11958 matches found
WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin)
Exploit Title: WSTMart 2.0.8 - Cross-Site Request Forgery Add Admin Date: 2018-12-23 Exploit Author: linfeng Vendor Homepage:https://github.com/wstmall/wstmart/ Software Link:http://www.wstmart.net/ Version: WSTMart 2.0.8181212 CVE :CVE-2018-19138 0x02 CSRF PoC 18/5000 Function point: background...
WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin)
WSTMart 2.0.8 - Cross-Site Request Forgery Add Admin Exploit Title: WSTMart 2.0.8 - Cross-Site Request Forgery Add Admin Date: 2018-12-23 Exploit Author: linfeng Vendor Homepage:https://github.com/wstmall/wstmart/ Software Link:http://www.wstmart.net/ Version: WSTMart 2.0.8181212 CVE...
WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title: WSTMart 2.0.8 - Cross-Site Request Forgery Add Admin Exploit Author: linfeng Vendor Homepage:https://github.com/wstmall/wstmart/ Software Link:http://www.wstmart.net/ Version: WSTMart 2.0.8181212 CVE :CVE-2018-19138 0x02 CSRF Po...
CVE-2018-20369
Barracuda Message Archiver 2018 has XSS in the errormsg exception-handling value for the ldapuser parameter to the cgi-mod/ldaploadentry.cgi module. The injection point of the issue is the AddUpdate module...
The vulnerability of network monitoring software for PRTG Network Monitor, related to insecure privilege management, allows a intruder to create users with privileges for “read and write” operations.
The vulnerability of the network monitoring software PRTG Network Monitor relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to create users with “read-write” privileges, including administrators. This can be achieved by replacing the...
Cross site request forgery (csrf)
Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...
CVE-2018-19598
CVE-2018-19598 affects Statamic 2.10.3. A stored/reflected-like XSS exists via the First Name or Last Name fields in an ‘Add new user’ request to the /users URI. Public exploitation details are not provided in the provided documents. No remediation details are included here.
CVE-2018-19598
Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...
Code execution vulnerability in Elefant CMS 2.0.8 backend
Elefant CMS is a PHP-based content management system CMS. The system includes features such as an events calendar, contact form, social media integration and member login. A code execution vulnerability exists in the Elefant CMS 2.0.8 backend at Add Language List, which stems from a failure to...
DEBIAN-CVE-2018-18247
Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...
CVE-2018-18922
adduser in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/adduser.php POST request...
Grammarly Launches Public Bug Bounty Program
Online AI-based communications tool Grammarly is taking its private bug bounty program public in hopes of finding and fixing more vulnerabilities in its software. The company has run a private bug bounty program – which currently has 1,500 participants – in conjunction with HackerOne for over a...
Alumni Tracer SMS Notification - SQL Injection / Cross-Site Request Forgery Vulnerabilities
Exploit for php platform in category web applications Exploit Title: Alumni Tracer SMS Notification - SQL Injection / Cross-Site Request Forgery Add/Update Admin Exploit Author: Ihsan Sencan Vendor Homepage:...
DomainMOD cross-site scripting vulnerability (CNVD-2019-07965)
DomainMOD is an open source application for managing your domain names and other Internet assets in a central location. DomainMOD 4.11.01 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the assets/add/category.php Category Name or Stakeholder fields...
CVE-2018-20011
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...
Default credentials
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...
CVE-2018-20015
YzmCMS v5.2 has admin/role/add.html CSRF...
CVE-2018-20011
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...
Google Android out-of-bounds write vulnerability (CNVD-2019-01771)
Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An out-of-bounds write vulnerability exists in HIDDevAddRecord in hiddapi.cc in Google Android 9. The vulnerability stems from a lack of boundary checking. A local attack...