CVE-2017-5633

CVE-2017-5633 describes multiple CSRF vulnerabilities affecting the D-Link DI-524 Wireless Router running firmware 9.01. The issue enables remote attackers to perform actions via crafted requests to CGI programs, including changing the admin password and rebooting the device (and possibly other i...

Advanced Matrimonial Script 2.0.3 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Advanced Matrimonial Script v2.0.3 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/advanced-matrimonial/ Demo:...

PT-2017-16633 · D Link · D-Link Di-524 Wireless Router

Name of the Vulnerable Software and Affected Versions: D-Link DI-524 Wireless Router version 9.01 Description: The issue affects the D-Link DI-524 Wireless Router, allowing remote attackers to perform certain actions due to multiple cross-site request forgery CSRF vulnerabilities. These actions...

MLM Forced Matrix 2.0.7 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: MLM Forced Matrix v2.0.7 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/mlm-forced-matrix/ Demo: http://74.124.215.220/forctrix/...

CVE-2016-9315

CVE-2016-9315 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 and earlier. The issue is a privilege-escalation in the com.trend.iwss.gui.servlet.updateaccountadministration servlet, where an authenticated, low-privilege user can change the Master Admin password or add new...

Trend Micro InterScan Web Security Virtual Appliance Elevation of Privilege Vulnerability

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. An elevation of privilege vulnerability exists in Trend Micro IWSVA version 6.5. An attack...

CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

CVE-2016-9361

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...

CVE-2016-9361

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...

CVE-2016-9353

An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use...

CVE-2016-9353

An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use...

Hardcoded credentials

An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use...

CVE-2016-9361

An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPor...

CVE-2016-9353

An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use...

CVE-2016-9353

CVE-2016-9353 affects Advantech SUSIAccess Server (3.0 and earlier). The admin password is stored on the system and encrypted with a static, hard-coded key, enabling reverse retrieval and misuse of the admin account. ZDI/ZDI-adjacent disclosures describe a local privilege/escalation path leveragi...

Viral Fun Facts Sharing Script 1.1.0 SQL Injection

Exploit Title: Flippy DamnFacts a Viral Fun Facts Sharing Script v1.1.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy: https://www.flippyscripts.com/flippy-damnfacts-viral-fun-facts-sharing-script/ Demo:...

Ultimate Viral Media Script 1.0 - id Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Flippy eXtremeViral – Ultimate Viral Media Script v1.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy:...

IBM DataPower Gateway < 7.5.2.2 Default Admin Password Security Bypass

According to its self-reported version, the IBM DataPower Gateway running on the remote host is prior to 7.5.2.2. It is, therefore, affected by a security bypass vulnerability due to the default password still being accepted as valid if the administrator logs in before the startup configuration i...

Ultimate Viral Media Script 1.0 - 'id' SQL Injection

Exploit Title: Flippy eXtremeViral – Ultimate Viral Media Script v1.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy: https://www.flippyscripts.com/flippy-extremeviral-ultimate-viral-media-script/ Demo: http://eviral.flippyscripts.co...