PT-2017-13296

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to an XSS vulnerability in the out function in controllers/member/Login.php. This vulnerability is triggered by the Referer HTTP header and affects Internet Explorer. Recommendations For...

CVE-2017-14194: Improper Neutralization of Input During Web Page Generation

The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer...

CVE-2017-14192: Improper Neutralization of Input During Web Page Generation

The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field...

PT-2017-13294

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to an XSS concern in the checktitle function, specifically in the module field within the controllers/member/api.php file. Recommendations For FineCms version 5.0.11, consider disabling t...

CVE-2017-14193: Improper Neutralization of Input During Web Page Generation

The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer...

CVE-2017-13697: Improper Neutralization of Input During Web Page Generation

controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...

PT-2017-13025

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to XSS and concerns the dirname variable in the controllers/member/api.php file. Recommendations For FineCms version 5.0.11, consider restricting the use of the dirname variable in the...

Photogallery Project 1.0 - SQL Injection

Exploit Title: Photogallery Project 1.0 - Multiple Vulnerabilities Dork: N/A Date: 17.08.2017 Vendor Homepage : http://surajkumar.in/ Software Link: http://surajkumar.in/product/photogallery-project-in-php/ Demo: http://surajkumar.in/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

finecms SQL injection vulnerability (CNVD-2017-28415)

FineCMS is a website building system based on PHP+MySql+CI framework. A SQL injection vulnerability exists in the controllersmemberContentController.php page in Finecms, which can be exploited by remote attackers to manipulate the website database...

libming 'OpCode' Function Denial of Service Vulnerability

libming is a Flash SWF output library for PHP, Perl, Ruby, Python, C, C ++, Java, and more. A security vulnerability exists in the OpCode function called from decompileSETMEMBER in util/decompile.c in Libming, which can be exploited to cause a denial of service heap-based buffer out-of-bounds rea...

CVE-2017-11718

There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php...

PT-2017-12198

Name of the Vulnerable Software and Affected Versions MetInfo versions prior to 5.3.18 Description The issue concerns URL Redirector Abuse via the gourl parameter to "member/login.php" API endpoint. Recommendations For MetInfo versions prior to 5.3.18, update to version 5.3.18 or later to resolve...

CVE-2017-11718: URL Redirection to Untrusted Site

There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php...

Sql injection

dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...

PaulShop - SQL Injection Cross-Site Scripting

PaulShop - SQL Injection Cross-Site Scripting Exploit Title: PaulShop CMS - Sql Injection and stored XSS Date: 07/23/2017 Exploit Author: BTIS Team http://www.btis.vn Vendor Homepage: https://codecanyon.net/item/paulshop-cms-with-shopping-cart-system/18070714 Version: 03/27/2017 Tested on:...

Apache Solar 5.5.4 / 6.5.1 Member Spoofing Vulnerability

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious...

CVE-2014-7953

Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running "pm install" with the target apk, and simultaneously running a crafted script to process logcat'...

CVE-2014-7953

Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running "pm install" with the target apk, and simultaneously running a crafted script to process logcat'...

teamchallengehourglass.com XSS vulnerability

Vulnerable URL: http://www.teamchallengehourglass.com/memberGallery.asp?programme=1"...

Niushop open source mall system v1.05 beta 20170622 getMemberExpressAddress method has a SQL injection vulnerability

NiuShop open source mall system, is a PHP open source e-commerce system. Niushop open source mall system v1.05 beta 20170622 getMemberExpressAddress method SQL injection vulnerability. The vulnerability due to the system id parameter does not filter the data submitted by the user , a remote...