13457 matches found
CVE-2021-39377: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in openSIS 8.0 when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the index.php username parameter...
PT-2021-4493
Name of the Vulnerable Software and Affected Versions openSIS version 8.0 Description A SQL Injection issue exists, allowing a malicious attacker to issue SQL commands to the database through the username parameter in the "index.php" endpoint. This can enable a remote attacker to execute arbitrar...
PT-2021-4504
Name of the Vulnerable Software and Affected Versions openSIS version 8.0 Description A SQL injection issue exists due to inadequate protection of the SQL query structure. This allows a remote attacker to execute arbitrary SQL commands using the USERNAME parameter in the "index.php" endpoint. The...
CVE-2020-20343: Cross-Site Request Forgery (CSRF)
WTCMS 1.0 contains a cross-site request forgery CSRF vulnerability in the index.php?g=admin&m=nav&a=addpost component that allows attackers to arbitrarily add articles in the administrator background...
PT-2021-10479
Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0 Description: The issue is related to a cross-site request forgery CSRF vulnerability. This vulnerability is located in the "index.php?g=admin&m=nav&a=add post" component, which allows attackers to arbitrarily add articles in...
CVE-2020-19047
Cross Site Request Forgey CSRF in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?controller=system&action=admineditact'...
CVE-2020-19049: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...
PT-2021-10276
Name of the Vulnerable Software and Affected Versions: iWebShop version 5.3 Description: The issue allows remote attackers to execute arbitrary code via a malicious POST request to the "/index.php?controller=system&action=admin edit act" API endpoint. This is a Cross Site Request Forgery CSRF...
CVE-2020-19705
thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add...
CVE-2020-19705
thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add...
CVE-2020-19705
CVE-2020-19705 affects the open‑source CMS component thinkphp-zcms . The vulnerability is a SQL injection achievable through the URL path /index.php?m=home&c=message&a=add, enabling arbitrary SQL execution. Documents do not provide specific affected versions, patch guidance, or exploit details be...
PT-2021-10184
Name of the Vulnerable Software and Affected Versions: qdPM version 9.1 Description: A Cross Site Scripting XSS issue exists in the Heading field found in the Login Page under the General menu. This can be exploited via a crafted website name by doing an authenticated POST HTTP request to "/qdPM...
PT-2021-10186
Name of the Vulnerable Software and Affected Versions: Rukovoditel version 2.4.1 Description: A stored cross-site scripting XSS issue exists in the Name of application field on the General Configuration page, allowing remote attackers to inject arbitrary web script or HTML via a crafted website...
PT-2021-10393
Name of the Vulnerable Software and Affected Versions: thinkphp-zcms as of 20190715 Description: The issue allows SQL injection via the "index.php?m=home&c=message&a=add" API endpoint. This could potentially lead to unauthorized access to sensitive data. Recommendations: For thinkphp-zcms as of...
CVE-2020-19705: Improper Neutralization of Special Elements used in an SQL Command
thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add...
PT-2021-22245
Name of the Vulnerable Software and Affected Versions NASCENT RemKon Device Manager version 4.0.0.0 Description The issue concerns the assets/index.php Image Upload feature, which allows attackers to upload any code to the target system, resulting in remote code execution. The API endpoint...
CVE-2021-38613: Unrestricted Upload of File with Dangerous Type
The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution...
PT-2021-22243
Name of the Vulnerable Software and Affected Versions NASCENT RemKon Device Manager version 4.0.0.0 Description A command-injection issue in the Image Upload function allows attackers to execute arbitrary commands as root via shell metacharacters in the filename parameter to "assets/index.php"...
Simple Phone Book/Directory 1.0 SQL Injection
Exploit Title: Simple Phone book/directory 1.0 - 'Username' SQL Injection Unauthenticated Date: 21/08/2021 Exploit Author: Justin White Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/13011/phone-bookphone-directory.html Version: 1.0 Testeted on:...
