Job Portal CMS 2.3.0.2 SQL Injection

==================================================================================================================================== | Title : Job Portal CMS V2.3.0.2 Sql Injection Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 Français V.Pro | | Vendor ...

xForUp Simple File Uploader 1.0 SQL Injection

==================================================================================================================================== | Title : xForUp simple file uploader V1.0 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro | | Vendor :...

The vulnerability of the FvDesigner software for creating operator panels, related to access to an uninitialized pointer, allows a hacker to execute arbitrary code in the target system.

The vulnerability of the FvDesigner software for creating operator panels is related to access to an uninitialized pointer. Exploiting this vulnerability could allow a attacker to execute arbitrary code on the target system...

The vulnerability of the FvDesigner software for creating operator panels, related to the execution of operations outside the buffer boundaries in memory, allows a hacker to execute arbitrary code on the target system.

The vulnerability of the FvDesigner software for creating operator panels is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system...

The vulnerability of the FvDesigner software for creating operator panels, related to the execution of operations outside the buffer boundaries in memory, allows a hacker to execute arbitrary code on the target system.

The vulnerability of the FvDesigner software for creating operator panels is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system...

The vulnerability of the monitoring panel widgets of the Trend Micro Apex Central security management and monitoring tool allows a threat actor to execute arbitrary code.

The vulnerability of the monitoring panel of the security monitoring and management tool Trend Micro Apex Central exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created...

CMSgrafia 7 SQL Injection

====================================================================================================================================== | Title : CMSgrafia v7 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 61.0.1 32-bit | |...

Cloud Base Multiple School Generate And Management System 4.6.0 Insecure Settings

==================================================================================================================================== | Title : Cloud Base Multiple school Generate & Management System v4.6.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français...

PT-2023-25860 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.9 Description: DataEase is an open source data visualization analysis tool. The DataEase panel and dataset have a stored cross-site scripting vulnerability. The issue has been fixed in version 1.18.9. There are...

PT-2023-26391 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.2.10 Description: A problematic issue was found in DedeBIZ, affecting an unknown functionality of the file /admin/vote edit.php. This issue leads to cross site scripting and can be launched remotely. The exploit has been...

CVE-2023-37916

CVE-2023-37916: KubePi (github.com/KubeOperator/kubepi) had a leak in /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 that exposed password hashes for any user (including admin). The root cause is a leaking endpoint returning password hashes; no workaround is documented. The issue has been fix...

CVE-2023-37916 Leak password hash of any user

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user including admin. A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users...

CVE-2023-37917

KubePi Privilege Escalation vulnerability: a normal user can elevate privileges by editing the isadmin field in requests, gaining admin control. Root cause is improper authorization in user-create/update flow. Impact is administrative access with high confidentiality/integrity/availability concer...

CVE-2023-37917 Privilege Escalation in kubepi

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are...

CVE-2023-37917 Privilege Escalation in kubepi

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are...

Mozilla: Exposing Django Debug Panel and Sensitive Infrastructure Information at https://dev.fxprivaterelay.nonprod.cloudops.mozgcp.net

The Django Debug Panel was exposed in a development environment, allowing sensitive infrastructure information to be accessed. This included details about the locations of databases, user information, and internal IP addresses. The exposure of this information posed significant security risks and...

KubePi 安全漏洞

KubePi is a K8s panel. It allows administrators to import multiple Kubernetes clusters and assign permissions for different clusters, namespaces to specified users through permission control. A security vulnerability exists in KubePi versions prior to 1.6.5, which stems from the fact that normal...

CMS NEXIN 2.0 Insecure Settings

==================================================================================================================================== | Title : CMS NEXIN engine v2.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

KubePi 信息泄露漏洞

KubePi is a K8s panel. It allows administrators to import multiple Kubernetes clusters and assign permissions for different clusters, namespaces to specified users through permission control. An information disclosure vulnerability exists in KubePi versions prior to 1.6.5, which originates from t...

GHSA-9436-3GMP-4F53 grav Server-side Template Injection (SSTI) mitigation bypass

Summary The fix for SSTI using |map, |filter and |reduce twigs implemented in the commit 71bbed1 introduces bypass of the denylist due to incorrect return value from isDangerousFunction, which allows to execute the payload prepending double backslash \ Details The isDangerousFunction check in...