SQL injection vulnerability in the sl***.aspx page of the Bid frontend of Qixing bidding system Bid (CNVD-2019-06238)

Qixing Bidding System Bid is a system suitable for enterprises to collect information on bidding information of government procurement, engineering construction, land grant, etc., and to track the progress of works and payment of successful projects. A SQL injection vulnerability exists in the...

3gtel-frontend-platform (1.0.0), @achieve-all/v-element (1.0.0) +404 more potentially affected by CVE-2018-16486 via defaults-deep (>=0.2.3, <=0.2.4)

defaults-deep NPM version =0.2.3, =0.1.1, =1.0.0, =1.0.0, =2.0.0, =2.0.7, =0.1.0, =1.0.0, =1.0.8, =0.1.2, =1.0.3, =1.0.0, =6.0.0-rc1, =7.4.3 and more Source cves: CVE-2018-16486 Source advisory: OSV:GHSA-PJXW-22XF-6PWC...

PayPal: Stored XSS on https://paypal.com/signin via cache poisoning

Due to a configuration in frontend, caching servers, it was possible for a researcher to use request smuggling to convert a page request into a cached redirect. If the cached redirect were accessed by a legitimate user, an attacker's content would be rendered instead of the requested page. While...

SQL injection vulnerability in the co***.aspx and de***.aspx files in the frontend of Gallery, a Qixing image & video library.

Qixing Image & Video GalleryGallery is mainly used to store images or videos in the company. SQL injection vulnerability exists in the frontend co.aspx and de.aspx files of the Qixing Image & Video Gallery, which can be exploited by attackers to obtain sensitive information from the database...

Seacms frontend me***.php file has SQL injection vulnerability

SeaCMS is a video-on-demand system based on PHP+MySql technology. A SQL injection vulnerability exists in the Seacms frontend me.php file. An attacker can exploit the vulnerability to obtain sensitive information from the database...

WordPress Snax 4.9.x SQL Injection

Exploit Title : WordPress Snax Plugins 4.9.x SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 28/01/2019 Vendor Homepage : snax.bringthepixel.com Software Information Link : codecanyon.net/item/snax-viral-frontend-uploader/16540363 Software Version ...

[SECURITY] Fedora 29 Update: irssi-1.1.2-1.fc29

Irssi is a modular IRC client with Perl scripting. Only text-mode frontend is currently supported. The GTK/GNOME frontend is no longer being maintained...

Shop7z Online Shopping System Fashion Edition Frontend Sh***_fo***.asp File SQL Injection Vulnerability

Shop7z online shopping system is to support Alipay, WeChat payment and a variety of commonly used interfaces, computer and cell phone version and APP seamless combination of data as a whole. Shop7z online shopping system fashion version of the front Shfo.asp file SQL injection vulnerability...

Cross-Site Scripting in Form Framework

Failing to properly encode user input, frontend forms handled by the form framework system extension “form” are vulnerable to cross-site scripting...

Multiple vulnerabilities in extension "femanager" (femanager)

It is possible to bypass configured server side validation rules which allows an attacker to create frontend user records with invalid data. Also, the eID script allows an attacker to set various validators using GET parameters resulting in information disclosure of field values from the feusers...

LmxCMS V1.4 SQL Injection Vulnerability in Frontend Bo***.cl***.php

Dream Cms, hereinafter referred to as "lmxcms", is a simple and practical website management system cms developed by "10 years" screen name. A SQL injection vulnerability exists in LmxCMS V1.4 frontend Bo.cl.php. An attacker can exploit this vulnerability to obtain sensitive database information...

LmxCMS V1.4 SQL Injection Vulnerability in Frontend Ta***.cl***.php

Dream Cms, hereinafter referred to as "lmxcms", is a simple and practical website management system cms developed by "10 years" screen name. A SQL injection vulnerability exists in LmxCMS V1.4 frontend Ta.cl.php. An attacker can exploit the vulnerability to obtain sensitive database information...

LmxCMS V1.4 SQL Injection Vulnerability in Frontend Se***.cl***.php

Dream Cms, hereinafter referred to as "lmxcms", is a simple and practical website management system cms developed by "10 years" screen name. A SQL injection vulnerability exists in LmxCMS V1.4 frontend Se.cl.php. An attacker can exploit the vulnerability to obtain sensitive database information...

Open-Xchange OX App Suite Cross Site Scripting / SSRF

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 59653 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.10.0 Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.0-rev13 Vendor notification:...

Command Execution Vulnerability in Yzncms Frontend

Yzncms aka Otaku CMS is a CMS content management system based on the latest TP5.1 framework. Yzncms front-end command execution vulnerability, an attacker can exploit the vulnerability to execute arbitrary commands...

Sitadel - Web Application Security Scanner

Sitadel is basically an update for WAScan making it compatible for python = 3.4 It allows more flexibility for you to write new modules and implement new features : Frontend framework detection Content Delivery Network detection Define Risk Level to allow for scans Plugin system Docker image...

WUZHI CMS v4.1.0 SQL Injection Vulnerability in Frontend sm***_ch***.php File

WUZHI CMS is Beijing five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. WUZHI CMS v4.1.0 SQL injection vulnerability exists in the front smch.php file. An attacker can exploit the vulnerability to obtain sensitive database information...

Base Soundtouch 18.1.4 Cross Site Scripting

CWE-80 XSS Bose Soundtouch App Internal reference: - Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 18.1.4 and maybe older versions, too not tested Vulnerable component: IOS Frontend of the application Report confidence: Unconfirmed Solution status: Could be fixed by vendor?...

WeiPHP 5.0beta frontend Us***.php has SQL injection vulnerability

WeiPHP is an open source WeChat public platform development framework, can easily build a personal WeChat public account operation platform. A SQL injection vulnerability exists in WeiPHP 5.0beta frontend at Us.php. Attackers can use this vulnerability to obtain sensitive database information...

WeiPHP 5.0beta frontend has an override access vulnerability

WeiPHP is an open source WeChat public platform development framework, can easily build a personal WeChat public account operation platform. WeiPHP5.0beta front-end has an override access vulnerability. The vulnerability stems from the user operation does not verify the identity, the attacker can...