0z09e

6 exploits Active since Jun 2020
CVE-2020-35846 NOMISEC CRITICAL WORKING POC
Agentejo Cockpit < 0.11.2 - SQL Injection
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
6 stars
CVSS 9.8
CVE-2022-22909 NOMISEC HIGH WORKING POC
Digitaldruid Hoteldruid - Code Injection
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
5 stars
CVSS 8.8
CVE-2020-14295 NOMISEC HIGH WORKING POC
Cacti - SQL Injection
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
2 stars
CVSS 7.2
CVE-2021-47758 EXPLOITDB HIGH python WORKING POC
Chikitsa Patient Management System - Unrestricted File Upload
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables arbitrary command execution on the server through a weaponized PHP script.
CVSS 8.8
CVE-2021-47757 EXPLOITDB HIGH python WORKING POC
Chikitsa Patient Management System - Unrestricted File Upload
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a modified backup zip file with a malicious PHP shell to execute arbitrary system commands on the server.
CVSS 8.8
CVE-2022-22909 EXPLOITDB HIGH python WORKING POC
Digitaldruid Hoteldruid - Code Injection
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
CVSS 8.8