Suphawith Phusanbai

7 exploits Active since Oct 2024
CVE-2024-48827 WRITEUP HIGH WRITEUP
sbondCo Watcharr 1.43.0 - Remote Code Execution and Privilege Escalation via Change Password Function
An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function.
CVSS 8.8
CVE-2024-48093 WRITEUP HIGH WRITEUP
Operately 0.1.0 - Authenticated Remote Code Execution via Unrestricted File Upload in Discussions Tab
Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing malicious files without validating file extensions or content types.
CVSS 8.0
CVE-2024-50634 WRITEUP HIGH WORKING POC
Watcharr < 1.43.0 - Privilege Escalation via Weak JWT Token
A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication.
CVSS 8.8
CVE-2024-50636 WRITEUP CRITICAL WRITEUP
PyMOL 2.5.0 - Remote Code Execution via Malicious .PYM File
PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers can craft a malicious .PYM file containing a Python reverse shell payload and exploit the function to achieve Remote Command Execution (RCE). This vulnerability arises because PyMOL treats .PYM files as Python scripts without properly validating or restricting the commands within the script, enabling attackers to run unauthorized commands in the context of the user running the application.
CVSS 9.8
CVE-2024-53484 WRITEUP HIGH WRITEUP
Ever Traduora <0.20.0 - Privilege Escalation
Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key.
CVSS 8.8
CVE-2024-57276 WRITEUP HIGH WRITEUP
Electronic Arts Dragon Age Origins 1.05 - Privilege Escalation
In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability. This service is configured with insecure permissions, allowing users to modify the executable file path used by the service. The service runs with NT AUTHORITY\SYSTEM privileges, enabling attackers to escalate privileges by replacing or placing a malicious executable in the service path.
CVSS 7.3
CVE-2024-48827 EXPLOITDB HIGH python WORKING POC
sbondCo Watcharr 1.43.0 - Remote Code Execution and Privilege Escalation via Change Password Function
An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function.
CVSS 8.8