1250 matches found
CVE-2020-27368
Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Parameter...
TotoLink A702r 访问控制错误漏洞
The Totolink A702r is a router device from the Chinese company Totolink. The Totolink A702r V1.0.0-B20161227.1023 suffers from an access control error vulnerability that allows an attacker to access the icon directory via the GET parameter. No detailed vulnerability details are provided at this...
Responsive ELearning System 1.0 SQL Injection
Exploit Title: Responsive E-Learning System 1.0 – 'id' Sql Injection Date: 2020-12-24 Exploit Author: Kshitiz Rajmanitorpotterk Vendor Homepage: https://www.sourcecodester.com/php/5172/responsive-e-learning-system.html Software Link:...
CVE-2020-9439
Multiple cross-site scripting XSS vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the searchkey GET Parameter in TinCanContentListTable.php, message GET Parameter in licensing.php,...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the searchkey GET Parameter in TinCanContentListTable.php, message GET Parameter in licensing.php,...
CVE-2020-9439
Multiple cross-site scripting XSS vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the searchkey GET Parameter in TinCanContentListTable.php, message GET Parameter in licensing.php,...
CVE-2020-29288
An SQL injection vulnerability was discovered in Gym Management System In manageuser.php file, GET parameter 'id' is vulnerable...
CVE-2020-29288
An SQL injection vulnerability was discovered in Gym Management System In manageuser.php file, GET parameter 'id' is vulnerable...
CVE-2020-29288
An SQL injection vulnerability was discovered in Gym Management System In manageuser.php file, GET parameter 'id' is vulnerable...
Sourcecodester SourceCodester Gym Management System SQL Injection Vulnerability
Sourcecodester SourceCodester Gym Management System is an American SourceCodester Sourcecodester company's a gym management system. The system is developed in C and sql server and features customer and vendor management, product management, sales management, gym membership management, fitness...
Automattic: [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.php
Summary Hello, i have found a SQLI Injection Time Based on https://www.intensedebate.com/changeReplaceOpt.php. The parameter $GET'acctid' is vulnerable. Detection I have inject a MySQL function sleep, and it works. GET /changeReplaceOpt.php?&opt=1&acctid=419523%20AND%20SLEEP15 HTTP/1.1 Host:...
Mail.ru: reflected xss on learn.city-mobil.ru via redirect_url parameter
Reflected XSS in learn.city-mobil.ru via GET parameter redirecturl Назад...
Design/Logic Flaw
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the...
Karel IP Phone IP1211 Web Management Panel - Directory Traversal
Exploit Title: Karel IP Phone IP1211 Web Management Panel - Directory Traversal Exploit Author: Berat Gokberk ISLER Date: 2020-09-01 CVE: N/A Type: Webapps Vendor Homepage: https://www.karel.com.tr/urun-cozum/ip1211-ip-telefon Version: IP1211 Details Directory traversal vulnerability on the Karel...
Mail.ru: Reflected XSS & Open Redirect at mcs main domain
Reflected XSS in mcs.mail.ru via GET parameter backurl...
CVE-2020-15487
Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...
CVE-2020-14024
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the 1 Receiver or Recipient field in the Mailbox feature, 2 OZFORMGROUPNAME field in the Group configuration of addresses, 3 listname field in the Defining address lists configuration, o...
CVE-2020-14024
CVE-2020-14024 специалисты описывают как у Ozeki NG SMS Gateway до версии 4.17.6 обнаружены несколько XSS-уязвимостей, требующих аутентифицированного доступа: через поля Receiver/Recipient в Mailbox, OZFORM_GROUPNAME в настройках групп адресов, поле listname в Defining Address Lists и через любой...
CVE-2020-14024
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the 1 Receiver or Recipient field in the Mailbox feature, 2 OZFORMGROUPNAME field in the Group configuration of addresses, 3 listname field in the Defining address lists configuration, o...