6829 matches found
CVE-2018-5284
The ImageInject plugin 1.15 for WordPress has XSS via the flickrappid parameter to wp-admin/options-general.php...
WordPress ImageInject plugin cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.ImageInject plugin is used in one of the image upload plugin. A cross-site scripting vulnerability exists in versi...
CVE-2017-17908
PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general...
CVE-2017-17908: Cross-Site Request Forgery (CSRF)
PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general...
PHP Scripts Mall Responsive Realestate Script Cross-Site Scripting Vulnerability
Responsive Realestate Script is a script for building real estate websites. A cross-site scripting vulnerability exists in PHP Scripts Mall Responsive Realestate Script. A remote attacker can inject arbitrary web script or HTML by sending the 'gplus' parameter to the admin/general.php file...
vBulletin <= 5.3.4 Arbitrary File Deletion And RCE Vulnerabilities
vBulletin is prone to arbitrary file deletion and remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...
FS Trademe Clone SQL Injection Vulnerability
FS Trademe Clone is a set of versatile website creation scripts based on PHP and MySQL. The script supports the creation of websites in categories such as auctions, e-commerce, B2B, real estate, job portals and classified ads. A SQL injection vulnerability exists in FS Trademe Clone version 1.0. ...
Sql injection
FS Trademe Clone 1.0 has SQL Injection via the searchitem.php search parameter or the generalitemdetails.php id parameter...
[SECURITY] Fedora 26 Update: exim-4.89-7.fc26
Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...
FS Trademe Clone 1.0 SQL Injection
Exploit Title: FS Trademe Clone 1.0 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/trademe-clone/ Demo: http://trademe-clone.demonstration.co.in/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx...
Qtouch General Edition is vulnerable to an untrustworthy code loading flaw
Qtouch General Purpose Edition is automation software that integrates the functions of device communication, graphic display, data conversion, logic processing, etc. and provides secondary development. Qtouch Universal Edition is vulnerable to an untrustworthy code loading flaw. The attacker...
WordPress Cross-Site Scripting Vulnerability (CNVD-2017-38249)
WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A cross-site scripting vulnerability exists in WordPress before 4.9.1. The vulnerability...
CVE-2017-17093: Improper Neutralization of Input During Web Page Generation
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...
EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1291)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the key management subsystem of the Linux kernel. An update on an uninstantiated key could cause a kernel panic,...
CVE-2017-16955
SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" parameter to /wp-admin/options-general.php?page=inlinks/inlinks.php...
Arbitrary File Deletion Vulnerability in the Pelco Sarix Enhanced GeneralSetupController.php File
pelco Sarix Enhanced is a webcam. An arbitrary file deletion vulnerability exists in the pelco Sarix Enhanced GeneralSetupController.php file. The vulnerability is due to the program failing to properly check for uploaded files when processing them, an attacker can delete arbitrary files in the...
Oracle MySQL Server 5.6 <= 5.6.21 Security Update (cpujan2016) - Linux
Oracle MySQL Server is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Logic design flaws in Vogelmaster's Android app
Wojia General Manager Android APP is a home control software. There is a logic design vulnerability in Wojia General Management Android APP. An attacker can exploit the vulnerability to modify arbitrary payment amount...