1118 matches found
Debian DSA-4165-1 : ldap-account-manager - security update
Michal Kedzior found two vulnerabilities in LDAP Account Manager, a web front-end for LDAP directories. - CVE-2018-8763 The found Reflected Cross Site Scripting XSS vulnerability might allow an attacker to execute JavaScript code in the browser of the victim or to redirect her to a malicious...
BEESCMS V4.0_R_20160525全局变量覆盖导致前台getshell
...
QCMS最新版3.0.1后台登录验证可绕过，结合任意文件上传可前台getshell
...
ZEIT Next.js Directory Traversal Vulnerability (CNVD-2018-03103)
ZEIT Next.js is an open source general-purpose webapps development framework . A directory traversal vulnerability exists in ZEIT Next.js version 4 prior to 4.2.3. An attacker can exploit this vulnerability to access front-end JavaScript components or possibly obtain sensitive data...
CVE-2018-6002
The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php warsoundypreview parameter...
CVE-2018-6001
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php warsdyplpreview parameter...
XSS vulnerabililty in the front end "unsubscribe" module of the newsletter extension
More info at https://contao.org/en/news/contao-3532.html...
Stored Cross-Site Scripting Vulnerability in DuxCms Frontend
DuxCms is a web content management based on HMVC rules and developed in PHP for SMEs, companies, news, individuals and other related industries. DuxCms frontend has a stored cross-site scripting vulnerability. Attackers can insert malicious js code in the front page to get user cookies and other...
SQL Injection Vulnerability in MacCMS Version 8.x
MacCMS program is a fast shadow video building system that runs on PHP+MYSQL environment. A frontend SQL injection vulnerability exists in MacCMS version 8.x 2017-06-20, which can be exploited by attackers to obtain sensitive database information...
BlueTech Enterprise Website Management System (PHP version) front-end arbitrary file download vulnerability
BlueTech Enterprise Website Management System PHP version is developed with PHP+MYSQL technology and MVC mode. Support pseudo-static function, can generate google and baidu map, support custom url, keywords and description, in line with SEO standards. BlueTech enterprise website management system...
SQL injection vulnerabililty in the back end search filter and the front end listing module
More info at https://contao.org/en/news/contao-3531.html...
SQL injection vulnerabililty in the front end listing module
More info at https://contao.org/en/news/contao-448.html...
SQL injection in the back end search filter and the listing module
Date : 2017-11-15 CVE ID : CVE-2017-16558 Description Both the search filter in the back end and the listing module in the front end are vulnerable to SQL injections. To exploit the vulnerability in the back end, a back end user has to be logged in, whereas the front end the vulnerability can be...
WordPress Plugin Polls 1.2.4 - SQL Injection (PoC)
Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Vulnerable version:Download Link : https://downloads.wordpress.org/plugin/polls-widget.1.2.4.zip //////////////////////// /// Overview: //////////////////////// WordPress Polls plugin is a tool for creating polls and survey...
Typecho 1.1(15.5.12)前台任意代码执行漏洞
No description provided by source...
NiuShop open source mall system v1.16 front-end use plug-in functionality at the existence of any file contains vulnerabilities
NiuShop open source mall system is by Shanxi Niu Cool Information Technology Co., Ltd. completely independent design, research and development of a PHP open source e-commerce system . NiuShop open source mall system v1.16 front-end use plug-in functionality at the existence of any file contains a...
74cms frontend has a logical design flaw
74cms is a free + open source professional recruitment system based on PHP + MYSQL as the core development. 74cms front-end there is a logical design vulnerability. The vulnerability is due to the foreground of the password recovery function fails to correctly verify the identity of the visitor...
SQL Injection Vulnerability in ShopsN v2.0 Frontend OrderController.class.php File
ShopsN is a free e-commerce open source system. ShopsN v2.0 official version of the front-end OrderController.class.php file SQL injection vulnerability . As the system fails to effectively filter the addrdel function. A remote attacker can exploit the vulnerability to obtain sensitive informatio...