Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-articles.php by adding a question mark ? followed by the payload...

Tutor LMS < 1.5.3 - Cross-Site Request Forgery (CSRF)

Tutor LMS WordPress plugin is vulnerable to Cross-Site Request Forgery CSRF attacks. As the requests for the approval and blocking of instructors are sent using the GET method, the CSRF attack to approve an attacker-controlled instructor account can be performed by having the admin visit...

Cross site request forgery (csrf)

An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF...

CVE-2019-14976

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter...

Securifi Almond Cross-Site Scripting Vulnerability

The Securifi Almond is a wireless router with a touch screen. A cross-site scripting vulnerability in the Securifi Almond, Almond+, and Almond 2015 using firmware version AL-R096 can be exploited by a remote attacker to take control of the device as the admin user, execute arbitrary code, or chan...

Gemalto Admin Control Center Information Disclosure Vulnerability

Gemalto Admin Control Center is a set of Web-based Sentinel user tools from Gemalto. The product is mainly used to query and manage hardware and software Sentinel license keys. An information disclosure vulnerability exists in Gemalto Admin Control Center version 7.92. The vulnerability arises fr...

CVE-2019-8282

Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle MITM attack and replace original language pack by malicious one...

CVE-2019-8282

Gemalto Admin Control Center (all versions prior to 7.92) communicates language packs over cleartext HTTP to www3.safenet-inc.com. This creates a MITM risk that could replace legitimate language packs with malicious ones. Affected component: the Admin Control Center client/server communication fo...

CVE-2019-8282

Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle MITM attack and replace original language pack by malicious one...

CVE-2019-8283

Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it...

CVE-2019-8283

Gemalto Admin Control Center (Hasplm cookie) is affected in versions prior to 7.92 due to the absence of the HttpOnly flag on the Hasplm cookie. This design flaw can allow malicious JavaScript to access the cookie, enabling potential information disclosure. The vulnerability affects the Hasplm co...

Design/Logic Flaw

The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...

CVE-2018-14729

The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...

CVE-2019-11426

An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...

OpenKM Document Management Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenKM Document Management %q Versions of the OpenKM Document Management 'AkkuS ' , Vulnerability Discovery, PoC & Msf Module 'References' = 'URL'...

idreamsoft iCMS Directory Traversal Vulnerability (CNVD-2019-12122)

iCMS is an efficient and simple content management system built with PHP and MySQL. A directory traversal vulnerability exists in admincp.php?app=apps&do=save in idreamsoft iCMS 7.0.13, which can be exploited to delete arbitrary folders with the help of the 'app=' parameter and uninstall requests...

idreamsoft iCMS Directory Traversal Vulnerability (CNVD-2019-12123)

iCMS is an efficient and simple content management system built with PHP and MySQL. A directory traversal vulnerability exists in admincp.php?app=apps&do=save in idreamsoft iCMS 7.0.13, which can be exploited by an attacker to create a ZIP file with the contents of an arbitrary directory and...

Dirt-Cheap, Legit, Windows Software: Pick Two

Buying heavily discounted, popular software from second-hand sources online has always been something of an iffy security proposition. But purchasing steeply discounted licenses for cloud-based subscription products like recent versions of Microsoft Office can be an extremely risky transaction,...

Sql injection

FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319...

SmartWorks Systems Pakistan 1.0 SQL Injection

Exploit Title : SmartWorks Systems Pakistan 1.0 SQL Injection Author Discovered By : KingSkrupellos Date : 30/12/2018 Vendor Homepage : smartworks.pk Tested On : Windows Exploit Risk : Medium Category : WebApps Version Information : Nginx 1.14.1 - jQuery 1.11.1 - jQuery UI 1.10.4 CWE : CWE-89...