Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07227)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the EditCurrentPool.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker with the help of the 'PropName' parameter to inject...

CVE-2018-19927

Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...

ASUSTOR ADM Operating System Command Injection Vulnerability

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An operating system command injection vulnerability exists in the group.cgi file in ASUSTOR ADM version 3.1.1. An attacker can exploit this vulnerability by modifying the 'name' POST parameter to execute...

CVE-2018-12317

OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter...

Drobo 5N2 Improper Access Control Vulnerability (CNVD-2019-05934)

The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. An access control error vulnerability exists in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. An attacker c...

CVE-2018-14695

Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...

Buffalo TS5600D1206 Command Injection Vulnerability (CNVD-2019-00674)

The Buffalo TS5600D1206 is a network storage device from the Buffalo Group of Japan. A command injection vulnerability exists in the User.create method in the Buffalo TS5600D1206 version 3.61-0.10, which can be exploited to execute system commands with the 'name' parameter...

CVE-2018-13318

System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter...

CVE-2018-13318

System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter...

Ticketly 1.0 - name SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Ticketly 1.0 – 'name' SQL Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Vendor: Abisoft https://abisoftgt.net Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql...

FruityWifi Code Execution Vulnerability

FruityWifi is a wireless network auditing tool. A security vulnerability exists in the www/modules/save.php file in FruityWifi 2.4 and earlier versions. A remote attacker can exploit this vulnerability by sending a specially crafted 'modname' parameter via a POST request to execute arbitrary code...

CVE-2018-19170

In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...

CVE-2018-19170

In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...

CVE-2018-19089

tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/saverole name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\userlist.jsp...

CVE-2018-18868

No-CMS 1.1.3 is prone to Persistent XSS via a contactus name parameter, as demonstrated by the VG48Z5PqVWname parameter...

Fiyo CMS Cross-Site Scripting Vulnerability (CNVD-2018-21626)

Fiyo CMS is a content management system CMS for creating CMS templates. A cross-site scripting vulnerability exists in the dapur\apps\appuser\edituser.php page in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'name'...

CVE-2018-18545

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

Design/Logic Flaw

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

CVE-2018-18545

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

CVE-2018-18416

LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...