CVE-2020-28351

The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack via the PATHINFO to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page...

PT-2020-16993

Name of the Vulnerable Software and Affected Versions Mitel ShoreTel version 19.46.1802.0 Description The issue allows an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the time zone object in the HOME MEETING& page, specifically...

Exploit for Cross-site Scripting in Mitel Shoretel_Firmware

ShoreTel 19.46.1802.0 Reflected Cross Site Scripting Attack T...

Processwire CMS 2.4.0 Local File Inclusion

Exploit Title: Local File Inclusion Processwire CMS 2.4.0 Vulnerability Type: Unauthenticated LFI Date: 03.11.2020 Exploit Author: Y1LD1R1M Type: WEBAPPS Platform: PHP Vendor Homepage: https://processwire.com/ Version: 2.4.0 Tested on: Kali Linux Description Local File Inclusion in Processwire CM...

CVE-2020-27956: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...

PT-2020-16879

Name of the Vulnerable Software and Affected Versions SourceCodester Car Rental Management System version 1.0 Description The issue allows remote code execution due to an arbitrary file upload vulnerability in the Upload Image component. This is possible because .php files can be uploaded to the...

CVE-2020-26802: Cross-Site Request Forgery (CSRF)

forma.lms 2.3.0.2 is affected by Cross Site Request Forgery CSRF in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeover...

PT-2020-16490

Name of the Vulnerable Software and Affected Versions forma.lms version 2.3.0.2 Description The issue allows for Cross Site Request Forgery CSRF in the "forma.lms" application, specifically in the "formalms/appCore/index.php" endpoint, when a GET request is made to...

CVE-2020-26043

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php...

CVE-2020-26041

An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php...

CVE-2020-26043

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php...

CVE-2020-26042

An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php...

Cross site scripting

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php...

Sql injection

An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php...

SpinetiX Fusion Digital Signage 3.4.8 File Backup/Delete Path Traversal

Summary At SpinetiX we inspire businesses to unlock the potential of their story. We believe in the power of digital signage as a dynamic new storytelling platform to engage with people. For more than 13 years, we have been constantly innovating to deliver cutting-edge digital signage solutions...

CVE-2020-26042

An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php...

CVE-2020-26042

CVE-2020-26042 affects Hoosk CMS v1.8.0 with a SQL injection vulnerability in install/index.php. Per the connected NVD record, the issue yields partial confidentiality, partial integrity, and partial availability impacts (CVSS v2 base 7.5, HIGH; CVSS v3.1 base 9.8, CRITICAL). Exploitation details...

CVE-2020-26041

An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php...

PT-2020-16273

Name of the Vulnerable Software and Affected Versions Hoosk CmS version 1.8.0 Description An issue was discovered in Hoosk CmS, which allows for Remote Code Execution. The vulnerability is located in the install/index.php file. Recommendations For Hoosk CmS version 1.8.0, consider removing or...

PT-2020-16274

Name of the Vulnerable Software and Affected Versions Hoosk CMS version 1.8.0 Description A SQL injection issue was found in the install/index.php file. Recommendations For Hoosk CMS version 1.8.0, update to a newer version that contains a fix for this issue...