2574 matches found
PT-2017-12198
Name of the Vulnerable Software and Affected Versions MetInfo versions prior to 5.3.18 Description The issue concerns URL Redirector Abuse via the gourl parameter to "member/login.php" API endpoint. Recommendations For MetInfo versions prior to 5.3.18, update to version 5.3.18 or later to resolve...
CVE-2017-11718: URL Redirection to Untrusted Site
There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php...
tout-debrid.ch XSS vulnerability
Vulnerable URL: http://tout-debrid.ch/login.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 497683 VIP website status:| No Check tout-debrid.ch SSL connection:| Grade: A...
CVE-2017-11675
The traverseStrictSanitize function in admindir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the adminname array parameter to...
PT-2017-12167
Name of the Vulnerable Software and Affected Versions ZenCart version 1.5.5e Description The issue arises from the traverseStrictSanitize function in admin dir/includes/classes/AdminRequestSanitizer.php, which mishandles key strings. This allows remote authenticated users to execute arbitrary PHP...
CVE-2017-11675: Improper Control of Generation of Code
The traverseStrictSanitize function in admindir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the adminname array parameter to...
PT-2017-12116
Name of the Vulnerable Software and Affected Versions dayrui FineCms version 5.0.9 Description The issue concerns a Cross Site Scripting XSS problem. It occurs in the admin/Login.php file when a specific payload is entered into the username field, provided the payload does not start with a ''...
CVE-2017-11581: Improper Neutralization of Input During Web Page Generation
dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...
CVE-2017-11581
dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...
Stellar.org: HTTP - Basic Authentication on https://www.stellar.org/wp-login.php
Greetings, noticed https://www.stellar.org/wp-login.php using basic authentication. PoC: YWRtaW46YWRtaW4= is base64 encode of admin:admin Impact: Vulnerable to client side attacks. Vulnerable to MITM attack. Vulenrable to Eavesdropping attack. Vulnerable to Brute force attacks. Fix: HTTP-Basic...
cvsnwk.org XSS vulnerability
Vulnerable URL: http://www.cvsnwk.org/cvsm/login.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4223347 VIP website status:| No Check cvsnwk.org SSL connection:| Grade: F...
my.cashtrain.com.au XSS vulnerability
Vulnerable URL:...
punt.nl XSS vulnerability
Vulnerable URL: http://www.punt.nl/login.php/'-alert'OPENBUGBOUNTY'-' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 134247 VIP website status:| No Check punt.nl SSL connection:|...
CaseAware Cross Site Scripting
Exploit Title: CaseAware Cross Site Scripting Vulnerability Date: 20th May 2017 Exploit Author: justpentest Vendor Homepage: https://caseaware.com/ Version: All the versions Contact: [email protected] CVE : 2017-5631 Source:...
CVE-2016-10329
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...
CVE-2016-10329
Affected product: Synology Photo Station (prior to version 6.5.3-3226). Vulnerability: Command injection in login.php that allows remote attackers to execute arbitrary code through shell metacharacters in a crafted X-Forwarded-For header. Impact: Remote code execution with high risk (as noted by ...
CVE-2016-10329: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...
CVE-2017-8295
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...
CVE-2017-8295: Weak Password Recovery Mechanism for Forgotten Password
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...
