Page 7 - Software Link News Today

# Exploit Title: Joomla Solidres 2.13.3 - Reflected XSS# Exploit Author: CraCkEr# Date: 28/07/2023# Vendor: Solidres Team# Vendor Homepage: http://solidres.com/# Software Link: https://extensions.joomla.org/extension/vertical-markets/booking-a-reservations/solidres/# Demo: http://demo.solidres.com/joomla# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter....

#!/bin/bash# Exploit Title: Online Piggery Management System v1.0 - unauthenticated file upload vulnerability# Date: July 12 2023# Exploit Author: 1337kid# Software Link: https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html# Version: 1.0# Tested on: Ubuntu# CVE : CVE-2023-37629## chmod +x exploit.sh# ./exploit.sh web_url# ./exploit.sh http://127.0.0.1:8080/echo " _____ _____ ___ __ ___ ____ ________ __ ___ ___ "echo " / __ / /

# Exploit Title: Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution# Date: 16 July 2023# Exploit Author: Thurein Soe# CVE : CVE-2022-28171# Vendor Homepage: https://www.hikvision.com# Software Link: N/A# Refence Link: https://cve.report/CVE-2022-28171# Version: Filmora 12: Ds-a71024 Firmware, Ds-a71024 Firmware Ds-a71048r-cvs Firmware Ds-a71048 Firmware Ds-a71072r Firmware Ds-a71072r Firmware Ds-a72024 Firmware Ds-a72024 Firmware Ds-a72048r-cvs Firmware Ds-a72072r

# Exploit Title: Foody Friend 1.0 - Arbitrary File Upload# Exploit Author: CraCkEr# Date: 12/07/2023# Vendor: Bug Finder# Vendor Homepage: https://bugfinder.net/# Software Link: https://bugfinder.net/product/foody-friend-a-saas-based-web-app-food-ordering-bot-for-telegram-and-messenger/25# Tested on: Windows 10 Pro# Impact: Allows User to upload files to the web server## DescriptionAllows Attacker to upload malicious files onto the server, such as Stored XSS## Steps to Reproduce:1.

# Exploit Title: Travelable 1.0 - Stored XSS# Exploit Author: CraCkEr# Date: 15/07/2023# Vendor: travelmate.com# Vendor Homepage: https://www.codester.com/items/43963/travelable-trek-management-solution# Software Link: https://travel.codeswithbipin.com/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site## DescriptionAllow Attacker to inject malicious code into website, give ability to steal sensitiveinformation, manipulate data, and launch additional attacks.Path: /[random-nu...

# Exploit Title: BloodBank 1.1 - SQL Injection# Exploit Author: CraCkEr# Date: 15/07/2023# Vendor: phpscriptpoint# Vendor Homepage: https://phpscriptpoint.com/# Software Link: https://demo.phpscriptpoint.com/bloodbank/# Tested on: Windows 10 Pro# Impact: Database Access## DescriptionSQL injection attacks can allow unauthorized access to sensitive data, modification ofdata and crash the application or make it unavailable, leading to lost revenue anddamage to

# Exploit Title: Carlisting 1.6 - Reflected XSS# Exploit Author: CraCkEr# Date: 16/07/2023# Vendor: phpscriptpoint# Vendor Homepage: https://phpscriptpoint.com/# Software Link: https://demo.phpscriptpoint.com/carlisting/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety

# Exploit Title: Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated)# Exploit Author: Sander Ferdinand# Date: 2023-06-07# Version: 13.4.0# Vendor Homepage: http://erpnext.org# Software Link: https://github.com/frappe/frappe/# Tested on: Ubuntu 22.04# CVE : noneSilly sandbox escape.> Frappe Framework uses the RestrictedPython library to restrict access to methods available for server scripts.Requirements:- 'System Manager' role (which is

# Exploit Title: Spring Cloud 3.2.2 - Remote Command Execution (RCE)# Date: 07/07/2023# Exploit Author: GatoGamer1155, 0bfxgh0st# Vendor Homepage: https://spring.io/projects/spring-cloud-function/# Description: Exploit to execute commands exploiting CVE-2022-22963# Software Link: https://spring.io/projects/spring-cloud-function# CVE: CVE-2022-22963import requests, argparse, jsonparser = argparse.ArgumentParser()parser.add_argument("--url", type=str, help="http://172.17.0.2:8080/fu...

# Exploit Title: Atlas Business Directory Listing 2.13 - Reflected XSS# Exploit Author: CraCkEr# Date: 09/07/2023# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/atlas/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan