CVE-2017-15374

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...

CVE-2017-15374

Shopware 5.2.5–5.3 contains a persistent cross-site scripting (XSS) vulnerability in the backend CMS modules for customer and order handling. The flaw allows injection of script into firstname/lastname/order fields, triggering execution in the admin backend preview of customers or orders. Exploit...

IBM Insights Foundation for Energy SQL Injection Vulnerability

IBM Insights Foundation for Energy is a suite of energy analytics, data management and visualization solutions from IBM in the United States. A SQL injection vulnerability exists in IBM Insights Foundation for Energy version 2.0. A remote attacker can exploit the vulnerability by sending speciall...

CVE-2017-1311

IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 125719...

SQL injection vulnerability in the background management system of the small program of Five Grams Mall

Five grams of mall small program background management system is a PHP development with background WeChat mall small program source code. Five grams mall applet background management system SQL injection vulnerability, the vulnerability is due to the system fails to user-submitted data for...

UBUNTU-CVE-2017-14650

A Remote Code Execution vulnerability has been found in the HordeImage library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code. Custom applicatio...

CVE-2017-14650

CVE-2017-14650 affects Horde_Image (Im backend) using ImageMagick convert; root cause is missing input validation of the index field in _raw() when building the ImageMagick command. Affected are Horde_Image versions 2.0.0 through 2.5.1; fixed in 2.5.2. The vulnerability is contextual: it is not r...

[SECURITY] Fedora 26 Update: synfig-1.2.0-9.fc26.1

Synfig is a powerful, industrial-strength vector-based 2D animation software, designed from the ground-up for producing feature-film quality animation with fewer people and resources. It is designed to be capable of producing feature-film quality animation. It eliminates the need for tweening,...

S-CMS v3.0 build20170911 Authentication Bypass Vulnerability in Backend

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS v3.0 build20170911 authentication bypass vulnerability exists in the background, due to the system fails to accurately verify the cookie information, the attacker can bypass the login authenticatio...

Unauthorized Access Vulnerability in the Android Version of Xinlian Energy Cloud APP

Xinlian Electricity Cloud App is an electric energy application that allows you to view the overall electricity consumption information and the information of each electricity sub-circuit online. Xinlian Electricity Cloud APP Android version has an unauthorized access vulnerability, which allows...

Unrestricted file upload

In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajaxrename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php...

MailChimp for WordPress <= 4.1.6 - Authenticated Cross-Site Scripting (XSS)

Usage of the output of addqueryarg without escaping in various places in the WordPress Backend leads to reflected XSS vulnerability. PoC URL/wp-admin/admin.php?page=mailchimp-for-wp-integrations&"...

Code Execution Vulnerability in Ocean CMS

Ocean Movie System aka Ocean CMS seacms is a PHP movie system. Ocean CMS has a code execution vulnerability, the vulnerability is due to the system fails to strictly filter the written files. Attackers can modify the background files through csrf write code, and then get the site management...

TYPO3 Backend Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in the TYPO3 backend. Because the program fails to properly encode user input, an attacker would need to use a valid backend user...

Cicada Knowledge Enterprise Portal open source version 6.5 cross-site scripting vulnerabilities at the user login and backend logins

Cicada Knowledge Enterprise Portal System is an enterprise portal system designed for enterprise marketing use. Cicada Knowledge Enterprise Portal open source version 6.5 user login and background login at the cross-site scripting vulnerabilities, attackers can use the vulnerability to insert...

Cross-Site Scripting in TYPO3 CMS Backend

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-004/...

CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

DEBIAN-CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

WordPress WpJobBoard 4.5.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Document Title: =============== WpJobBoard v4.5.1 - Multiple Cross Site Web Vulnerabilities Vulnerability Class: ==================== Cross Site Scripting - Non Persistent Current Estimated Price: ======================== 500a! - 1.000a! Produ...

SQL injection vulnerability in OURPHP backend ourphp_callback.php page

OurPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. A SQL injection vulnerability exists in the background ourphpcallback.php page of OURPHP. Attackers can use this vulnerability to obtain sensitive database informatio...