HaPe PKH 1.1 - Arbitrary File Upload

HaPe PKH 1.1 - Arbitrary File Upload Exploit Title: HaPe PKH 1.1 - Arbitrary File Upload Dork: N/A Date: 2018-10-12 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.sitejo.id Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download Version: 1.1 Category: Webapps Test...

CVE-2018-16432

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

Sql injection

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

CVE-2018-16432: Improper Neutralization of Special Elements used in an SQL Command

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

CVE-2018-16432

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

Remote Code Execution Vulnerability in All Series of ECShop Versions

ECShop is a B2C independent online store system, suitable for enterprises and individuals to quickly build a personalized online store. The system is based on PHP language and MYSQL database structure development of cross-platform open source program. A remote code execution vulnerability exists ...

PT-2018-12899

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote attacker to execute arbitrary SQL commands. This can be achieved via the eid, userid, or pid parameter in the "portal/add edit event user.php" file. Recommendations For...

PT-2018-12897

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote attacker to execute arbitrary SQL commands. This is achieved via the catid or providerid parameter in the "portal/find appt popup user.php" file. Recommendations For...

CVE-2018-14971

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS...

CVE-2018-14971: Improper Neutralization of Input During Web Page Generation

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS...

PT-2018-12848

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue was discovered in the upload/System/Controller/backend/user.php file, which has a Cross-Site Scripting XSS issue. Recommendations For QCMS version 3.0.1, consider disabling access to the...

CVE-2018-8925

Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...

CVE-2018-8925

Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...

CVE-2018-8925: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...

CVE-2018-10268

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...

CVE-2018-10268

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...

CVE-2018-10268

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...

CVE-2018-10268: Improper Neutralization of Input During Web Page Generation

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...

PT-2018-9798

Name of the Vulnerable Software and Affected Versions: FastAdmin version 1.0.0.20180417 beta Description: An issue was discovered in the application, allowing for XSS via the avatar parameter in the User.php file, located at the "application/api/controller/" endpoint. Recommendations: For FastAdm...

CVE-2018-9162

Contec Smart Home 4.15 devices do not require authentication for newuser.php, edituser.php, deleteuser.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors...