5058 matches found
CVE-2017-3187 The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery
The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery CSRF vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has a...
CVE-2017-3187
The provided data shows CVE-2017-3187 affecting dotCMS admin panel versions 3.7.1 and earlier, with a CSRF vulnerability enabling actions with a victim’s permissions (and potentially arbitrary commands if an active session exists). Related entries (CVE-2017-3188) describe a compatible path-traver...
FTP2FTP 1.0 - Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Exploit Title: FTP2FTP 1.0 - Arbitrary File Download Dork: N/A Date: 18.07.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395 Version: 1.0...
FTP2FTP 1.0 - Arbitrary File Download
FTP2FTP 1.0 - Arbitrary File Download Exploit Title: FTP2FTP 1.0 - Arbitrary File Download Dork: N/A Date: 18.07.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395 Version: 1.0 Category: Webapps...
Smart SMS & Email Manager 3.3 - 'contact_type_id' SQL Injection
Exploit Title: Smart SMS & Email Manager v3.3 - SQL Injection Google Dork: N/A Date: 17.07.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/smart-sms-email-manager-ssem/14817919 Version: 3.3 Tested on: Kali linux...
Smart SMS And Email Manager 3.3 SQL Injection
Exploit Title: Smart SMS & Email Manager v3.3 - SQL Injection Google Dork: N/A Date: 17.07.2018 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor Homepage: https://codecanyon.net/item/smart-sms-email-manager-ssem/14817919 Version: 3.3 Tested on: Kali linux...
Smart SMS & Email Manager 3.3 - contact_type_id SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Smart SMS & Email Manager v3.3 - SQL Injection Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/smart-sms-email-manager-ssem/14817919 Version: 3.3 Tested on: Kali linux...
FTP2FTP 1.0 - Arbitrary File Download
Exploit Title: FTP2FTP 1.0 - Arbitrary File Download Dork: N/A Date: 18.07.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395 Version: 1.0 Category: Webapps Tested on: Kali linux Description : The...
philipsecurity.com XSS vulnerability
Open Bug Bounty ID: OBB-649114 Description| Value ---|--- Affected Website:| philipsecurity.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Jirafeau Cross-Site Request Forgery Vulnerability (CNVD-2018-13352)
Jirafeau is a file sharing website system. A cross-site request forgery vulnerability exists in the delete file feature of the admin panel in versions of Jirafeau prior to 3.4.1. A remote attacker can exploit this vulnerability to force an administrator to delete files uploaded by other users via...
CVE-2018-14069
An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add...
CVE-2016-9482 PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass
Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel...
CVE-2018-13850
The "Firebase Cloud Messaging FCM + Advance Admin Panel" component supporting Firebase Push Notification on iOS through 2017-10-26 allows SQL injection via the /advancepush/public/login username parameter...
Jirafeau Cross-Site Request Forgery Vulnerability
Jirafeau is a file sharing website system. A cross-site request forgery vulnerability exists in the administration panel in Jirafeau versions prior to 3.4.1. A remote attacker can exploit this vulnerability to force an administrator to perform a file lookup operation and perform a cross-site...
CSRF vulnerability in the admin panel
More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...
CSRF vulnerability in the admin panel
More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...
CVE-2018-13407
A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused...
CVE-2018-13407
A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused...
CVE-2018-13407
The CVE-2018-13407 entry describes a CSRF vulnerability in Jirafeau before version 3.4.1 where the admin panel’s “delete file” function is not protected against automated requests, enabling potential abuse. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, OSV, etc.), all alignin...
Stellar.org: Admin panel of https://www.stellar.org/wp-admin/
https://www.stellar.org/wp-admin/ link has various operations which should not be accessible to an anonymous user. As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password. on the other side server information is easily...