ajdumanhug

5 exploits Active since Jul 2020
CVE-2023-46818 NOMISEC HIGH WORKING POC
ISPConfig language_edit.php PHP Code Injection
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
15 stars
CVSS 7.2
CVE-2024-21546 NOMISEC CRITICAL WORKING POC
unisharp/laravel-filemanager < 2.9.1 - Remote Code Execution via Mimetype and File Extension Manipulation
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.
4 stars
CVSS 9.8
CVE-2023-46818 NOMISEC HIGH WORKING POC
ISPConfig language_edit.php PHP Code Injection
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
1 stars
CVSS 7.2
CVE-2022-42092 NOMISEC HIGH WORKING POC
Backdrop CMS 1.22.0 - Unrestricted File Upload via Themes
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.
1 stars
CVSS 7.2
CVE-2020-5902 NOMISEC CRITICAL WORKING POC
BIG-IP 11.6.1-11.6.5.1 - Remote Code Execution via TMUI Undisclosed Pages
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
CVSS 9.8