CVE-2020-35437

Subrion CMS 4.2.1 is affected by a Cross-Site Scripting (XSS) flaw via the avatar[path] parameter in a POST to the /_core/profile/ URI. The vulnerability stems from unsanitized input in avatar[path], enabling script injection. Public exploit reports describe a stored XSS; however, the provided do...

WordPress Plugin WP-PostRatings 1.86 - 'postratings_image' Cross-Site Scripting

Exploit Title: WordPress Plugin WP-PostRatings 1.86 - 'postratingsimage' Cross-Site Scripting Date: 20-12-2018 Software Link: https://wordpress.org/plugins/wp-postratings/ Exploit Author: Park Won Seok Version: wp-postratings.1.86 Tested on: Windows 10 x64 description: A Stored Cross-site scripti...

MiniWeb Denial of Service Vulnerability (CNVD-2021-07126)

MiniWeb is an HTTP server-side software written in C, with less resource consumption, fast response, cross-platform and other advantages. A denial of service vulnerability exists in MiniWeb 0.8.19. A remote attacker can exploit this vulnerability by using the long name of the first parameter in a...

CVE-2020-29596

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service daemon crash via a long name for the first parameter in a POST request...

CVE-2020-29596

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service daemon crash via a long name for the first parameter in a POST request...

CVE-2020-26281

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

Cross site request forgery (csrf)

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

Cross site request forgery (csrf)

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service daemon crash via a long name for the first parameter in a POST request...

CVE-2020-29596

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service daemon crash via a long name for the first parameter in a POST request...

CVE-2020-25010

An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to upload a malicious script file by constructing a POST type request and writing a payload in the request parameters as an...

CVE-2020-25010

An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to upload a malicious script file by constructing a POST type request and writing a payload in the request parameters as an...

CVE-2020-25010

CVE-2020-25010 affects Kyland KPS2204 6-Port Managed DIN-Rail Programmable Serial Device Servers, Software Version R0002.P05. It enables arbitrary code execution by remote attackers who send a crafted POST request and embed a payload in request parameters to instruct the server to write a file. T...

Kyland KPS2204 Code Issue Vulnerability

The Kyland KPS2204 is a programmable protocol converter developed for serial device networking applications by Kyland in Beijing, China. A security vulnerability exists in the Kyland KPS2204 6 Port Managed Din-Rail Programmable Device Servers Software Version:R0002.P05, which can be exploited by ...

HPE Systems Insight Manager AMF Deserialization RCE

A remotely exploitable vulnerability exists within HPE System Insight Manager SIM version 7.6.x that can be leveraged by a remote unauthenticated attacker to execute code within the context of HPE System Insight Manager's hpsimsvc.exe process, which runs with administrative privileges. The...

Cross site scripting

A cross-site scripting XSS vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with drtsformbuildid parameter containing the XSS payload and t paramet...

CVE-2020-29303

A cross-site scripting XSS vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with drtsformbuildid parameter containing the XSS payload and t paramet...

MiniWeb HTTP Server 0.8.19 - Buffer Overflow (PoC)

Exploit Title: MiniWeb HTTP Server 0.8.19 - Buffer Overflow PoC Date: 13.12.2020 Exploit Author: securityforeveryone.com Author Mail: helloATsecurityforeveryone.com Vendor Homepage: https://sourceforge.net/projects/miniweb/ Software Link:...

Directories Pro < 1.3.46 - Authenticated Reflected Cross-Site Scripting

The plugin did not sanitise the drtsformbuildid parameter in a POST request to /wp-admin/admin.php?page=drts/directories, allowing for HTML or JavaScript injection...

WordPress SabaiApps DirectoriesPro plugin 跨站脚本漏洞

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site scripting vulnerability exists in WordPress SabaiApps DirectoriesPro plugin...

The vulnerability of the KTS web interface “Mayak,” related to the failure to protect the SQL query structure, allows attackers to execute arbitrary SQL commands.

The vulnerability of the KTS “Lighthouse” web interface is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands using a specially crafted HTTP POST request...