Hardcoded credentials

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side...

CVE-2021-38755

Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php...

CVE-2021-32735

Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's ListItem component used in the pages and files section for example displayed HTML in page titles as it is. This could be used for cross-site scripting XSS attacks. Malicious authenticated Panel users can...

ZrLog Cross-Site Scripting Vulnerability (CNVD-2021-43499)

ZrLog is a blogging system developed using the Java language. A security vulnerability exists in ZrLog 2.1.3, which can be exploited by remote attackers to inject arbitrary web scripts and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

CVE-2020-21316

CVE-2020-21316 describes an XSS vulnerability in ZrLog 2.1.3’s comment section. The issue allows remote attackers to inject arbitrary scripts via the nickname parameter and potentially steal administrator cookies, gaining access to the admin panel. Affected component: ZrLog 2.1.3; vulnerability t...

CVE-2020-21316: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

ZrLog 跨站脚本漏洞

ZrLog is a blogging system developed using the Java language. A security vulnerability exists in ZrLog 2.1.3, which can be exploited by remote attackers to inject arbitrary web scripts and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

Small CRM 3.0 - 'Authentication Bypass' SQL Injection

Exploit Title: Small CRM 3.0 - 'Authentication Bypass' SQL Injection Date: 12/06/2021 Exploit Author: BHAVESH KAUL Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/small-crm-php/ Version: 3.0 Tested on: Server: XAMPP Description Small CRM 3.0 is vulnerable to SQL...

COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass) Vulnerability

Exploit Title: COVID19 Testing Management System 1.0 - SQL Injection Auth Bypass Exploit Author: Rohit Burke Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Windows 10 SQL Injection:...

COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)

Exploit Title: COVID19 Testing Management System 1.0 - SQL Injection Auth Bypass Date: 19/05/2021 Exploit Author: Rohit Burke Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Windows 10 SQL...

COVID19 Testing Management System 1.0 SQL Injection

Exploit Title: COVID19 Testing Management System 1.0 - SQL Injection Auth Bypass Date: 19/05/2021 Exploit Author: Rohit Burke Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Windows 10 SQL...

Adobe Connect 10 Username Disclosure

Title: adobe connect 10 Local Route Disclosure Author: h4shur date:2021-02-07 Vendor Homepage: https://www.adobe.com Software Link: https://www.adobe.com/products/adobeconnect.html Version: 10 and earlier Tested on: Windows 10 & Google Chrome Category : Web Application Bugs Description : There ar...

Projectnotes Student Result Management System SQL Injection Vulnerability

Projectnotes Student Result Management System is a Php-based student result management system organized by Projectnotes. Projectnotes Student Result Management System suffers from a SQL injection vulnerability that can be exploited by an attacker to access the admin panel and manage results per...

Informatica: loing in to marketplace panel on enablement.informatica.com

hello dear support I have found the issue and you can log in in to panel with any password and username F1163976 url: https://enablement.informatica.com/marketplace/ F1163979 Impact Can gain access to admin panel...

Egavilan Media EGM Address Book SQL Injection Vulnerability

Egavilan Media EGM Address Book is a platform for managing contact information address book organized by Egavilan Media in the United States. A SQL injection vulnerability exists in EGavilan Media EGM Address Book version 1.0, which can be exploited by an attacker to gain access to the admin pane...

Egavilan Media Under Onstruction Page With Cpanel SQL Injection Vulnerability

Egavilan Media Under Onstruction Page With Cpanel is a software used to show websites under construction organized by Egavilan Media in the United States. An SQL injection vulnerability exists in Egavilan Media Under Onstruction Page With Cpanel, which can be exploited by an attacker to gain acce...

CVE-2020-29474

EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution...

CVE-2020-29474

CVE-2020-29474 affects EGavilan Media EGM Address Book 1.0. A SQL injection vulnerability allows an attacker to gain Admin Panel access and perform remote arbitrary code execution. Publicly available exploits (e.g., Exploit-DB) exist per references in the records.

CVE-2020-29472: Improper Neutralization of Special Elements used in an SQL Command

EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution...

CVE-2020-29474: Improper Neutralization of Special Elements used in an SQL Command

EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution...