Exploit Collector
Ransom.Conti MVID-2022-0601 Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Conti MVID-2022-0606 Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress WP Event Manager 3.1.27 Cross Site Scripting

https://3.bp.blogspot.com/-jrxagBWWEzc/WWlvX2ct0sI/AAAAAAAAIOc/SeYUuYsvaHQ6pP3Hky0NtyeOgPg6HpFpgCLcBGAs/s1600/h54.png
WordPress WP Event Manager plugin version 3.1.27 suffers from a persistent cross site scripting vulnerability.

SHA-256 | cb5312a73f5b91f714b3b64a7d4a985e9b27b678feeae51e27a65c49cef79597

Download
# Exploit Title: WordPress Plugin WP Event Manager - Stored Cross Site
Scripting
# Date: 15-05-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage: https://wordpress.org/plugins/wp-event-manager/
# Version: 3.1.27
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com
#Steps To Reproduce :

1 - First Install the plugins - wp-event-manager and activate it.
2 - Go to event manager —> Add New
3 - Inside the “”Event Title” at the top, enter XSS payload “>
onerror=alert(1)> and hit publish.
4 - Check the newly made event’s URL /event/{id}/ , XSS will trigger.

#Poc Image :

https://imgur.com/J1Q3x5u

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Zyxel Remote Command Execution

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Victorian Machinery is a proof of concept exploit for CVE-2022-30525. The vulnerability is an unauthenticated and remote command injection vulnerability affecting Zyxel firewall's that support zero touch provisioning. Zyxel pushed a fix for this issue on April 28, 2022. Multiple models are affected.

SHA-256 | d85780bb5daa2abd4c685fc1f2bd14ad0bfe7fbd9a5a6a99b45f1efcddb6a0bf

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Conti MVID-2022-0602 Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Zyxel Firewall ZTP Unauthenticated Command Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome 100 extensions::ExtensionApiFrameIdMap::GetFrameId Heap Use-After-Free

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
A use-after-free issue exists in Chrome 100 and earlier versions. A malicious extension can achieve arbitrary code execution in the browser process.

SHA-256 | 595428413ed6af41648e85f12bfacfc4d3b4b659dea62dab16b66777c9ddb014

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IpMatcher 1.0.4.1 Server-Side Request Forgery

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
HighCMS/HighPortal 12.x SQL Injection

https://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png
HighCMS/HighPortal version 12.x appears to suffer from a remote SQL injection vulnerability.

SHA-256 | 11e531f865e4da1f04161aa0a4cb5e11bbe807e029d3818481e6c9fa1d18a1e6

Download
# Exploit Title: HighCMS/HighPortal v12.x SQL Inj
# Type : WEBAPPS "HighCMS/HighPortal"
# Platform : ASP.NET
# Date : 4/23/2022
# Exploit Author : E1.Coders
# Software Link : https://aryanic.com/page/portal
# Version : v12.x
# Category : Webapps
# Tested on: Linux/Windows
# Google Dork: inurl:index.jsp?siteid=1&fkeyid=&siteid=1&pageid=

# Google Dork: <©2022

Step 1: Enter the address of the "page" that has the problem of sql injection attacks
http: //TARGET/index.jsp? Siteid = 1 & fkeyid = & siteid = 1 & pageid = 6528 Default credentials. ( is True )
STEP 2 : Send the following request "
or
Use sqlmap : python sqlmap.py -u "https://example.ir/index.jsp?siteid=1&fkeyid=&siteid=1&pageid=11211"


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty от Meta Pool

Meta Pool опубликовал в своем gitBook программу Bug Bounty, в которой может участвовать любой, кто обнаружит ошибку или уязвимость в…Continue reading on Meta Pool Russia »
Read more...