0z09e

6 exploits Active since Jun 2020
CVE-2020-35846 NOMISEC CRITICAL WORKING POC
Agentejo Cockpit < 0.11.2 - NoSQL Injection via Auth Controller Check Function
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
6 stars
CVSS 9.8
CVE-2022-22909 NOMISEC HIGH WORKING POC
HotelDruid 3.0.3 - Remote Code Execution via Create New Room Name Field
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
5 stars
CVSS 8.8
CVE-2020-14295 NOMISEC HIGH WORKING POC
Cacti 1.2.12 - Authenticated SQL Injection via color.php filter Parameter
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
2 stars
CVSS 7.2
CVE-2021-47758 EXPLOITDB HIGH python WORKING POC
Chikitsa Patient Management System 2.0.2 - Authenticated Remote Code Execution via Malicious Plugin Upload
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables arbitrary command execution on the server through a weaponized PHP script.
CVSS 8.8
CVE-2021-47757 EXPLOITDB HIGH python WORKING POC
Chikitsa Patient Management System 2.0.2 - Authenticated Remote Code Execution via Backup Restoration
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a modified backup zip file with a malicious PHP shell to execute arbitrary system commands on the server.
CVSS 8.8
CVE-2022-22909 EXPLOITDB HIGH python WORKING POC
HotelDruid 3.0.3 - Remote Code Execution via Create New Room Name Field
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
CVSS 8.8