knightcapitalfunding.com XSS vulnerability

Vulnerable URL: https://www.knightcapitalfunding.com/?s=%3C/script%3E%3Cimg%20src=x%20onerror=prompt/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1822718 VIP website...

Stored Cross-Site Scripting Vulnerability in Knight CMS Version 3.7

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. A stored cross-site scripting vulnerability exists in Knight CMS version 3.7. Because the editor in KindEditor version 4.1.10 fails to filter input content, an attacker can exploit the vulnerability to execute arbitrary...

knightfrank.ru XSS vulnerability

Vulnerable URL: http://www.knightfrank.ru/search?query=%3C/script%3E%3Cimg%20src=x%20onerror=prompt/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| Yes, at 31.12.2016 Latest check for patch:| 31.12.2016 01:04 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Knight CMS suffers from SQL injection vulnerability

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS Talent System version 3.7 suffers from a SQL injection vulnerability, which is exploited by attackers to obtain sensitive information due to unfiltered variable names...

Knight CMS Talent System v3.7 has SQL Injection Vulnerabilities

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS Talent System v3.7 suffers from a SQL injection vulnerability due to numeric variable filtering being missed resulting in injection, allowing remote attackers to exploit the vulnerability by submitting special...

Knight CMS Talent System Cross-site Scripting Vulnerability

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS Talent System v3.7 cross-site scripting vulnerability, attackers can exploit the vulnerability to execute arbitrary script code, steal cookie-based authentication and launch other attacks...

Knight CMS Talent System Arbitrary File Deletion Vulnerability

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS Talent System v3.7 exists arbitrary file deletion vulnerability, due to the variable $filename does not perform effective filtering, attackers can exploit the vulnerability to traverse the deletion of arbitrar...

Knight CMS Talent System SQL Injection Vulnerability

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS Talent System v3.7 exists SQL injection vulnerability, due to the variable $id filtering was omitted to cause injection, attackers use the vulnerability to obtain sensitive information...

Knight Talent System V3.7 Exists Storage-based Cross-site Scripting Vulnerability

Knight Talent System is a professional talent system based on PHP + MYSQL as the core development, free + open source. The system has a high implementation efficiency, free switching of templates, flexible background management functions and many other excellent features. Knight Talent System V3....

Holy Knight EN - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Holy Knight EN published at the 'play' market has multiple vulnerabilities...

Storm of Knight - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Storm of Knight published at the 'play' market has multiple vulnerabilities...

Buff Knight! - RPG Runner - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Buff Knight! - RPG Runner published at the 'play' market has multiple vulnerabilities...

Knight Rider Watchface - Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Knight Rider Watchface published at the 'play' market has multiple vulnerabilities...

knightfrank.ru XSS vulnerability

Vulnerable URL: http://www.knightfrank.ru/search?query=%3Csvg%20onload=alert%60XSSPosed%60%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 697490 Google Pagerank| 4 VIP website status:| No Check knightfrank.ru...

骑士CMS SQL注入前台GETSHELL

No description provided by source...

骑士CMS某接口1处SQL盲注#1(官网demo测试)

简要描述： 骑士CMS某接口1处SQL盲注官网demo测试 详细说明： 手机客户端接口存在SQL注入，SELECT注入无关键字过滤,理论上可以获取任意数据。 ： http://demo.74cms.com/android/resume.php 代码： 15 if !empty$aset'displayorder' 16 17 $arr=explode'',$aset'displayorder'; 18 $arr1=pregmatch'/asc|desc/',$arr1?$arr1:"desc"; 19 if $arr0=="rtime" 20 21 $orderbysql=" ORDER...

骑士CMS某新功能4处SQL注入

简要描述： 骑士CMS官网某新功能4处SQL盲注，官网测试。 详细说明： 官网培训信息搜索和猎头工作搜索等4处SQL盲注。 0x01: 当前位置：首页 教育培训 课程列表 搜索课程 http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc&key= 参数sort存在SQL注入,desc后面的字符串全部带入SQL：...

骑士CMS某新功能SQL注入

简要描述： 骑士CMS某新功能SQL注入 详细说明： http://demo.74cms.com/ 培训中心SQL注入。所以先注册一个培训中心的账号，然后去发不新课程， 课程名用：cname'/, 其他的随便填写。 然后使用用户的身份登录其申请课程： 随便填写： 提交即返回错误： 我们把其他说明改为： /,3,1, 200, concatuser,0x0a,version , 1, 1413525884 然后提交即成功。 这个时候用培训中心的账号，查看课程申请：...

Gitlab-shell Code Execution Exploit

This Metasploit module takes advantage of the addition of authorized ssh keys in the gitlab-shell functionality of Gitlab. Versions of gitlab-shell prior to 1.7.4 used the ssh key provided directly in a system call resulting in a command injection vulnerability. As this relies on adding an ssh ke...

Black Knight Forum 4.0 Member.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13327/info Black Knight Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to utilizing the data in an SQL query. Successful...