CVE-2020-25117

The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager...

Design/Logic Flaw

The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...

CVE-2020-17451

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 pagelinkname, pagetitle, pagecontent, or pageextracontent parameter, or the acp/acp.php?tn=system&sub=syspref prefspagename, prefspagetitle, or prefspagesubtitle parameter...

DesignMasterEvents CMS 1.0 SQL Injection / Cross Site Scripting

Exploit Title: DesignMasterEvents Conference management CMS SQL Injection Auth Bypass & XSS Vulnerability Google Dork: intext:"by :Design Master Events" Date: 2020-03-28 Exploit Author: @ThelastVvV Vendor Homepage: http://www.designmasterevents.com Version: 1.0 Tested on: Ubuntu...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-articles.php by adding a question mark ? followed by the payload...

Tutor LMS < 1.5.3 - Cross-Site Request Forgery (CSRF)

Tutor LMS WordPress plugin is vulnerable to Cross-Site Request Forgery CSRF attacks. As the requests for the approval and blocking of instructors are sent using the GET method, the CSRF attack to approve an attacker-controlled instructor account can be performed by having the admin visit...

Cross site request forgery (csrf)

An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF...

CVE-2019-14976

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

Securifi Almond Cross-Site Scripting Vulnerability

The Securifi Almond is a wireless router with a touch screen. A cross-site scripting vulnerability in the Securifi Almond, Almond+, and Almond 2015 using firmware version AL-R096 can be exploited by a remote attacker to take control of the device as the admin user, execute arbitrary code, or chan...

Gemalto Admin Control Center Information Disclosure Vulnerability

Gemalto Admin Control Center is a set of Web-based Sentinel user tools from Gemalto. The product is mainly used to query and manage hardware and software Sentinel license keys. An information disclosure vulnerability exists in Gemalto Admin Control Center version 7.92. The vulnerability arises fr...

CVE-2019-8282

Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle MITM attack and replace original language pack by malicious one...

CVE-2019-8282

Gemalto Admin Control Center (all versions prior to 7.92) communicates language packs over cleartext HTTP to www3.safenet-inc.com. This creates a MITM risk that could replace legitimate language packs with malicious ones. Affected component: the Admin Control Center client/server communication fo...

CVE-2019-8282

Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle MITM attack and replace original language pack by malicious one...

CVE-2019-8283

Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it...

CVE-2019-8283

Gemalto Admin Control Center (Hasplm cookie) is affected in versions prior to 7.92 due to the absence of the HttpOnly flag on the Hasplm cookie. This design flaw can allow malicious JavaScript to access the cookie, enabling potential information disclosure. The vulnerability affects the Hasplm co...

CVE-2018-14729

The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...

Design/Logic Flaw

The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...

CVE-2019-11426

An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...

OpenKM Document Management Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenKM Document Management %q Versions of the OpenKM Document Management 'AkkuS ' , Vulnerability Discovery, PoC & Msf Module 'References' = 'URL'...

idreamsoft iCMS Directory Traversal Vulnerability (CNVD-2019-12122)

iCMS is an efficient and simple content management system built with PHP and MySQL. A directory traversal vulnerability exists in admincp.php?app=apps&do=save in idreamsoft iCMS 7.0.13, which can be exploited to delete arbitrary folders with the help of the 'app=' parameter and uninstall requests...