1.0.2 - CSV Injection

HRSALE The Ultimate HRM 1.0.2 – ‘award_id’ SQL Injection

# Exploit Title: HRSALE The Ultimate HRM v1.0.2 - 'award_id' SQL Injection

HRSALE The Ultimate HRM 1.0.2 – (Authenticated) Cross-Site Scripting

# Exploit Title: HRSALE The Ultimate HRM 1.0.2 - Authenticated Cross Site Scripting

HRSALE The Ultimate HRM 1.0.2 – Local File Inclusion

# Exploit Title: HRSALE The Ultimate HRM v1.0.2 - Local File Inclusion

Chrome V8 JIT – ‘AwaitedPromise’ Update Bug

Here's a snippet of AsyncGeneratorReturn. (https://cs.chromium.org/chromium/src/v8/src/builtins/builtins-async-genera...

Chrome V8 JIT – Arrow Function Scope Fixing Bug

When the parser parses the parameter list of an arrow function contaning destructuring assignments, it can't distingu...

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)

This is a sample of exploit for Drupal 7 new vulnerability SA-CORE-2018-004 / CVE-2018-7602.

UK Cookie Consent – Persistent Cross-Site Scripting

# Exploit Title: UK Cookie Consent v2.3.9 - Persistent Cross-Site Scripting

WUZHI CMS 4.1.0 – Cross-Site Request Forgery

# Exploit Title: WUZHI CMS 4.1.0 - Cross-Site Request Forgery

Open-AudIT 2.1 – CSV Macro Injection

Hi Guys,

Monstra CMS 3.0.4 – Arbitrary Folder Deletion

# Exploit Title: Monstra CMS 3.0.4 allows remote attackers to delete folder via an get request

Interspire Email Marketer < 6.1.6 - Remote Admin Authentication Bypass

'''

VLC Media Player/Kodi/PopcornTime ‘Red Chimera’ < 2.2.5 - Memory Corruption (PoC)

"""

Ericsson-LG iPECS NMS A.1Ac – Cleartext Credential Disclosure

# -*- coding: utf-8 -*-

RGui 3.4.4 – Local Buffer Overflow

#!/usr/bin/python

Allok Video to DVD Burner 2.6.1217 – Buffer Overflow (SEH)

#######################################################

gif2apng 1.9 – ‘.gif’ Stack Buffer Overflow

# Exploit Title: gif2apng 1.9 '.gif' Stack-Buffer Overflow

WordPress Plugin Woo Import Export 1.0 – Arbitrary File Deletion

Kaspersky KSN for Linux 5.2 – Memory Corruption

'''

Easy File Sharing Web Server 7.2 – ‘UserID’ Remote Buffer Overflow (DEP Bypass)

#!/usr/bin/env python

lastore-daemon D-Bus – Privilege Escalation (Metasploit)

##

ASUS infosvr – Authentication Bypass Command Execution (Metasploit)

##

Microsoft Internet Explorer 11.371.16299.0 (Windows 10) – Denial Of Service

'''

Adobe Flash – Overflow when Playing Sound

The attached fuzzed swf file causes heap overflow when playing a sound.

Adobe Flash – Overflow in Slab Rendering

The attached fuzzed swf file causes heap or stack corruption (depending on platform) when rendering a slab.

Adobe Flash – Info Leak in Image Inflation

The attached image causes an info leak in image inflation. It occasionally crashes when rendered, otherwise it displa...

Adobe Flash – Out-of-Bounds Write in blur Filtering

The attached swf file causes and out-of-bounds write in blur filtering.

Chrome V8 JIT – ‘NodeProperties::InferReceiverMaps’ Type Confusion

https://cs.chromium.org/chromium/src/v8/src/compiler/node-properties.cc?rcl=df84e87191022bf6914f9570069908f10b303245&...

WSO2 Carbon / WSO2 Dashboard Server 5.3.0 – Persistent Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory < 20180423-0 >

Microsoft Windows – Local Privilege Escalation

#include "stdafx.h"

phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery

# Exploit Title: phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery

Ncomputing vSpace Pro 10/11 – Directory Traversal

# Exploit Title: Ncomputing vSpace Pro v10 and v11 - Directory Traversal Vulnerability

Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

#!/usr/bin/env python

Free Download Manager 2.0 Built 417 – Local Buffer Overflow (SEH)

# Exploit Title: Free Download Manager 2.0 Built 417 - Local Buffer Overflow (SEH)

PRTG Network Monitor < 18.1.39.1648 - Stack Overflow (Denial of Service)

# Exploit Title: PRTG 18.1.39.1648 - Stack Overflow

Drupal avatar_uploader v7.x-1.0-beta8 – Arbitrary File Disclosure

#Title: Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure

Monstra cms 3.0.4 – Persitent Cross-Site Scripting

# Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting

VMware Workstation 12.5.2 – Drag n Drop Use-After-Free (Pwn2Own 2017) (PoC)

char *initial_dnd = "tools.capability.dnd_version 4";

Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 – Deserialization Remote Command Execution

# -*- coding: utf-8 -*-

Cobub Razor 0.8.0 – Physical Path Leakage

# Exploit Title: Cobub Razor 0.8.0 Physical path Leakage Vulnerability

MySQL Squid Access Report 2.1.4 – SQL Injection / Cross-Site Scripting

# Exploit Title: MySQL Squid Access Report 2.1.4 Multiple Vulnerabilities

Rvsitebuilder CMS – Database Backup Download

# Exploit Title: Rvsitebuilder CMS Database Backup Download

Easy File Sharing Web Server 7.2 – Stack Buffer Overflow

# Exploit Title: Easy File Sharing Web Server 7.2 stack buffer overflow

Match Clone Script 1.0.4 – Cross-Site Scripting

########################################################################

Kodi 17.6 – Persistent Cross-Site Scripting

=============================================

Lutron Quantum 2.0 – 3.2.243 – Information Disclosure

'''