Tianjin Qipeng Technology Development Co., Ltd. website building system backstage existence of universal password login vulnerability

Tianjin Qipeng Technology Development Co., Ltd. is a main website construction web port company. A universal password login vulnerability exists in the website building system of Tianjin Qipeng Technology Development Co. Attackers can use this vulnerability to log in the background, obtain...

PT-2019-16927 · Ibm · Ibm Sterling File Gateway

Name of the Vulnerable Software and Affected Versions: IBM Sterling File Gateway versions 2.2.0.0 through 6.0.1.0 Description: The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end databas...

Override access vulnerability in Guojiz web site navigation system

Guojiz website navigation system is a navigation website source code system developed by PHP+MySQL. Guojiz website navigation system has an override access vulnerability that can be exploited by an attacker to change any user's password...

CVE-2019-12517

An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The savequizscore functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress...

Cross site scripting

An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The savequizscore functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress...

CVE-2019-12517

An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The savequizscore functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress...

WordPress SlickQuiz 1.3.7.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications 1. ADVISORY INFORMATION ======================= Product: SlickQuiz Vendor URL: https://wordpress.org/plugins/slickquiz/ Type: Cross-Site Scripting CWE-79 Date found: 2019-05-30 Date published: 2019-09-10 CVSSv3 Score: 6.1...

File Upload Vulnerability in eyoucms Backend

Eyou Content Management System EyouCms belongs to Hainan Zanzan Network Technology Co., Ltd. is a domestic PHP open source website management system. Eyoucms backend file upload vulnerability, attackers can exploit the vulnerability to upload webshell, get server privileges...

Code execution vulnerability in indexhibits CMS

Indexhibit is a pioneering CMS web application created in 2006 for creating websites in an established index + exhibit format. A code execution vulnerability exists in indexhibits CMS, which can be exploited by an attacker to reinstall the web system and enter a backend getshell to gain server...

WordPress SlickQuiz 1.3.7.1 Cross Site Scripting

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: SlickQuiz Vendor URL: https://wordpress.org/plugins/slickquiz/ Type: Cross-Site Scripting CWE-79 Date found: 2019-05-30 Date published: 2019-09-10 CVSSv3 Score: 6.1...

SQL injection vulnerability in the C***_fi*** parameter of aj***.php page in the background of S-CMS government website system.

S-CMS is a content management system CMS based on PHP and MySQL. There is a SQL injection vulnerability in the Cfi parameter of the aj.php page in the background of the S-CMS government website building system, which can be exploited by an attacker to obtain sensitive information from the databas...

CVE-2019-16097

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...

CVE-2019-16097

Harbor up to version 1.8.2 is affected by CVE-2019-16097: core/api/user.go allows non-admin users to create admin accounts via POST /api/users when Harbor uses DB as the authentication backend and self-registration is enabled. Impact is privilege escalation to administrator as described in multip...

Directory Traversal Vulnerability in Xunrui CMS Backend Pages

Sichuan Xunruiyun Software Development Co., Ltd. is an Internet enterprise focusing on providing informatization services for small and medium-sized enterprises, mainly engaged in PHP language CMS website management system, offline communication and information engineering, online and offline...

SQL injection vulnerability in zzzzphp backend sa***_co*** method

zzphp is a free website builder developed in PHP language. There is a SQL injection vulnerability in the saco method in the background of zzzphp, which can be exploited by attackers to obtain sensitive information from the database...

File Upload Vulnerability in Multiple Modules of MoMoCMS Website Builder System Backend

MoMoCMS is an enterprise building system developed by php+MySQL. There is a file upload vulnerability in the background of MoMoCMS website builder system, which can be exploited by attackers to gain server privileges...

Code Execution Vulnerability in SongCMS Backend

SongCMS is a PHP MySQL, ASP Access/SQL Server based development , enterprise-oriented , multi-language support , free , open source CMS, to help business users to quickly build and deploy enterprise-level portal . SongCMS backend code execution vulnerabilities , attackers use the vulnerability to...

Directory Traversal, Code Execution, Arbitrary File Deletion Vulnerabilities in SongCMS Backend

SongCMS is a PHP MySQL, ASP Access/SQL Server based development , enterprise-oriented , multi-language support , free , open source CMS, to help business users to quickly build and deploy enterprise-level portal . SongCMS backend directory traversal , code execution , arbitrary file deletion...

S-CMS hospital website building system backend a***.php suffers from SQL injection vulnerability

S-CMS hospital station building system is developed by php+mysql, easy to operate, convenient, support PC+Mobile+WeChat. S-CMS hospital building system background a.php SQL injection vulnerability, attackers can use the vulnerability to obtain database information...

SQL Injection Vulnerability in YzmCMS Backend da***.cl***.php

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMS backend da.cl.php has a SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information in the...