Smart SMS And Email Manager 3.3 SQL Injection

Exploit Title: Smart SMS & Email Manager v3.3 - SQL Injection Google Dork: N/A Date: 17.07.2018 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor Homepage: https://codecanyon.net/item/smart-sms-email-manager-ssem/14817919 Version: 3.3 Tested on: Kali linux...

FTP2FTP 1.0 - Arbitrary File Download

Exploit Title: FTP2FTP 1.0 - Arbitrary File Download Dork: N/A Date: 18.07.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395 Version: 1.0 Category: Webapps Tested on: Kali linux Description : The...

philipsecurity.com XSS vulnerability

Open Bug Bounty ID: OBB-649114 Description| Value ---|--- Affected Website:| philipsecurity.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Jirafeau Cross-Site Request Forgery Vulnerability (CNVD-2018-13352)

Jirafeau is a file sharing website system. A cross-site request forgery vulnerability exists in the delete file feature of the admin panel in versions of Jirafeau prior to 3.4.1. A remote attacker can exploit this vulnerability to force an administrator to delete files uploaded by other users via...

ABB Panel Builder 800

1. EXECUTIVE SUMMARY CVSS v3 7.0 Vendor: ABB Equipment: Panel Builder 800 Vulnerability: Improper Input Validation 2. RISK EVALUATION An attacker could exploit the vulnerability by tricking a user to open a specially crafted file, allowing the attacker to insert and run arbitrary code. This...

CVE-2018-14069

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add...

Authentication flaw

Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel...

CVE-2016-9482 PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass

Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel...

CVE-2018-13850

The "Firebase Cloud Messaging FCM + Advance Admin Panel" component supporting Firebase Push Notification on iOS through 2017-10-26 allows SQL injection via the /advancepush/public/login username parameter...

Jirafeau Cross-Site Request Forgery Vulnerability

Jirafeau is a file sharing website system. A cross-site request forgery vulnerability exists in the administration panel in Jirafeau versions prior to 3.4.1. A remote attacker can exploit this vulnerability to force an administrator to perform a file lookup operation and perform a cross-site...

CSRF vulnerability in the admin panel

More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...

CSRF vulnerability in the admin panel

More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...

CVE-2018-11349

The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: searchbyname, searchbyhash, and searchlink...

CVE-2018-11349

The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: searchbyname, searchbyhash, and searchlink...

CVE-2018-11349

The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: searchbyname, searchbyhash, and searchlink...

CVE-2018-13407

A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused...

CVE-2018-13407

A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused...

CVE-2018-13407

The CVE-2018-13407 entry describes a CSRF vulnerability in Jirafeau before version 3.4.1 where the admin panel’s “delete file” function is not protected against automated requests, enabling potential abuse. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, OSV, etc.), all alignin...

Stellar.org: Admin panel of https://www.stellar.org/wp-admin/

https://www.stellar.org/wp-admin/ link has various operations which should not be accessible to an anonymous user. As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password. on the other side server information is easily...

Microsoft Windows: Always install with elevated privileges

This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system. If you enable this policy setting, privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user offered on the...