PT-2020-18979

Name of the Vulnerable Software and Affected Versions CLink Office version 2.0 Description A cross-site scripting XSS issue in the index page of the management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter. This could potentially lead to unauthorize...

PHPKB Multi-Language 9 Authenticated Directory Traversal Exploit

Exploit for php platform in category web applications Exploit Title: PHPKB Multi-Language 9 - Authenticated Directory Traversal Exploit Author: Antonio Cannito Vendor Homepage: https://www.knowledgebase-script.com/ Software Link: https://www.knowledgebase-script.com/pricing.php Version:...

PT-2020-20227

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin version 3.4.22 Description The issue concerns Multiple Stored XSS vulnerabilities. These vulnerabilities can be exploited via parameters such as ninja formsrecaptcha site key, ninja formsrecaptcha secret key, ninja...

CVE-2020-8510

An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en user+perms+lang, one can login as any user without a password...

CVE-2020-6756

languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 KDI Version allows unauthenticated attackers to remotely execute code via the lang parameter...

CVE-2020-6756

languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 KDI Version allows unauthenticated attackers to remotely execute code via the lang parameter...

CVE-2020-6756

CVE-2020-6756 affects Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version). The vulnerability is in languageOptions.php and allows unauthenticated remote code execution via the lang parameter. Connected sources confirm an RCE condition with this PHP file, affecting PixelStor 5000 K devices;...

CVE-2020-6756: Improper Neutralization of Special Elements used in an OS Command

languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 KDI Version allows unauthenticated attackers to remotely execute code via the lang parameter...

PT-2020-19213

Name of the Vulnerable Software and Affected Versions Rasilient PixelStor 5000 K version 4.0.1580-20150629 Description The issue allows unauthenticated attackers to remotely execute code. This is achieved via the lang parameter in the languageOptions.php file. Recommendations For version...

PT-2019-6265

Name of the Vulnerable Software and Affected Versions Metinfo version 7.0.0 beta Description The issue is related to a SQL Injection vulnerability in the member/getpassword.php file, specifically when the lang parameter is set to cn and the a parameter is set to dovalid. This vulnerability is due...

CVE-2019-18419

A cross-site scripting XSS vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

Cross site scripting

A cross-site scripting XSS vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2019-18419

A cross-site scripting XSS vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

PT-2019-15402

Name of the Vulnerable Software and Affected Versions ClonOS WEB control panel version 19.09 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the lang parameter in the "index.php" file. Recommendations For ClonOS WEB control panel version...

CVE-2019-18419: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

PT-2019-7774

Name of the Vulnerable Software and Affected Versions kento-post-view-counter plugin versions prior to 2.8 Description The issue concerns stored XSS, which can be triggered via the kento pvc numbers lang, kento pvc today text, or kento pvc total text variables. This allows for malicious script...

UPDATE: SILENTTRINITY v0.3.0

PenTestIT RSS Feed Just yesterday, I wrote about this open source post-exploitation C2 framework and a new release is already available. The post was titled - List of Open Source C2 Post-Exploitation Frameworks. We now have SILENTTRINITY v0.3.0 amongst us, which was in the works for a long time!...

PT-2019-8369

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 64.0.21 Description The issue allows code execution in the context of the root account via a SET VHOST LANG PACKAGE multilang adminbin call. Recommendations For versions prior to 64.0.21, update to version 64.0.21 or...

CVE-2019-1010207: Improper Neutralization of Input During Web Page Generation

Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting XSS. The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/he...

PT-2019-11512

Name of the Vulnerable Software and Affected Versions: Genetechsolutions Pie Register version 3.0.15 Description: The issue allows for Cross Site Scripting XSS, which can lead to the stealing of session cookies. The vulnerable component is the Login file, specifically the parameters interim-login...