CVE-2021-22847

Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege...

Hyweb HyCMS-J1 SQL Injection Vulnerability

Hyweb HyCMS-J1 is a text management system from the Chinese company Hyweb. Hyweb HyCMS-J1 suffers from a SQL injection vulnerability that stems from an inability to filter POST request parameters. A remote attacker can use this vulnerability to inject SQL syntax and execute commands without...

Sonicwall SMA100 Operating System Command Injection Vulnerability

The Sonicwall SMA100 is a secure access gateway device from Sonicwall USA. A command injection vulnerability exists in the SonicWall SMA100 appliance that allows an authenticated administrative user to perform OS command injection using HTTP POST parameters. No detailed vulnerability details are...

CVE-2020-5146

A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier...

CVE-2020-5146

A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier...

CVE-2020-5146: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier...

Sonicwall SMA100 操作系统命令注入漏洞

The Sonicwall SMA100 is a secure access gateway device from Sonicwall USA. A command injection vulnerability exists in the SonicWall SMA100 appliance that allows an authenticated administrative user to perform OS command injection using HTTP POST parameters. No detailed vulnerability details are...

CVE-2018-20243: Insufficiently Protected Credentials

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629...

CVE-2020-9242

FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain parameters post from user, successful exploit could allow an authenticated attacker to launch a command injection attack...

Mail.ru: HTML/iframe/XSS injection on https://www.ucs.ru/online/shelter/settings/check/

Potential XSS via POST parameters in www.ucs.ru...

Victor CMS 1.0 Cross Site Scripting

Exploit Title: Victor CMS 1.0 - 'adduser' Persistent Cross-Site Scripting Google Dork: N/A Date: 2020-05-23 Exploit Author: Nitya Nand Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: 1.0 Tested on: Linux C...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...

CVE-2020-9384: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...

Subex ROC Partner Settlement 10.5 Insecure Direct Object Reference

=========================================================================================================== Subex ROC Partner Settlement 10.5 - Authenticated IDOR in change password function lead to account takeover...

PT-2020-12127 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to rename any file on the web server by exploiting a path traversal vulnerability. This is achieved by using a dot-dot-slash sequence ../ via the imgName a...

Directory Traversal

oneup/uploader-bundle is vulnerable to directory traversal. A remote attacker is able to access system files outside of the root directory via the ../ characters in the POST parameters used to build a path where the chunks are stored and assembled temporarily. The vulnerability can be exploited b...

CVE-2020-5306

Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content...

Cross site scripting

Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content...

CVE-2019-5071

An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route AC9V1.0 Firmware V15.03.05.16multiTRU. A specially crafted HTTP POST request can cause a command injection in the DNS1 post...

CVE-2019-5072

An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route AC9V1.0 Firmware V15.03.05.16multiTRU. A specially crafted HTTP POST request can cause a command injection in the DNS2 post...