Design/Logic Flaw

xfind/search in Ximdex 4.0 has XSS via the filternvalue parameters for non-negative values of n, as demonstrated by n equal to 0 through 12...

CVE-2018-12047

XIMDEX XSS (CVE-2018-12047) affects Ximdex 4.0, specifically the xfind/search functionality. The vulnerability is a cross-site scripting flaw triggered via the filter[n][value] parameters with non-negative n (as demonstrated for n = 0–12), enabling arbitrary script injection on the search page. T...

CVE-2018-12047

xfind/search in Ximdex 4.0 has XSS via the filternvalue parameters for non-negative values of n, as demonstrated by n equal to 0 through 12...

Ximdex cross-site scripting vulnerability (CNVD-2018-14436)

Ximdex is a content and data management system. The system includes features such as an intelligent search engine, information aggregation, image and text recognition. A cross-site scripting vulnerability exists in the search page in Ximdex version 4.0. A remote attacker can exploit this...

CVE-2018-11735

index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter...

CVE-2018-11735

index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter...

CVE-2018-11735

CVE-2018-11735 affects Ximdex 4.0. The vulnerability is a Cross-Site Scripting (XSS) on the account creation page (index.php?action=createaccount) via the sname or fname parameters. The root cause is an unsanitized/inadequately escaped user input in these fields, enabling arbitrary script injecti...

CVE-2018-11735

index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter...

CVE-2016-10523

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth...

CVE-2016-10523

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth...

Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection

Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection Date: 21-05-2018 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Wind Turbine Category: webapps --- Proof Of Concept -------- Request POST /php/login.php...

Nordex N149/4.0-4.5 Scada Web Server SQL Injection

Exploit Title: Nordex N149/4.0-4.5 Scada Web Server - SQL Injection Date: 21-05-2018 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Category: webapps --- Proof Of Concept -------- Request POST /php/login.php HTTP/1.1 Cache-Control...

Nordex N149/4.0-4.5 - SQL Injection

Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection Date: 21-05-2018 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Wind Turbine Category: webapps --- Proof Of Concept -------- Request POST /php/login.php...

Nordex N1494.0-4.5 - SQL Injection

Nordex N1494.0-4.5 - SQL Injection Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection Date: 21-05-2018 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Wind Turbine Category: webapps --- Proof Of Concept...

Nordex N149/4.0-4.5 - SQL Injection Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Wind Turbine Category: webapps --- Proof Of Conce...

NodAPS 4.0 Cross Site Request Forgery / SQL Injection

Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?srank=1535 Version: 4.0 Tested on: windows...

NodAPS 4.0 - SQL injection / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?srank=1535...

NodAPS 4.0 - SQL injection Cross-Site Request Forgery

NodAPS 4.0 - SQL injection Cross-Site Request Forgery Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage:...

NodAPS 4.0 - SQL injection / Cross-Site Request Forgery

Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?srank=1535 Version: 4.0 Tested on: windows...

CVE-2017-18264

An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg'Servers'$i'AllowNoPassword' = false are bypassed under certain PHP versions e.g., version 5. This can allow the login of users who have no...