CVE-2021-3129
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Github link:
https://github.com/Prabesh01/hoh4
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Github link:
https://github.com/Prabesh01/hoh4
GitHub
GitHub - Prabesh01/hoh4: Modified version of laravel ignition RCE (CVE-2021-3129) exploit script for Hour of Hack Session-4
Modified version of laravel ignition RCE (CVE-2021-3129) exploit script for Hour of Hack Session-4 - Prabesh01/hoh4
CVE-2024-46538
A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.
Github link:
https://github.com/LauLeysen/CVE-2024-46538
A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.
Github link:
https://github.com/LauLeysen/CVE-2024-46538
GitHub
GitHub - LauLeysen/CVE-2024-46538: based on [EQSTLab](https://github.com/EQSTLab)
based on [EQSTLab](https://github.com/EQSTLab). Contribute to LauLeysen/CVE-2024-46538 development by creating an account on GitHub.
CVE-2022-1386
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
Github link:
https://github.com/lamcodeofpwnosec/CVE-2022-1386
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
Github link:
https://github.com/lamcodeofpwnosec/CVE-2022-1386
GitHub
GitHub - lamcodeofpwnosec/CVE-2022-1386: Fusion Builder < 3.6.2 - Unauthenticated SSRF
Fusion Builder < 3.6.2 - Unauthenticated SSRF. Contribute to lamcodeofpwnosec/CVE-2022-1386 development by creating an account on GitHub.
CVE-2023-4220
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Github link:
https://github.com/MikeyPPPPPPPP/CVE-2023-4220
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Github link:
https://github.com/MikeyPPPPPPPP/CVE-2023-4220
GitHub
GitHub - MikeyPPPPPPPP/CVE-2023-4220: Remote command execution exploit made for redteamers.
Remote command execution exploit made for redteamers. - MikeyPPPPPPPP/CVE-2023-4220
CVE-2022-26318
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
Github link:
https://github.com/egilas/Watchguard-RCE-POC-CVE-2022-26318
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
Github link:
https://github.com/egilas/Watchguard-RCE-POC-CVE-2022-26318
GitHub
GitHub - egilas/Watchguard-RCE-POC-CVE-2022-26318: PoC for Watchguard CVE-2022-26318 updated to Python3.12
PoC for Watchguard CVE-2022-26318 updated to Python3.12 - egilas/Watchguard-RCE-POC-CVE-2022-26318
CVE-2024-9465
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Github link:
https://github.com/Farzan-Kh/CVE-2024-9465
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Github link:
https://github.com/Farzan-Kh/CVE-2024-9465
CVE-2023-4220
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Github link:
https://github.com/Pr1or95/CVE-2023-4220-exploit
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Github link:
https://github.com/Pr1or95/CVE-2023-4220-exploit
GitHub
GitHub - Pr1or95/CVE-2023-4220-exploit: Carga de archivos sin restricciones en la funcionalidad de carga de archivos grandes en…
Carga de archivos sin restricciones en la funcionalidad de carga de archivos grandes en `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` en Chamilo LMS en versiones <= 1.11.24 permite ...