Sql injection

SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user...

CVE-2020-25472

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery CSRF vulnerability, which allows attackers to add new users...

Stored XSS Vulnerability at XXL-JOB Added User

XXL-JOB is a lightweight distributed task scheduling platform whose core design goals are rapid development, simple learning, lightweight and easy to extend. A stored XSS vulnerability exists at XXL-JOB new users, which can be exploited by an attacker to obtain user cookie information...

CloudMe 1.11.2 - Buffer Overflow ROP (DEP,ASLR) Exploit (2)

Exploit Title: CloudMe 1.11.2 - Buffer Overflow ROP DEP,ASLR Exploit Author: Bobby Cooke boku CVE: CVE-2018-6892 Vendor Homepage: https://www.cloudme.com/ Software Link: https://www.cloudme.com/downloads/CloudMe1112.exe Version: 1.11.2 Tested On: Windows 10 x64 - 10.0.19041 Build 19041 Script:...

CloudMe 1.11.2 Buffer Overflow

Exploit Title: CloudMe 1.11.2 - Turing Complete Add-Admin ROP DEP,ASLR Exploit Author: Bobby Cooke boku CVE: CVE-2018-6892 Date: September 29th, 2020 Vendor Homepage: https://www.cloudme.com/ Software Link: https://www.cloudme.com/downloads/CloudMe1112.exe Version: 1.11.2 Tested On: Windows 10 x6...

CVE-2020-12281

iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php...

CVE-2012-3338

IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new user account functionality. An attacker could exploit this vulnerability to create unprivileged user accounts. IBM X-Force ID: 78286...

Security feature bypass

IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new user account functionality. An attacker could exploit this vulnerability to create unprivileged user accounts. IBM X-Force ID: 78286...

CVE-2020-13693

An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled...

CVE-2020-13693

An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled...

Privilege escalation

An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled...

CVE-2020-13693

The CVE-2020-13693 entry concerns the WordPress bbPress plugin before 2.6.5, where an unauthenticated privilege-escalation vulnerability exists when New User Registration is enabled. The issue stems from a privilege escalation path in bbPress that allows attackers without authentication to gain h...

CVE-2020-13693

An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled...

bbPress < 2.6.5 - Unauthenticated Privilege Escalation when New User Registration enabled

Raphael Karger discovered an unauthenticated privilege escalation issue when new user registration is enabled...

NukeViet VMS 4.4.00 Cross Site Request Forgery

Exploit Title: NukeViet VMS 4.4.00 - Cross-Site Request Forgery Change Admin Password Date: 2020-05-18 Exploit Author: JEBARAJ Vendor Homepage: https://nukeviet.vn/ Software Link: https://github.com/nukeviet/nukeviet/releases/download/4.4.00/nukeviet4.4.00setup.zip Version: 4.4.00 Tested on:...

Exploit for Missing Authentication for Critical Function in Vmware Vcenter_Server

Proof of concept for CVE-2020-3952https://www.guardicore.co...

Exploit for Missing Authentication for Critical Function in Vmware Vcenter_Server

Proof of concept for CVE-2020-3952https://www.guardicore.co...

CVE-2020-9477

An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the authentication functionality in the web-based interface could allow an unauthenticated remote attacker to capture packets at the time of authentication and gain access to the cleartext password. An attacker...

Insecure File Permissions

github.com/openshift/ocp-release-operator-sdk configures an insecure file permission for /etc/passwd. Any local user is able to modify the contents within the /etc/passwd file. This allows an attacker to escalate privileges by creating a new user with higher privileges and switching to the new us...

CVE-2020-9028

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen when creating a new user...