13009 matches found
CVE-2018-13351
TerraMaster TOS 3.1.03 Control Panel contains a cross-site scripting vulnerability that allows attackers to execute JavaScript through the edit password form. The provided documents do not specify the vulnerable component version beyond 3.1.03, nor any patched remediation or available exploit det...
CVE-2018-13331
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames...
CVE-2018-13351
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form...
CVE-2018-13335
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions...
CVE-2018-13331
CVE-2018-13331 affects TerraMaster TOS (Control Panel) with version 3.1.03. The vulnerability is a cross-site scripting flaw that lets an attacker cause JavaScript execution by placing script code in usernames when viewing user pages. This is described in multiple sources referencing the TerraMas...
CVE-2018-13357
CVE-2018-13357 is an XSS in TerraMaster TOS 3.1.03. The vulnerability lies in the Control Panel where JavaScript can be executed when viewing Shared Folders, via the names of Shared Folders. Affected product/component: TerraMaster TOS Control Panel / Shared Folders naming. Impact: attacker can in...
CVE-2018-19562
An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...
CVE-2018-19547
JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...
Debian DLA-1593-1 : phpbb3 security update
Simon Scannell and Robin Peraglie of RIPS Technologies discovered that passing an absolute path to a fileexists check in phpBB, a full featured web forum, allows remote code execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel...
WordPress Pods 2.7.9 Database Disclosure Vulnerability
WordPress Pods plugin version 2.7.9 suffers from a database disclosure vulnerability. Exploit Title : WordPress Pods Plugins 2.7.9 Database Backup Arbitrary File Download Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Vendor Homepage : +...
WordPress Universal Post Manager 1.5.0 Database Disclosure Vulnerability
WordPress Universal Post Manager plugin version 1.5.0 suffers from a database disclosure vulnerability. Exploit Title : WordPress universal-post-manager 1.5.0 Plugins Database Backup Information Disclosure Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army...
Joomla MacGallery Database Disclosure Vulnerability
The Joomla commacgallery component suffers from a database disclosure vulnerability. Exploit Title : Joomla commacgallery Components Apptha Install-Uninstall Database Backup Information Disclosure Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Vendor...
CVE-2018-19457
Logicspice FAQ Script 2.9.7 allows uploading arbitrary files, which leads to remote command execution via admin/faqs/faqimages with a .php file...
WordPress Absolutely Glamorous Custom Admin 6.4.1 Database Disclosure
Exploit Title : WordPress Absolutely Glamorous Custom Admin ag-custom-admin Plugin Database Backup Arbitrary File Download Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 19/11/2018 Vendor Homepage : wordpress.org Tested On : Windows and Linux Catego...
WordPress Universal Post Manager 1.5.0 Database Disclosure
Exploit Title : WordPress universal-post-manager 1.5.0 Plugins Database Backup Information Disclosure Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 22/11/2018 Vendor Homepage : wordpress.org/support/plugin/universal-post-manager/...
Joomla MacGallery Database Disclosure
Exploit Title : Joomla commacgallery Components Apptha Install-Uninstall Database Backup Information Disclosure Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 19/11/2018 Vendor Homepage : joomla.org...
Subrion CMS Arbitrary PHP Code Execution Vulnerability
Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A security vulnerability exists in /panel/uploads in Subrion CMS version 4.2.1, which stems from the failu...
CVE-2018-18772
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=sendssh, as demonstrated by executing an arbitrary OS command...