Exploit

Stackfield Desktop App: RCE via Path Traversal and Arbitrary File Write (CVE-2026-28373)

CVE-2026-28373 describes a path traversal vulnerability in the Stackfield desktop app affecting all versions up to 1.10.1 on Windows and macOS. During the decryption of an encrypted organization data export, attacker-controlled "filePath" and "fileGuid" values are used to derive output locations without proper validation. By crafting a valid encrypted export, a low-privileged attacker can force the app to write arbitrary files outside the export directory, ultimately leading to Remote Code Execution.

Mar 23, 2026

When Audits Fail Part 2: From Pre-Auth SSRF to RCE in TRUfusion Enterprise

A pre-auth SSRF in TRUfusion Enterprise (CVE-2025-32355) allows external attackers to reach internal-only services via a misconfigured reverse proxy. This enables access to the internal Axis2 file-upload service "WsPortalV6UpDwAxis2Impl" using default credentials, while a path traversal in upload path handling (CVE-2025-59793) enables arbitrary file writes to web-accessible directories. Chained together, these flaws enable unauthenticated remote code execution.

Feb 16, 2026

When Audits Fail Part 1: Four Critical Pre-Auth Vulnerabilities in TRUfusion Enterprise

In early 2025, we encountered a mission-critical software component called TRUfusion Enterprise on the perimeter of one of our customers that is used to transfer highly sensitive data. Since Rocket Software claims that they are undergoing regular audits and also follow secure coding guidelines, we didn't expect to find much but to our surprise, it took us just two minutes to discover the first totally unsophisticated, but critical pre-auth path traversal vulnerability that already gave us admin rights.

Sep 30, 2025

What the NULL?! Pre-Auth Wing FTP Server RCE (CVE-2025-47812)

While performing a penetration test for one of our Continuous Penetration Testing customers, we've found a Wing FTP server instance that allowed anonymous connections. It was almost the only interesting thing exposed, but we still wanted to get a foothold into their perimeter and provide the customer with an impactful finding.

Jun 30, 2025

SAP Emarsys SDK for Android Sensitive Data Leak (CVE-2023-6542)

In late 2023, we've discovered and coordinated a quite interesting vulnerability affecting the Emarsys SDK for Android versions 3.6.1 and below with the respective vendor, SAP. While the overall coordination process went smoothly, the security advisory published by SAP only had a brief and partially misleading description of the vulnerability: Due to the lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application.

Apr 10, 2025

WordPress GiveWP POP to RCE (CVE-2024-5932)

A few days ago, Wordfence published a blog post about a PHP Object Injection vulnerability affecting the popular Wordpress Plugin GiveWP in all versions donor_meta->get_meta() method. Bypassing stripslashes\_deep One thing that does not immediately stand out but will get important later is the usage of stripslashes_deep during the validation of the $user_info array, which contains the vulnerable user_title attribute: Why is that important?

Aug 26, 2024

Patch Diffing CVE-2023-28121 to Compromise a WooCommerce

Back in March 2023, I noticed an interesting security advisory that was published by Wordfence about a critical "Authentication Bypass and Privilege Escalation" (aka CVE-2023-28121) affecting the "WooCommerce Payments" plugin which has more than 600.000 active installs according to WordPress. Since one of my customers was running a WooCommerce instance with the vulnerable version of the plugin, but there wasn't a publicly available PoC/exploit back then, I decided to look at it and build an exploit for it.

Jul 3, 2023

SecurePwn Part 2: Leaking Remote Memory Contents (CVE-2023-22897)

While my last finding affecting SecurePoint's UTM was quite interesting already, I was hit by a really hard OpenSSL Heartbleed flashback with this one. The following exploit works against both the admin portal on port 11115 as well as the user portal on port 443.

Apr 12, 2023

SecurePwn Part 1: Bypassing SecurePoint UTM's Authentication (CVE-2023-22620)

While working on a recent customer engagement, I discovered two fascinating and somewhat weird bugs in SecurePoint's UTM firewall solution. The first one, aka CVE-2023-22620, is rated critical for an attacker to bypass the entire authentication and gain access to the firewall's administrative panel.

Apr 11, 2023

CVE-2020-16171: Exploiting Acronis Cyber Backup for Fun and Emails

You have probably read one or more blog posts about SSRFs, many being escalated to RCE. While this might be the ultimate goal, this post is about an often overlooked impact of SSRFs: application logic impact.

Sep 14, 2020

CVE-2018-7841: Schneider Electric U.Motion Builder Remote Code Execution 0-day

I came across an unauthenticated Remote Code Execution vulnerability (called CVE-2018-7841) on an IoT device which was apparently using a component provided by Schneider Electric called U.Motion Builder. While I've found it using my usual BurpSuite foo, I later noticed that there is already a public advisory about a very similar looking issue published by ZDI named Schneider Electric U.Motion Builder track\_import\_export SQL Injection Remote Code Execution Vulnerability (ZDI-17-378) aka CVE-2018-7765).

May 13, 2019

Easy File Management Web Server v5.3 Exploit-Kung Fu

During the last few days a lot of nice Remote Exploits have been released over at Exploit-DB by one of my followers Harold aka superkojiman targeting applications by EFS Software Inc. First of all: Kudos to Harold, you did a really nice job :-)!

May 31, 2014

CVE-2014-2206: GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution

I've published another security advisory about a remote code execution vulnerability with a CVSS score of 10,0 today. Affected are all available versions of the GetGo Download Manager, so if you're still using this software you should immediately switch to a more secure one, because the GetGo project is dead, but still high-rated by cnet.com.

Mar 2, 2014

VideoCharge Studio v2.12.3.685 GetHttpResponse() Remote Code Execution

I'm focusing on exploit development at the moment and it's time to raise the level to my personal next challenge: I've rm -rf'ed my Windows XP virtual machine! Now I'm happy to announce and document my first full VirtualProtect() ROP Remote Code Execution Exploit, which bypasses all known security mechanisms on Windows 7 - like SafeSEH, ASLR and DEP.

Feb 19, 2014

CVE-2013-3934: Kingsoft Office Writer v2012 8.1.0.3385 Buffer Overflow SafeSEH Bypass Exploit

Hello readers, Pop a calculator here, pop one there! I'm focusing on exploit development at the moment, because I love calculators ;-). My exploit targets the vulnerability described in CVE-2013-3934: Stack-based buffer overflow in Kingsoft Writer 2012 8.1.0.3030, as used in Kingsoft Office 2013 before 9.1.0.4256, allows remote attackers to execute arbitrary code via a long font name in a WPS file.

Nov 27, 2013

CVE-2013-6356: Avira Secure Backup v1.0.0.1 Buffer Overflow - Anatomy of a Vulnerability

Hello Followers, Avira is one of the leading Anti-Virus vendors and also the biggest one in Germany. Security is their daily business and they've done a quite nice job in hardening their products.

Nov 16, 2013

CVE-2013-5702: Watchguard Server Center v11.7.4 Multiple XSS Vulnerabilities

Great news from the vulnerability front! I'm happy to see that the quality of vulnerability coordination with Watchguard evolved to my satisfaction during the past few months and the following new vulnerability disclosure proves that.

Oct 21, 2013

CVE-2013-5701: Watchguard Server Center v11.7.4 wgpr.dll Local Privileges Escalation Vulnerability

Hello readers, this is my first article in a series about vulnerabilities in Watchguard products. Watchguard is a self-proclaimed NextGen Security vendor building security appliances for complete network protection.

Sep 8, 2013

WinAmp v5.64 Fixes Several Code Execution Vulnerabilities (CVE-2013-4694, CVE-2013-4695)

In early June I've reported several security vulnerabilities in Nullsoft's flagship product WinAmp to the devs. I received an amazing fast answer from the WinAmp Team acknowledging all reported security vulnerabilities.

Jul 1, 2013

ABBS Audio Media Player v3.1 WinALL Exploit

A few weeks ago, one of my followers asked me if I can help him writing a functional exploit for the current version of the Audio Media Player by ABBS because he's experiencing problems with successfully exploiting a NULL-byte issue. All exploits that are available over at the Exploit Database like this one or even this Metasploit module are either only working on specific versions of Windows or are not working with the current version of the application.

May 5, 2013

CVE-2014-2087: Free Download Manager CDownloads_Deleted:: UpdateDownload() Remote Code Execution

I've discovered another 0day Remote Code Execution flaw in a CNET.com Top10 software of its category, which has been downloaded more than 6 million times right now. Affected Versions and CVSS I've successfully verified the vulnerability in the following versions (but any older versions may be affected too): Free Download Manager v3.9.3 build 1360 (latest) Free Download Manager v3.8 build 1173 Free Download Manager v3.0 build 852 The CVSS score is 9,3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) because there is a little bit of user interaction needed.

Mar 13, 2013

HP Intelligent Management Center v5.1: Bypassing javax.faces.ViewState CSRF Protection

Have you read my last advisory about the HP Intelligent Management Center v5.1 E0202 topoContent.jsf Non-Persistent Cross-Site Scripting Vulnerability ? You should do! Taken by itself it's not even an interesting vulnerability.

Mar 5, 2013

FormatFactory v3.0.1 Profile File Handling Buffer Overflow Exploit

Here's a working exploit for an already disclosed bug - including SafeSEH Bypass - and for the actual version, which is still vulnerable. Sadly. An important side - note!

Nov 19, 2012

Bypassing SafeSEH Memory Protection in Zoner Photo Studio v15

My last advisory IA42 "Zoner Photo Studio v15 Build3 (Zps.exe) Registry Value Parsing Local Buffer Overflow" looks like a general exploitable vulnerability, but it is quite interesting to exploit because there is a major memory protection in use: SafeSEH. But first of all, let's have a look at the PoC-Script, which demonstrates the vulnerability: The application loads the value from the "Issuer" Registry key during the launch and crashes: May the exploit development begin.

Nov 9, 2012

NCMedia Sound Editor Pro v7.5.1 Windows 7 Exploit

First of all...thanks b33f from fuzzysecurity.com for your hint which helped a lot in solving the reliability issue of my last exploit :-) ! In my last article I wrote about a missing **reliable** way of executing shellcode.

Sep 23, 2012

Exploiting the NCMedia Sound Editor Pro v7.5.1 MRUList201202.dat File Handling Vulnerability with the help of mona.py

My latest finding: A classic buffer overflow. And this time I've used the great mona.py script created by the corelan team to exploit the vulnerability. It helps to find memory addresses for all of your stack adjustment needs (beside this, the script has got a lot of other powerful functions too).

Sep 16, 2012

Ricoh DC Software DL-10 FTP Server (SR10.exe) Remote Buffer Overflow Vulnerability

This time I've found a more critical vulnerability with a CVSSv2 score of 7,5 coordinated by Secunia.com which has already been published on 2012-03-01, but due to a very unfortunate way of communication by Secunia, I haven't been informed about the release of the advisory - that's the reason for the late article on it :-( But anyways, this vulnerability is a perfect example of how not to react to confidentially reported security issues: Ricoh did not response to any of Secunia's notifications since my discovery and reporting of the bug on 2012-02-05. Even if it's not one of their flagship products, there are always customers who take care of their entire network security and who don't like security breaches at all!

Mar 21, 2012

Macro Toolworks v7.5.0 ... and how to launch a calc.exe

Hello readers, I recently found a local buffer overflow vulnerability in Pitrinec Macro Toolworks v7.5.0, which is very easy to exploit at all. For demonstration purposes I will show you one possible way of getting your own shellcode to run using this overflow.

Mar 9, 2012

Buffer Overflow Exploitation: Jump to shellcode via PUSH ESP, RET

Another possible way to jump to shellcode is using the PUSH ESP, RET technique. If you've got no usable CALLs or JMPs to ESP for some reasons, you can first use a PUSH ESP to put the address of ESP onto the Stack and after that RET that value to the EIP.

Dec 16, 2011