CVE-2016-9717: Improper Input Validation

HTTP Parameter Override is identified in the IBM Infosphere Master Data Management MDM 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploite...

CVE-2016-10223

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

CVE-2017-5961

An issue was discovered in ionize through 1.0.8. The vulnerability exists due to insufficient filtration of user-supplied data in the "path" HTTP GET parameter passed to the "ionize-master/themes/admin/javascript/tinymce/jscripts/tinymce/plugins/codemirror/dialog.php" URL. An attacker could execu...

Cross-site Scripting (XSS)

Mattermost is vulnerable to cross-site scripting XSS. It does not properly validate and sanitize user-supplied input to the HTTP GET parameter link in "/error" page. It is possible to set the return link, which is part of the error page, to a base64 encoded DATA URI. This could be used to execute...

family.tgifridays.co.uk XSS vulnerability

Vulnerable URL: https://family.tgifridays.co.uk/search?actions=search%2Fmap=%22%3E%3Cscript%3Ealert%28%22OPENBUGBOUNTY%22%29%3C%2Fscript%3E%3Cdiv+id%3D%22=10 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Public...

ESF pfSense status_rrd_graph_img.php Command Injection

A Command Injection vulnerability has been reported in ESF pfSense. This vulnerability is due to statusrrdgraphimg.php incorrectly validating the graph HTTP parameter. A remote, authenticated attacker can exploit this vulnerability by sending crafted requests to the statusrrdgraphimg.php URI...

auto24.ee XSS vulnerability

Vulnerable URL: http://www.auto24.ee/new/list.php?dmake=10mvid=2100%22%3E%3Cscript%3Ealert%28%22XSSPOSED%22%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 14.03.2016 Latest check for patch:| 14.03.2016 19:23 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

RXTEC RXAdmin SQL Injection Vulnerability

RXTEC RXAdmin login page from UPDATE 06 / 2012 suffers from a remote SQL injection vulnerability. RXTEC20150513 Title: SQL injection vulnerability in the RXTEC RXAdmin Login Page allows remote attackers to execute arbitrary SQL commands via several HTTP parameter. Type of vulnerability: SQL...

Multiple SQL Injection Vulnerabilities in mcart.xls Bitrix Module

High-Tech Bridge Security Research Lab discovered multiple SQL Injection vulnerabilities in mcart.xls Bitrix module, which can be exploited to execute arbitrary SQL queries and obtain potentially sensitive data, modify information in database and gain complete control over the vulnerable website...

Reflected XSS in Role Scoper WordPress Plugin

High-Tech Bridge Security Research Lab discovered Cross-Site scripting vulnerability in a popular Role Scoper WordPress plugin, present on more than 10 000 websites. The vulnerability can be exploited by anonymous attackers against website administrators. Successful attack may allow to steal...

OpenEMR globals.php Authentication Bypass (CVE-2015-4453)

An authentication weakness vulnerability exists in OpenEMR, specifically in the globals.php script. The vulnerability is due to variable name collision during HTTP parameter extraction. Successful exploitation will bypass authentication and allow the attacker to gain unauthorized access to the...

Remote File Inclusion in Gwolle Guestbook WordPress Plugin

High-Tech Bridge Security Research Lab discovered a critical Remote File Inclusion RFI in Gwolle Guestbook WordPress plugin, which can be exploited by non-authenticated attacker to include remote PHP file and execute arbitrary code on the vulnerable system. HTTP GET parameter "abspath" is not bei...

Reprise License Manager HTTP Parameter Parsing Stack Buffer Overflow

A stack buffer overflow vulnerability exists in the Reprise License Manager. The vulnerability is due to insufficient input validation of the licfile and debuglog parameters while processing an HTTP request. Successful exploitation would lead to arbitrary code execution under the security context...

Reflected Cross-Site Scripting (XSS) in SourceBans

High-Tech Bridge Security Research Lab discovered vulnerability in SourceBans, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. The vulnerability exists due to insufficient filtration of input-data passed via the "advSearch" HTTP GET parameter to...

Cross-Site Scripting (XSS) in qTranslate WordPress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in qTranslate WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against website administrators. Successful exploitation of this vulnerability may allow a remote attacker to gain complete control ove...

Local PHP File Inclusion in ResourceSpace

Advisory ID: HTB23258 Product: ResourceSpace Vendor: Montala Limited Vulnerable Versions: 7.1.6513 and probably prior Tested Version: 7.1.6513 Advisory Publication: May 6, 2015 without technical details Vendor Notification: May 6, 2015 Vendor Patch: June 1, 2015 Public Disclosure: June 3, 2015...

u-Auctions - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This...

u-Auctions - Multiple Vulnerabilities

u-Auctions - Multiple Vulnerabilities Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This vulnerability affects...

u-Auctions - Multiple Vulnerabilities

Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This vulnerability affects /adsearch.php URL encoded POST input...

Modx CMS 2.2.14 - CSRF Bypass, Reflected XSS, Stored XSS Vulnerability

Exploit for php platform in category web applications Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2...