PT-2019-8548

Name of the Vulnerable Software and Affected Versions noVNC versions prior to 0.6.2 Description A Cross-Site Scripting XSS issue was discovered in noVNC, where a remote VNC server could inject arbitrary HTML into the noVNC web page via messages propagated to the status field, such as the VNC serv...

WordPress WP Mobile Detector 3.5 Shell Upload Exploit

WP Mobile Detector Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /wp-content/plugins/wp-mobile-detector/resize.php script does contains a remote file include for files not cached by the system already. By uploading a...

SQL Injection Vulnerability in taoCMS Documentation Frontend

TaoCMS is the smallest around 100Kb fully functional CMS management system in China based on php+sqlite/mysql. taoCMS has a SQL injection vulnerability in the include/Model/Index.php file, which allows attackers to exploit the vulnerability to obtain sensitive database information...

UBUNTU-CVE-2017-15194

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

CVE-2017-15194: Improper Neutralization of Input During Web Page Generation

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

CVE-2016-10513

Cross Site Scripting XSS exists in Piwigo before 2.8.3 via a crafted search expression to include/functionssearch.inc.php...

CVE-2017-15194

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

PT-2017-13887

Name of the Vulnerable Software and Affected Versions Cacti version 1.1.25 Description The issue is related to XSS in the include/global session.php file. This is due to the handling of 1 the URI or 2 the refresh page. Recommendations For Cacti version 1.1.25, update to a version that includes a...

PT-2017-7911

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.3 Description The issue allows remote attackers to bypass intended access restrictions. This can be achieved via a URL that contains a " character, or a URL beginning with a substring other than the http:// or...

PT-2017-7910

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.3 Description A Cross Site Scripting XSS issue exists, allowing for the execution of malicious scripts via a crafted search expression. The issue is related to the include/functions search.inc.php file...

PT-2017-18845

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 3.0.34 Description A Shell metacharacter injection issue in the /usr/www/include/ajax/GetTest.php file allows for remote code execution as root. Recommendations For versions prior to 3.0.34, update to version...

CVE-2017-14402

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

CVE-2017-14402: Improper Neutralization of Special Elements used in an SQL Command

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

PT-2017-13445

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb version 5.1-0 Description The issue is related to a lack of input validation in include/function.php, which allows SQL injection via the user name parameter to the "ACCOUNT CREATION" section in module/adm...

Directory traversal

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be...

Tulpar - Web Vulnerability Scanner

Tulpar is a open source web vulnerability scanner for written to make web penetration testing automated. Features Sql Injection GET Method XSS GET Method Crawl E-mail Disclosure Credit Card Disclosure Whois Command Injection GET Method Directory Traversal GET Method File Include GET Method Server...

CVE-2017-12775: Improper Input Validation

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

PT-2017-12683

Name of the Vulnerable Software and Affected Versions Question2Answer versions prior to 1.7.5 Description The issue allows remote attackers to create multiple user accounts by exploiting a flaw in the qa-include/qa-install.php file. Recommendations For versions prior to 1.7.5, update to version...

Wireless Repeater BE126 - Local File Inclusion

Exploit Title: WIFI Repeater BE126 – Local File Inclusion Date Publish: 23/08/2017 Exploit Authors: Hay Mizrachi, Omer Kaspi Contact: [email protected], [email protected] Vendor Homepage: http://www.twsz.com Category: Webapps Version: 1.0 Tested on: Windows/Ubuntu 16.04 CVE: CVE-2017-8770 1 -...

CVE-2017-12131: Improper Neutralization of Input During Web Page Generation

The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens...