CVE-2020-17504

The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters...

CVE-2020-17503

The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in splitcardcmd.php in which the http parameter "lockin...

CVE-2020-17502

Barco TransForm N before 3.8 allows Command Injection issue 2 of 4. The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An...

CVE-2019-13633

Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can send arbitrary JavaScript code via a built-in communication channel, such as Telegram, WhatsApp, Viber, Skype, Facebook, Vkontakte, or Odnoklassniki. This is mishandled within the administration panel for...

Cross site scripting

Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can send arbitrary JavaScript code via a built-in communication channel, such as Telegram, WhatsApp, Viber, Skype, Facebook, Vkontakte, or Odnoklassniki. This is mishandled within the administration panel for...

CVE-2019-13633

Blinger.io v1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can inject arbitrary JavaScript through built-in communication channels (Telegram, WhatsApp, Viber, Skype, Facebook, Vkontakte, Odnoklassniki), with exploitation impacting the admin-conversation panels: /conversations/all, /c...

CVE-2019-12305

In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration panel of the device...

Design/Logic Flaw

In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration panel of the device...

CVE-2019-12305

CVE-2019-12305 affects EZCast Pro II. The vulnerability stems from the administration password md5 hash being returned in a web response, enabling crackers to obtain the hash and subsequently access the device's administration panel. This implies a broken or insufficiently protected authenticatio...

CVE-2019-12305

In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration panel of the device...

Code injection

The ping page of the administration panel in Telmat AccessLog = 6.0 TAL20180415 allows an attacker to get root shell access via authenticated code injection over the network...

CVE-2020-16148

Summary: CVE-2020-16148 relates to Telmat AccessLog, where the ping page of the administration panel on versions before 6.0 (TAL_20180415) can be abused to perform authenticated code injection over the network, potentially granting root shell privileges. This vulnerability is described across mul...

CVE-2020-25514

Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http:///lms/admin.php...

vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50934)

vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the announcement header of the channel...

LimeSurvey 4.3.10 Cross Site Scripting

Exploit Title: LimeSurvey 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting Date: 2020-08-23 Exploit Author: Matthew Aberegg Vendor Homepage: https://www.limesurvey.org Version: LimeSurvey 4.3.10+200812 Tested on: Ubuntu 18.04.4 Patch Link:...

CVE-2020-13889

showAlert in the administration panel in Bludit 3.12.0 allows XSS...

CVE-2020-13889

showAlert in the administration panel in Bludit 3.12.0 allows XSS...

CVE-2020-13889

showAlert in the administration panel in Bludit 3.12.0 allows XSS...

CVE-2020-13889

Bludit 3.12.0 shows XSS in the admin panel via showAlert(). The root cause is lack of proper validation of client-side data, enabling attacker-controlled code execution in the browser (example payload: showAlert("alert(1)") from publicly available exploit discussion). No remediation details are p...

Exploit for Cross-site Scripting in Bludit

Author: Andre k Lorenci Contact: [email protected] CVE-2020-1...