CVE-2022-24582

CVE-2022-24582 affects Accounting Journal Management 1.0 (PHP-based). The issue is a cross-site scripting vulnerability in the user list parameter manage_user , enabling both stored XSS and PHPSESSID hijacking. An attacker could exploit an existing session to perform actions inside or outside the...

CVE-2022-24582: Improper Neutralization of Input During Web Page Generation

Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manageuser from User lists is vulnerable to XSS-Stored and PHPSESSID attacks. The malicious user can attack the system by using the already session which he has from inside and outside of the network...

Win32.MarsStealer Web Panel Cross Site Scripting

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faaB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Win32.MarsStealer Web Panel Vulnerability: Unauthenticated Remote Persistent XSS Description: The...

AgentTesla Builder Web Panel Cross Site Scripting

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/db9629508fda139f71f625d764c7eff7.txt Contact: [email protected] Media: twitter.com/malvuln Threat: AgentTesla Builder Web Panel Vulnerability: Cross Site Scripting XSS Description: AgentTeslaBuilder...

AgentTesla Builder Web Panel Cross Site Scripting Vulnerability

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/db9629508fda139f71f625d764c7eff7.txt Contact: email protected Media: twitter.com/malvuln Threat: AgentTesla Builder Web Panel Vulnerability: Cross Site Scripting XSS Description: AgentTeslaBuilder WebU...

WannaRace - WebApp Intentionally Made Vulnerable To Race Condition For Practicing Race Condition

WebApp intentionally made vulnerable to Race Condition Description Race Condition vulnerability can be practiced in the developed WebApp. Task is to buy a Mega Box using race condition that costs more than available vouchers. Two challenges are made for practice. Challenge B is to be solved when...

CVE-2021-43141

Cross Site Scripting XSS vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in planapplication...

CVE-2021-41171

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing...

CVE-2021-41171

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing...

Design/Logic Flaw

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing...

CVE-2021-41171: Improper Restriction of Excessive Authentication Attempts

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing...

IFSC Code Finder Project 1.0 SQL Injection

Hello, dear friends. KR CVE-2021-42224 Vendor Description: - vulnerability: all or nothing SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php. The searchifsccode parameter appears to be vulnerable to SQL injection attacks. The...

IFSC Code Finder Project 1.0 SQL Injection Vulnerability

IFSC Code Finder Project 1.0 SQL Injection Vulnerability CVE-2021-42224 Vendor Description: - vulnerability: all or nothing SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php. The searchifsccode parameter appears to be vulnerabl...

Covid Vaccination Scheduler System 1.0 SQL Injection / Cross Site Scripting

CVE-2021-36621 Vendor Description Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection, XSS-STORED PHPSESSID Hijacking, and remote SQL Injection - bypass Authentication. The attacker can be hijacking the PHPSESSID by using this vulnerability and then he can...

Covid Vaccination Scheduler System 1.0 SQL Injection / Cross Site Scripting Vulnerabilities

Covid Vaccination Scheduler System version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to faisalfs10x in July of 2021. CVE-2021-36621 Vendor Description Sourcecodester Online Covid Vaccination...

PASS-PHP 1.0 SQL Injection / Cross Site Scripting Exploit

Exploit Title: PASS-PHP by: oretnom23 v1.0 is vulnerable to remote SqL-Injection bypass Authentication, XSS-Stored and PHPSESSID Hijacking. Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 09.24.2021 Vendor: https://www.sourcecodester.com/user/257130/activity Link:...

PASS-PHP 1.0 SQL Injection / Cross Site Scripting

Exploit Title: PASS-PHP by: oretnom23 v1.0 is vulnerable to remote SqL-Injection bypass Authentication, XSS-Stored and PHPSESSID Hijacking. Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 09.24.2021 Vendor: https://www.sourcecodester.com/user/257130/activity Link:...

AHSS-PHP 1.0 Cross Site Scripting / SQL Injection Vulnerabilities

Exploit Title: AHSS-PHP by: oretnom23 v1.0 is vulnerable in the application /scheduler/classes/Login.php to remote SQL-Injection-Bypass-Authentication + XSS-Stored Hijacking PHPSESSID Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 09.15.2021 Vendor:...

SURMS - PHP (by: oretnom23 ) v1.0 SQL-Injection-Bypass-Authentication and PWNED PHPSESSID Hijacking

The SURMS – PHP by: oretnom23 v1.0 is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account and PWNED PHPSESSID Hijacking in app /storage/classes/Login.php. remote SQL-Injection-Bypass-Authentication: . The parameter username from the login form is not protected correct...

MSMS-PHP (by: oretnom23 ) v1.0 - HIT STRIKE!

CVE-nu11-05 MSMS-PHP by: oretnom23 v1.0 HIT STRIKE Description: The MSMS-PHP by: oretnom23 v1.0 is vulnerable in three sections! – – remote SQL-Injection-Bypass-Authentication m0re info: . The parameter username from the login form is not protected correctly and there is no security and escaping...