203 matches found
Clcknshop 1.0.0 SQL Injection
Exploit Title: Clcknshop 1.0.0 - SQL Injection Exploit Author: CraCkEr Date: 16/08/2023 Vendor: Infosoftbd Solutions Vendor Homepage: https://infosoftbd.com/ Software Link: https://infosoftbd.com/multitenancy-e-commerce-solution/ Demo: https://kidszone.clckn.shop/ Tested on: Windows 10 Pro Impact...
SPA-Cart eCommerce CMS 1.9.0.3 Cross Site Scripting Vulnerability
Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS Exploit Author: CraCkEr Date: 20/08/2023 Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/ Tested on: Windows 10 Pro Impact: Manipulate the content of the site CVE: CVE-2023-4547 CWE:...
SPA-Cart eCommerce CMS 1.9.0.3 SQL Injection Vulnerability
Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection Exploit Author: CraCkEr Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/ Tested on: Windows 10 Pro Impact: Database Access CVE: CVE-2023-4548 CWE: CWE-89 - CWE-74 - CWE-707 Greetings...
SPA-Cart eCommerce CMS 1.9.0.3 Cross Site Scripting
Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS Exploit Author: CraCkEr Date: 20/08/2023 Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/ Tested on: Windows 10 Pro Impact: Manipulate the content of the site CVE: CVE-2023-4547 CWE:...
billard-sport-club-buschhausen-74.de Cross Site Scripting vulnerability OBB-3618291
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Academy LMS 6.1 Cross Site Scripting / File Upload
Exploit Title: Academy LMS 6.1 - Arbitrary File Upload Exploit Author: CraCkEr Date: 05/08/2023 Vendor: Creativeitem Vendor Homepage: https://academylms.net/ Software Link: https://demo.academylms.net/ Tested on: Windows 10 Pro Impact: Allows User to upload files to the web server CWE: CWE-79 -...
Academy LMS 6.1 Cross Site Scripting / File Upload Vulnerabilities
Exploit Title: Academy LMS 6.1 - Arbitrary File Upload Exploit Author: CraCkEr Vendor: Creativeitem Vendor Homepage: https://academylms.net/ Software Link: https://demo.academylms.net/ Tested on: Windows 10 Pro Impact: Allows User to upload files to the web server CWE: CWE-79 - CWE-74 - CWE-707...
Credit Lite 1.5.4 SQL Injection Vulnerability
Exploit Title: Credit Lite 1.5.4 - SQL Injection Exploit Author: CraCkEr Vendor: Hobby-Tech Vendor Homepage: https://codecanyon.net/item/credit-lite-micro-credit-solutions/39554392 Software Link: https://credit-lite.appshat.xyz/ Tested on: Windows 10 Pro Impact: Database Access CVE: CVE-2023-4407...
CVE-2023-4157
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in GitHub repository omeka/omeka-s prior to version 4.0.3...
Design/Logic Flaw
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in GitHub repository omeka/omeka-s prior to version 4.0.3...
CVE-2023-4157 Improper Neutralization of Special Elements in Output Used by a Downstream Component in omeka/omeka-s
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in GitHub repository omeka/omeka-s prior to version 4.0.3...
CVE-2023-4157 Improper Neutralization of Special Elements in Output Used by a Downstream Component in omeka/omeka-s
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in GitHub repository omeka/omeka-s prior to version 4.0.3...
CVE-2023-4157 Improper Neutralization of Special Elements in Output Used by a Downstream Component in omeka/omeka-s
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in GitHub repository omeka/omeka-s prior to version 4.0.3...
CVE-2023-4157
CVE-2023-4157 affects omeka/omeka-s up to version 4.0.3 due to CWE-74 improper neutralization of special elements in output used by a downstream component, enabling injection in output. Affected: omeka/omeka-s prior to 4.0.3. Root cause: inadequate input validation leading to injection. Impact is...
Schneider Electric EcoStruxure Machine Expert Injection (CVE-2020-7489)
A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability exists on EcoStruxure Machine Expert Basic or SoMachine Basic programming software versions in security notification. The result of this vulnerability, DLL substitution, could...
SUSE CVE-2016-7409
The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUGTRACE, allows local users to read process memory via the -v argument, related to a failed remote ident...
SUSE CVE-2019-5808
Use after free in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
SUSE CVE-2020-6813
When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox 74...
SUSE CVE-2023-0128
Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...