PT-2024-31521 · Skysystem · Skysystem Arfa-Cms

Name of the Vulnerable Software and Affected Versions: SkySystem Arfa-CMS versions prior to 5.1.3124 Description: A cross-site request forgery CSRF vulnerability in the admin panel allows remote attackers to add a new administrator, leading to escalation of privileges. This issue enables attacker...

SkySystem Arfa-CMS 安全漏洞

SkySystem Arfa-CMS is a content management system from SkySystem, Inc. A security vulnerability exists in SkySystem Arfa-CMS version 5.1.3124 and prior versions, which stems from a cross-site request forgery CSRF vulnerability in the admin panel...

Login System Project 1.0 SQL Injection

============================================================================================================================================= | Title : Login System Project 1.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 129.0.1 6...

Virtuozzo Hybrid Infrastructure 6.2 Update 1 (6.2.1-51)

In this release, Virtuozzo Hybrid Infrastructure provides stability and performance improvements, as well as addresses issues found in previous releases. Vulnerability id: VSTOR-68405 Failed to deploy the compute cluster due to an issue with the default storage policy. Vulnerability id: VSTOR-880...

CVE-2024-42612

Pligg CMS v2.0.2 is affected by a CSRF vulnerability that can be triggered through /admin/domain_management.php?whitelist_add. The root cause is insufficient verification of the request origin trusted user, enabling an attacker to forge malicious actions. Documented impact includes the ability to...

Build Your Own Botnet 2.0.0 Remote Code Execution

Exploit Title: BYOB Build Your Own Botnet v2.0.0 Unauthenticated RCE Remote Code Execution Date: 2024-08-14 Exploit Author: @chebuya Software Link: https://github.com/malwaredllc/byob Version: v2.0.0 Tested on: Ubuntu 22.04 LTS, Python 3.10.12, change numpy==1.17.3-numpy CVE: CVE-2024-?????,...

CVE-2024-7593

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel...

CVE-2024-7593

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel...

Farmacia Gama 1.0 Farmacia Gama 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Farmacia Gama v1.0 v1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | ...

Employee Management System 1.0 SQL Injection

============================================================================================================================================= | Title : Employee Management System v1.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

Blog Site 1.0 Cross Site Scripting

============================================================================================================================================= | Title : Blog Site 1.0 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | | Vendor :...

Exploit for Incorrect Comparison in Mailcow Mailcow\:_Dockerized

CVE-2024-41958-PoC This is a small proof of concept for CVE-...

CampCodes Supplier Management System 安全漏洞

Campcodes Supplier Management System is a supplier management system from Campcodes, Inc. A security vulnerability exists in CampCodes Supplier Management System version v1.0, which stems from an SQL injection vulnerability via SupplyManagementSystem/admin/viewinvoiceitems.php?id=...

CVE-2024-6942

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

CVE-2024-6942 ThinkSAAS Admin Panel Security Center anti.php cross site scripting

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

CVE-2024-6942

ThinkSAAS 3.7.0 Admin Panel Security Center contains a cross-site scripting flaw in file app/system/action/anti.php. Manipulating ip, email, or phone arguments can be exploited remotely; exploit has been disclosed publicly. Multiple connected sources confirm affected software and component. Pract...

CVE-2024-6942 ThinkSAAS Admin Panel Security Center anti.php cross site scripting

A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to...

PT-2024-37980 · Thinksaas · Thinksaas

Name of the Vulnerable Software and Affected Versions: ThinkSAAS version 3.7.0 Description: A problematic issue was found in the Admin Panel Security Center component, specifically in the file app/system/action/anti.php. The manipulation of the ip, email, or phone argument leads to cross-site...

WordPress Poll Maker 5.3.2 SQL Injection

Exploit Title: WordPress Poll Maker Plugin SQL Injection Date: 2024-07-11 Exploit Author: tmrswrr Category : Webapps Vendor: https://ays-pro.com/wordpress/poll-maker Version 5.3.2 1. Access the Admin Panel: - Navigate to the admin panel of your WordPress site. - Go to Poll Maker Results...

CVE-2024-27095 Decidim cross-site scripting (XSS) in the admin panel

Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1...