12874 matches found
UliCMS 2019.1 Cross Site Scripting
Exploit Title: UliCMS 2019.1 "Spitting Lama" - Stored Cross-Site Scripting Google Dork: intext:"by UliCMS" Date: 2019-05-12 Exploit Author: Unk9vvN Vendor Homepage: https://en.ulicms.de Software Link: https://www.ulicms.de/aktuelles.html?single=ulicms-20191-spitting-lama-ist-fertig Version: 2019....
UliCMS 2019.1 Spitting Lama - Persistent Cross-Site Scripting
UliCMS 2019.1 Spitting Lama - Persistent Cross-Site Scripting Exploit Title: UliCMS 2019.1 "Spitting Lama" - Stored Cross-Site Scripting Google Dork: intext:"by UliCMS" Date: 2019-05-12 Exploit Author: Unk9vvN Vendor Homepage: https://en.ulicms.de Software Link:...
UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting
Exploit Title: UliCMS 2019.1 "Spitting Lama" - Stored Cross-Site Scripting Google Dork: intext:"by UliCMS" Date: 2019-05-12 Exploit Author: Unk9vvN Vendor Homepage: https://en.ulicms.de Software Link: https://www.ulicms.de/aktuelles.html?single=ulicms-20191-spitting-lama-ist-fertig Version: 2019....
Pornhub: Blind XSS in redtube administering site my.reflected.net
Researcher was able to execute Blind XSS in Redtube WAF administering panel Blind XSS in Redtube WAF administering panel...
Security and Human Behavior (SHB) 2019
Today is the second day of the twelfth Workshop on Security and Human Behavior, which I am hosting at Harvard University. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro Acquisti, Ross Anderson, and...
FusionPBX Operator Panel exec.php Command Execution
This module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operatorpanelview permissions, or administrator permissions, to execute arbitrary commands as the web server user by sending ...
REDAXO Cross-Site Request Forgery Vulnerability
EDAXO is an open source Web portal content management system . The system supports custom modules , plug-in extensions , project backup and so on. A cross-site request forgery vulnerability exists in the scheduled task management of the admin panel in REDAXO version 5.2.0. The vulnerability stems...
Unikrn: multiple vulnerabilities on your mautic server
Hi @unikrn! I found some vulnerabilities in you crm server: 1. By pass Cloudflare access: You Use Cloudflare Access on https://crm.unikrn.com . BUt this link bypassed Cloudflare Access: ████████/login This vulnerability generates the disclosure of important data: PHP info page: ██████████phpinfo ...
Q&A with Ashley Fidler, Chief Product Officer at eSentire: Women in Cybersecurity
In a few short weeks, Carbon Black will be hosting our annual user conference, CBConnect19, in sunny San Diego. This year, we’re bringing together a group of powerhouse women from across a variety of industries for our annual Women in Cybersecurity Panel to share their knowledge and experience fr...
Remote code execution
In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php...
CVE-2016-10751
osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajaxupload...
CVE-2016-10757
The CVE-2016-10757 entry concerns Redaxo 5.2.0: the admin panel’s cron management is vulnerable to CSRF that can lead to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php. The Red Hat, NVD, CNVD and CVE records confirm a CSRF path enabling execution of arbitrary code, with ...
Design/Logic Flaw
The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...
CVE-2018-14729
The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...
CentOS Web Panel Cross-Site Scripting Vulnerability (CNVD-2019-15668)
CentOS Web Panel CWP is a free web hosting control panel. A cross-site scripting vulnerability exists in CWP 0.9.8.747 and earlier versions. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...
CVE-2019-12190
XSS was discovered in CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fmcurrentdir or filename parameter...
Cross site scripting
XSS was discovered in CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fmcurrentdir or filename parameter...
CVE-2019-12190
XSS was discovered in CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fmcurrentdir or filename parameter...
