15751 matches found
CVE-2023-48188
SQL injection vulnerability in PrestaShop opartdevis v.4.5.18 thru v.4.6.12 allows a remote attacker to execute arbitrary code via a crafted script to the getModuleTranslation function...
CVE-2023-6304
A vulnerability was found in Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830. It has been declared as critical. This vulnerability affects unknown code of the file /goform/goformgetcmdprocess of the component Ping Tool. The manipulation of the argument url leads to os...
PT-2023-32604 · Tecno · Tecno 4G Portable Wifi Tr118
Name of the Vulnerable Software and Affected Versions: Tecno 4G Portable WiFi TR118 version TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830 Description: A critical issue has been identified, affecting the Ping Tool component, specifically the /goform/goform get cmd process file. The url argument is...
VulnCheck KEV: CVE-2023-49103
ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo via GetPhpInfo.php, including administrative credentials...
CVE-2023-6301 SourceCodester Best Courier Management System GET Parameter parcel_list.php cross site scripting
A vulnerability has been found in SourceCodester Best Courier Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file parcellist.php of the component GET Parameter Handler. The manipulation of the argument id with the input alert...
Exploit for Improper Input Validation in Atlassian Confluence_Data_Center
CVE-2023-22515-Scan About This is simple scanner for CVE-...
Best Courier Management System Cross-Site Scripting Vulnerability
Best Courier Management System is a courier management system by Mayuri K. Individual developer. A cross-site scripting vulnerability exists in SourceCodester Best Courier Management System version 1.0, which stems from the presence of an unknown function in the parcellist.php file in the compone...
CVE-2023-48711 Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browser
google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery SSRF Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can set ...
CVE-2023-4594
Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmindll.htm file...
CVE-2023-4594
Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmindll.htm file...
CVE-2023-46357
In the module "Cross Selling in Modal Cart" motivationsale 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method motivationsaleDataModel::getProductsByIds has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injectio...
HrServ – Previously unknown web shell used in APT attack
Introduction In the course of our routine investigation, we discovered a DLL file, identified as hrserv.dll, which is a previously unknown web shell exhibiting sophisticated features such as custom encoding methods for client communication and in-memory execution. Our analysis of the sample led t...
get-cameras.com Open Redirect vulnerability OBB-3790297
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress Plugin News & Blog Designer Pack Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
overflow in get_number in vim
...
GHSA-RQ42-58QF-V3QX LibreNMS vulnerable to rate limiting bypass on login page
Summary Application is using two login methods and one of them is using GET request for authentication. There is no rate limiting security feature at GET request or backend is not validating that. PoC Go to /?username=admin&password=password&submit= Capture request in Burpsuite intruder and add...
LibreNMS vulnerable to rate limiting bypass on login page
Summary Application is using two login methods and one of them is using GET request for authentication. There is no rate limiting security feature at GET request or backend is not validating that. PoC Go to /?username=admin&password=password&submit= Capture request in Burpsuite intruder and add...
CVE-2023-48185
Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request...
