66 bytes small Linux/x86 Execve() alphanumeric shellcode.

114 bytes small Linux/x86 random bytes encoder and XOR/SUB/NOT/ROR execve(/bin/sh) shellcode.

571 bytes small Microsoft Windows x86 dynamic bind shell and null-free shellcode.

223 bytes small dynamic, null-free popcalc shellcode.

195 bytes small Windows/x86 null-free WinExec Calc.exe shellcode.

This Metasploit module exploits an issue in Google Chrome version 80.0.3987.87 (64 bit). The exploit corrupts the length of a float array (float_rel), which can then be used for out of bounds read and write on adjacent memory. The relative read and write is then used to modify a UInt64Array (uint64_aarw) which is used for read and writing from absolute memory. The exploit then uses WebAssembly in order to allocate a region of RWX memory, which is then replaced with the payload shellcode. The payload is executed within the sandboxed renderer process, so the browser must be run with the --no-sandbox option for the payload to work correctly.

232 bytes small Dynamic MessageBoxA||W PEB and Import Table Method shellcode.

210 bytes small WinExec add-admin dynamic null-free shellcode.

26 bytes small Linux/x86 reboot polymorphic shellcode.

33 bytes small Linux/x86 egghunter null-free shellcode.

63 bytes small Linux/x64_86 dynamic egghunter shellcode that searches memory for 2 instances of the egg. When the eggs are found, the egghunter passes execution control to the payload at the memory address of the eggs. The payload is an execve(/bin/bash) shellcode.

272 bytes small Linux/x86_64 null free password protected bindshell shellcode.

57 bytes small Linux/x64_86 /bin/bash shellcode. The stub decodes the ROL Encoded shellcode. When the stub has finished decoding the payload, execution control is passed to the payload.

39 bytes small Linux/x86 egghunter null-free shellcode. The egghunter dynamically searches memory for 2 instances of the egg. When the eggs are found, the egghunter passes execution control to the payload at the memory address of the eggs.

Citrix Application Delivery Controller and Citrix Gateway directory traversal remote code execution exploit.

Lotus Core CMS version 1.0.1 suffers from a local file inclusion vulnerability.

SuiteCRM versions 7.11.11 and below suffer from an add_to_prospect_list broken access control that allows for local file inclusion attacks.

QRadar Community Edition version 7.3.1.6 is vulnerable to instantiation of arbitrary objects based on user-supplied input. An authenticated attacker can abuse this to perform various types of attacks including server-side request forgery and (potentially) arbitrary execution of code.

PhreeBooks ERP version 5.2.5 suffers from a remote command execution vulnerability.

This Metasploit module exploits a vulnerability in the Kentico CMS platform versions 12.0.14 and earlier. Remote command execution is possible via unauthenticated XML requests to the Staging Service SyncServer.asmx interface ProcessSynchronizationTaskData method stagingTaskData parameter. XML input is passed to an insecure .NET deserialize call which allows for remote command execution.

UPLoad version 7.0 suffers from an insecure cookie handling vulnerability.

Ac4p.com Gallery version 1.0 suffers from cross site scripting, phpinfo disclosure, shell upload, and insecure cookie handling vulnerabilities.

Newbie CMS suffers from an insecure cookie handling vulnerability.

CuteNews version 1.4.6 suffers from an insecure cookie handling vulnerability.

Islamic Voice suffers from an insecure cookie handling vulnerability.

Denapars Shop Script suffers from administrative bypass, shell upload, and insecure cookie handling vulnerabilities.

velBox version 1.2 suffers from an insecure cookie handling vulnerability.

Memorial Web Site Script suffers from password reset and insecure cookie handling vulnerabilities.

[whem]-UPLoad version 7.0 suffers from an insecure cookie handling vulnerability.

My Book suffers from an insecure cookie handling vulnerability.

AV Arcade version 3 suffers from insecure cookie and SQL injection vulnerabilities.

Open Cart version 0.6.5 suffers from an insecure cookie handling vulnerability.

Tornado version 1.0 suffers from an insecure cookie vulnerability.

Aleza Portal version 1.6 suffers from an insecure cookie handling vulnerability that allows for SQL injection.

xWeblog version 2.2 suffers from an insecure cookie handling vulnerability.

PHP Hosting Directory version 2.0 suffers from an insecure cookie vulnerability that allows for administrative bypass.

WikiWebHelp version 0.3.3 suffers from an insecure cookie handling vulnerability.

Babil CMS suffers from an insecure cookie handling vulnerability.