WordPress cvp-irontec 4.8.3 Shell Upload

Exploit Title : WordPress cvp-irontec Themes 4.8.3 Remote Shell Upload Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/12/2018 Vendor Homepage : wordpress.org Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Version...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-03526)

Craft CMS is a content management system CMS for developers and content managers. A cross-site scripting vulnerability exists in the /admin-panel-path/index.php?p=admin/actions/entries/save-entry URL in Craft CMS version 3.0.25. A remote attacker can exploit this vulnerability to inject arbitrary...

WordPress Cvp-Adegrontec 4.8.3 Shell Upload

Exploit Title : WordPress Cvp-Adegrontec Themes 4.8.3 Remote Shell Upload Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/12/2018 Vendor Homepage : wordpress.org Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Version...

WordPress Firma Rehberi 4.9.9 Shell Upload / SQL Injection

Exploit Title : WordPress Firma Rehberi Themes 4.9.9 SQL Injection and Remote Shell Upload Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/12/2018 Vendor Homepage : wordpress.org temafabrika.com/demo/rehber3/ Software Download Link :...

WordPress Share-Buttons 4.9.9 Shell Upload

Exploit Title : WordPress Share-Buttons Plugins 4.9.9 Remote Shell Upload Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/12/2018 Vendor Homepage : wordpress.org sbuttons.ru Software Download Link : atwebresults.com/phpajaximageupload/ +...

CVE-2018-16627

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature...

CVE-2018-1000884

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password...

Design/Logic Flaw

PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. AdminVictim views user in admin-panel and gets...

CVE-2018-1000870

PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. AdminVictim views user in admin-panel and gets...

CVE-2018-1000870

PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. AdminVictim views user in admin-panel and gets...

CentOS Web Panel Cross-Site Scripting (CVE-2018-18774)

A cross-site scripting vulnerability exists in CentOS Web Panel. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

Baldr Botnet Panel Shell Upload Exploit

This module exploits an arbitrary file upload vulnerability within the Baldr stealer malware control panel when uploading victim log files which are uploaded as ZIP files. Attackers can turn this vulnerability into an RCE by first registering a new bot to the panel and then uploading a ZIP file...

Transcend Wi-Fi SD Card Cross-Site Request Forgery Vulnerability

The Transcend Wi-Fi SD Card is an SD card with wireless WI-FI capability. The Transcend Wi-Fi SD Card is vulnerable to cross-site request forgery. A remote attacker can exploit the vulnerability to gain access to the admin panel with default login and password for further CSRF attacks...

CVE-2018-17777

The CVE-2018-17777 entry describes a credential-bypass on D-Link DVA-5592 A1_WI_20180823 devices. If the Parental Control PIN on the page /ui/cbpc/login is the default 0000, an attacker can bypass the login form by editing the path of the cookie sid, gaining administrator access to the router con...

Transcend Wi-Fi SD Card Cross Site Request Forgery / Traversal Vulnerabilities

Transcend Wi-Fi SD Card 16GB with firmware 1.8 suffers from cross site request forgery and directory traversal vulnerabilities. There are Directory Traversal and Cross-Site Request Forgery vulnerabilities in Transcend Wi-Fi SD Card. ------------------------- Affected products:...

WordPress Ithemes-BackupBuddy Amazon WP-S3 2.9 Database Disclosure

Exploit Title : WordPress Ithemes-BackupBuddy Amazon WP-S3 Plugins 2.9 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 17/12/2018 Vendor Homepage : ithemes.com/purchase/backupbuddy/ wordpress.org/plugins/wp-s3/ Software Download Link :...

CVE-2018-19007

In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration in the Network Configuration panel is vulnerable to an OS system command injection as root...

CVE-2018-19007

The CVE-2018-19007 vulnerability affects Geutebrück GmbH E2 Camera Series before firmware 1.12.0.25. The issue is an OS command injection in the DDNS configuration (Network Configuration panel), allowing an attacker to execute commands as root. Impact is high (confidentiality, integrity, availabi...

WordPress JoeBooking 6.6.5 Database Disclosure

Exploit Title : WordPress JoeBooking Plugins 6.6.5 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : joebooking.com wordpress.org/plugins/joebooking/ Software Download Link :...

WordPress Wysija-Newsletters 2.10.2 Database Disclosure

Exploit Title : WordPress Wysija-Newsletters 2.10.2 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : mailpoet.com wordpress.org/plugins/wysija-newsletters/ Software Download Link :...