ZTE ZXHN-H108NS Authentication Bypass Vulnerability

ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7uZRDGR2A68 suffers from an authentication bypass vulnerability when alternate HTTP methods are leveraged. Exploit Title: Router ZTE-H108NS - Authentication Bypass Exploit Author: George Tsimpidas Vendor: https://www.zte.com.cn/global/...

PT-2022-27015 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.31 Description: The issue allows remote authenticated users to modify the query string via direct user input or stored search filter settings in the Admin CP's Users module, resulting in a SQL injection vulnerability...

PT-2022-24897 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.5.8.2 Kirby versions prior to 3.6.6.2 Kirby versions prior to 3.7.5.1 Kirby versions prior to 3.8.1 Description: The issue affects Kirby sites with user accounts, unless the API and Panel are disabled in the config. ...

OXHOO TP50 授权问题漏洞

The OXHOO TP50 is a receipt printer from OXHOO. A security vulnerability exists in the OXHOO TP50 OXH1.50 that originates from allowing an unauthenticated attacker to access the administration panel...

Uber Says It's Investigating a Potential Breach of Its Computer Systems

Ride hailing giant Uber disclosed Thursday it's responding to a cybersecurity incident involving a breach of its network and that it's in touch with law enforcement authorities. The New York Times first reported the incident. The company pointed to its tweeted statement when asked for comment on...

CVE-2021-44076

CrushFTP 9 is affected. The vulnerability arises when creating a new user via the "/WebInterface/UserManager/" interface, where an attacker with access to the administration panel can trigger Stored XSS. The payload may execute in scenarios such as when the user’s page appears in the Most Visited...

PT-2022-11976 · Crushftp · Crushftp

Name of the Vulnerable Software and Affected Versions: CrushFTP version 9 Description: An issue was discovered in the creation of a new user through the "/WebInterface/UserManager/" interface, allowing an attacker with access to the administration panel to perform Stored Cross-Site Scripting XSS...

CrushFTP 跨站脚本漏洞

CrushFTP is a file transfer server. A security vulnerability exists in CrushFTP version 9, which can be exploited by an attacker to execute stored cross-site scripting XSS by accessing the administration panel...

Nagios XI 跨站脚本漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A security vulnerability exists in Nagios XI version v5.8.6, which stems from the discovery of a cross-site...

MaianAffiliate Code Injection Vulnerability Vulnerability

MaianAffiliate is a free, simple but powerful php referral system written in PHP. a security vulnerability exists in MaianAffiliate v.1.0, which stems from the existence of a PHP code injection issue. An authenticated attacker can exploit this vulnerability to obtain RCE through the MaianAffiliat...

CVE-2022-1772

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...

CVE-2022-1772

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...

Cross site scripting

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...

CVE-2022-1772 Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting

The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing th...

CVE-2022-30371

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargotypes/viewcargotype.php?id=...

Home Owners Collection Management Cross-Site Scripting Vulnerability (CNVD-2022-77871)

Fairway Independent Mortgage Home Owners Collection Management is a home purchase loan system from Fairway Independent Mortgage. home owners collection management v1 version contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and...

Dairy Farm Shop Management System SQL Injection Vulnerability (CNVD-2022-68886)

Dairy Farm Shop Management System is a dairy farm store management system.A SQL injection vulnerability exists in Dairy Farm Shop Management System version 1.0, which stems from multiple SQL injection vulnerabilities in the username and password parameters in the administration panel. An attacker...

Home Owners Collection Management 跨站脚本漏洞

Fairway Independent Mortgage Home Owners Collection Management is a home purchase loan system from Fairway Independent Mortgage. home owners collection management v1 version contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and...

Directory Management System SQL注入漏洞

Directory Management System is a directory management system. SQL injection vulnerability exists in Directory Management System version 1.0, which stems from multiple SQL injection vulnerabilities in the username and password parameters in the administration panel. An attacker could use this...

Ecommerce-Website File Upload Vulnerability

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. v1.1.0 of Ecommerce-Website is vulnerable to a file upload vulnerability, which stems from a lack of file upload restrictions in public/admin/index.php?addproduct The vulnerability is caused...