Exploits

SoftExpert (SE) Suite v2.1.3 – Local File Inclusion

# Exploit Title: SoftExpert (SE) Suite v2.1.3 - Local File Inclusion

MilleGPG5 5.9.2 (Gennaio 2023) – Local Privilege Escalation / Incorrect Access Control

# Exploit Title: MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control

PHPFusion 9.10.30 – Stored Cross-Site Scripting (XSS)

Exploit Title: PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS)

Advanced Host Monitor v12.56 – Unquoted Service Path

# Exploit Title: Advanced Host Monitor v12.56 - Unquoted Service Path

OpenEMR v7.0.1 – Authentication credentials brute force

# Exploit Title: OpenEMR v7.0.1 - Authentication credentials brute force

FS-S3900-24T4S – Privilege Escalation

# Exploit Title: FS-S3900-24T4S Privilege Escalation

PHPJabbers Simple CMS V5.0 – Stored Cross-Site Scripting (XSS)

# Exploit Title: PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)

PHPJabbers Simple CMS 5.0 – SQL Injection

# Exploit Title: PHPJabbers Simple CMS 5.0 - SQL Injection

Companymaps v8.0 – Stored Cross Site Scripting (XSS)

# Exploit Title: Companymaps V8.0 - Stored Cross Site Scripting (XSS)

GLPI 9.5.7 – Username Enumeration

# Exploit Title: GLPI 9.5.7 - Username Enumeration

KodExplorer 4.49 – CSRF to Arbitrary File Upload

# Exploit Title: KodExplorer

OCS Inventory NG 2.3.0.0 – Unquoted Service Path

#####################################################################

PaperCut NG/MG 22.0.4 – Authentication Bypass

# Exploit Title: PaperCut NG/MG 22.0.4 - Authentication Bypass

Mars Stealer 8.3 – Admin Account Takeover

# Exploit Title: Mars Stealer 8.3 - Admin Account Takeover

Arcsoft PhotoStudio 6.0.0.172 – Unquoted Service Path

##########################################################################

Multi-Vendor Online Groceries Management System 1.0 – Remote Code Execution

# Exploit Title: Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution (RCE)

Wondershare Filmora 12.2.9.2233 – Unquoted Service Path

############################################################################

Sophos Web Appliance 4.3.10.4 – Pre-auth command injection

#!/bin/bash

Serendipity 2.4.0 – Remote Code Execution (RCE) (Authenticated)

Exploit Title: Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated)

Serendipity 2.4.0 – Cross-Site Scripting (XSS)

Exploit Title: Serendipity 2.4.0 - Cross-Site Scripting (XSS)

Lilac-Reloaded for Nagios 2.0.8 – Remote Code Execution (RCE)

#!/usr/bin/env python

File Replication Pro 7.5.0 – Privilege Escalation/Password reset due Incorrect Access Control

# Exploit Title: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control

Microsoft Word 16.72.23040900 – Remote Code Execution (RCE)

## Exploit Title: Microsoft Word 16.72.23040900 - Remote Code Execution (RCE)

Bang Resto v1.0 – Stored Cross-Site Scripting (XSS)

# Exploit Title: Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)

Bang Resto v1.0 – ‘Multiple’ SQL Injection

# Exploit Title: Bang Resto v1.0 - 'Multiple' SQL Injection

Swagger UI 4.1.3 – User Interface (UI) Misrepresentation of Critical Information

# Exploit Title: Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information

AspEmail v5.6.0.2 – Local Privilege Escalation

####################################################################################################################

GDidees CMS 3.9.1 – Local File Disclosure

# Exploit Title: GDidees CMS 3.9.1 - Local File Disclosure

Franklin Fueling Systems TS-550 – Default Password

# Exploit Title: Franklin Fueling Systems TS-550 - Default Password

Chitor-CMS v1.1.2 – Pre-Auth SQL Injection

#!/usr/bin/python3

Linux Kernel 6.2 – Userspace Processes To Enable Mitigation

## Exploit Title: Linux Kernel 6.2 - Userspace Processes To Enable Mitigation

FUXA V.1.1.13-1186 – Unauthenticated Remote Code Execution (RCE)

# Exploit Title: FUXA V.1.1.13-1186- Unauthenticated Remote Code Execution (RCE)

Piwigo 13.6.0 – Stored Cross-Site Scripting (XSS)

Exploit Title: Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)

ProjeQtOr Project Management System 10.3.2 – Remote Code Execution (RCE)

Exploit Title: ProjeQtOr Project Management System 10.3.2 -Remote Code Execution (RCE)

Bludit 4.0.0-rc-2 – Account takeover

## Exploit Title: Bludit 4.0.0-rc-2 - Account takeover

Google Chrome Browser 111.0.5563.64 – AXPlatformNodeCocoa Fatal OOM/Crash (macOS)

## Exploit Title: Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)

InnovaStudio WYSIWYG Editor 5.4 – Unrestricted File Upload / Directory Traversal

# Exploit Title: InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal

Sielco Analog FM Transmitter 2.12 – ‘id’ Cookie Brute Force Session Hijacking

## Exploit Title: Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking

Sielco Analog FM Transmitter 2.12 – Cross-Site Request Forgery

CSRF Add Admin:

Sielco Analog FM Transmitter 2.12 – Improper Access Control Change Admin Password

Sielco Analog FM Transmitter 2.12 – Remote Privilege Escalation

Sielco PolyEco Digital FM Transmitter 2.0.6 – Authentication Bypass Exploit

#!/usr/bin/env python3

Sielco PolyEco Digital FM Transmitter 2.0.6 – Authorization Bypass Factory Reset

## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset

Sielco PolyEco Digital FM Transmitter 2.0.6 – Radio Data System POST Manipulation

## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation

Sielco PolyEco Digital FM Transmitter 2.0.6 – Unauthenticated Information Disclosure

## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure

Sielco PolyEco Digital FM Transmitter 2.0.6 – Account Takeover / Lockout / EoP

## Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP

ever gauzy v0.281.9 – JWT weak HMAC secret

## Exploit Title: ever gauzy v0.281.9 - JWT weak HMAC secret

Roxy Fileman 1.4.5 – Arbitrary File Upload

# Exploit Title: Roxy Fileman 1.4.5 - Arbitrary File Upload

Paradox Security Systems IPR512 – Denial Of Service

#!/bin/bash

BrainyCP V1.0 – Remote Code Execution

# Exploit Title: BrainyCP V1.0 - Remote Code Execution