CVE-2019-17322

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that...

CVE-2019-17322

ClipSoft REXPERT 1.0.0.527 and earlier is vulnerable to arbitrary file creation via a POST request where the file path is supplied as a parameter. An attacker could cause writing of an executable file to an arbitrary directory. Exploitation requires user interaction: the target must visit a malic...

Apache Solr Remote Code Execution via Velocity Template

This module exploits a vulnerability in Apache Solr use exploit/multi/http/solr/velocityrce msf undefinedvelocityrce show actions ...actions... msf undefinedvelocityrce set ACTION msf undefinedvelocityrce show options ...show and set options... msf undefinedvelocityrce run This module requires...

CVE-2019-14276

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

CVE-2019-14276

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

Design/Logic Flaw

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

CVE-2019-14276

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body...

CVE-2019-14276

The CVE-2019-14276 issue affects WUSTL XNAT 1.7.5.3, where XXE attacks are possible via the POST request body. Connected sources confirm the vulnerability is tied to XXE in XNAT 1.7.5.3 and recommend updating to a newer version that contains a fix. The NVD has documented scores (CVSS v2 and v3.1)...

CVE-2019-13392

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

Cross site scripting

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

EUVD-2019-4886

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

Popup-Maker < 1.8.12 - Multiple Vulnerabilities

An attacker can partially control the arguments of the doaction, during the initialization of the PUMSite . Because of this, an attacker can call any method which contains an action starting from popmake or pum . This will lead to successful execution of functions which do not require arguments...

Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting Exploit Author: Prof. Joas Antonio Vendor Homepage: https://www.intelbras.com/pt-br/ Software Link: http://en.intelbras.com.br/node/25896 Version: 1.0.18 Test...

VMware Harbor Privilege Escalation (VMSA-2019-0015) (CVE-2019-16097)

The remote VMware Harbor cloud native registry is affected by a remote privilege escalation vulnerability. Instances of VMware Harbor with DB as the authentication backend and which allow users to self-register are vulnerable. An authenticated, non-administrator, remote attacker can exploit this ...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

CVE-2018-21024

CVE-2018-21024 affects Centreon Web: a code issue in licenseUpload.php before 2.8.27 allows uploading arbitrary files via POST. Impact is arbitrary file upload on Centreon Web prior to 2.8.27; no exploitation details are provided in the supplied documents. Remediation: upgrade to Centreon Web 2.8...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

CVE-2007-5977

Cross-site scripting XSS vulnerability in dbcreate.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than...

CVE-2008-5905

The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request...