7217 matches found
Design/Logic Flaw
Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php...
CVE-2018-7172
In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...
nutten69.com XSS vulnerability
Open Bug Bounty ID: OBB-568923 Description| Value ---|--- Affected Website:| nutten69.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
shogi.net XSS vulnerability
Open Bug Bounty ID: OBB-565102 Description| Value ---|--- Affected Website:| shogi.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-7219
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...
Cross site request forgery (csrf)
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...
Code injection
trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...
CVE-2017-14536
trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...
CVE-2017-14536
CVE-2017-14536 affects the trixbox 2.8.0.4 release and is a cross-site scripting (XSS) vulnerability triggered via PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php. The available data describe the vulnerability as an XSS flaw without details on exploitation steps, affected...
CVE-2017-14536
trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...
Joomla! Component Fastball 2.5 - season SQL Injection
Joomla! Component Fastball 2.5 - season SQL Injection Exploit Title: Joomla! Component Fastball 2.5 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.fastballproductions.com/ Software Link: http://www.fastballproductions.com/ Version: 2.5 Category: Webapps Tested on:...
Joomla! Component Google Map Landkarten 4.2.3 - SQL Injection
Exploit Title: Joomla! Component Google Map Landkarten = 4.2.3 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.joomla-24.de/ Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/google-map-landkarten/ Software Download:...
royalprincehoteldubai.com XSS vulnerability
Open Bug Bounty ID: OBB-555595 Description| Value ---|--- Affected Website:| royalprincehoteldubai.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2015-3618
Cross-site scripting XSS vulnerability in Nagios Business Process Intelligence BPI before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving index.php...
CVE-2015-3618
Nagios Business Process Intelligence (BPI) is affected by a Cross-site scripting (XSS) vulnerability in which an attacker can inject arbitrary web script or HTML via index.php. The issue affects BPI releases prior to 2.3.4. Root cause is an XSS flaw in the web interface, leading to potential impa...
Design/Logic Flaw
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
CVE-2018-6550
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
CVE-2018-6550
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
TSiteBuilder 1.0 - SQL Injection
Exploit Title: TSiteBuilder 1.0 - SQL Injection Dork: N/A Date: 27.01.2018 Vendor Homepage: http://www.datacomponents.net/ Software Link: http://www.datacomponents.net/products/website/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: Ihsan Sencan Author Web...