CVE-2018-19892

DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field...

CVE-2018-19892

DomainMOD 4.11.01 has a Cross-Site Scripting (XSS) vulnerability via the admin/dw/add-server.php DisplayName, HostName, or UserName fields. The Nuclei template specifies the path as /domain//admin/dw/add-server.php and describes a stored XSS that can execute arbitrary JavaScript in the victim’s b...

DomainMOD cross-site scripting vulnerability (CNVD-2019-07969)

DomainMOD is an open source application for managing your domain names and other Internet assets in a central location. A cross-site scripting vulnerability exists in DomainMOD versions 4.11.01 and earlier, which can be exploited by an attacker via the admin/dw/add-server.php DisplayName, HostNam...

CVE-2018-19853

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

CVE-2018-19853

CVE-2018-19853 describes an elevation-of-privilege flaw in hitshop (through 2014-07-15) where a storekeeper account can add an administrator via admin.php/user/add, gaining control of the whole site. Affected component: the web application’s user/add workflow; root cause: storekeeper privileges c...

CVE-2018-19853

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

Cross-site Request Forgery (CSRF)

showdoc/showdoc is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists in /api/teamMember/save where it is possible to add members to a team through CSRF attacks...

CVE-2018-19750

DomainMOD up to version 4.11.01 contains a stored cross-site scripting (XSS) vulnerability in the admin/domain-fields notes field used when adding a Custom Domain Field. The issue is triggered via input in the notes field of the Add Custom Field action for Custom Domain Fields. The available docu...

CVE-2018-19752

DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar...

Joomla Fabrik 3.9 CSRF / LFI / Shell Upload

Exploit Title : Joomla ComFabrik 3.9 pluginAjax importcsv advancedsearch getprodimg controller LFI with htaccess CSRF Shell Access Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 29/11/2018 Vendor Homepage : extensions.joomla.org/extension/fabrik/...

ShowDoc Cross-Site Request Forgery Vulnerability

ShowDoc is an online document sharing tool. A cross-site request forgery vulnerability exists in server/index.php?s=/api/teamMember/save URL in ShowDoc version 2.4.2. A remote attacker can exploit this vulnerability to add a new user to a team...

ShopsN single merchant b2c mall system v2.3.6 has SQL injection vulnerability

ShopsN single merchant b2c mall system is an open source online store system developed using PHP + MySQL. ShopsN single merchant b2c mall system v2.3.6Us.class .php file addressadd function has a SQL injection vulnerability , an attacker can use this vulnerability to obtain the administrator...

UBUNTU-CVE-2018-14663

An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a...

DEBIAN-CVE-2018-14663

An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a...

CVE-2018-19557

An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images...

Cross site request forgery (csrf)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

CVE-2018-19545

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery (Add Admin)

Title: Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery Add Admin Author: Gjoko 'LiquidWorm' Krstic @zeroscience Exploit Date: 2018-11-17 Vendor: Synaccess Networks Inc. Product web page: https://www.synaccess-net.com Affected version: NP-0801DU HW6.0 BL1.5 FW7.23 WF7.4 Tested on:...

Ticketly 1.0 Cross Site Request Forgery

Exploit Title: Ticketly 1.0 - Cross-Site Request Forgery Add Admin Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-11-19 Google Dork: N/A Vendor: Abisoft https://abisoftgt.net Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql...

Bakeshop Inventory System SQL Injection Vulnerability

Bakeshop Inventory System is a bakery inventory management system. A SQL injection vulnerability exists in Bakeshop Inventory System version 1.0. A remote attacker can use the login page to view, add, modify, or delete information in the back-end database...