13022 matches found
CVE-2017-17941
PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter...
PHP Scripts Mall Single Theater Booking Cross-Site Request Forgery Vulnerability
PHP Scripts Mall Single Theater Booking is an open source theater script. A cross-site request forgery vulnerability exists in PHP Scripts Mall Single Theater Booking. A remote attacker can use the admin/sitesettings.php file to change sensitive settings on the user panel, or even inject web scri...
CVE-2017-17930
PHP Scripts Mall Professional Service Script has CSRF via admin/generalsettingupd.php, as demonstrated by modifying a setting in the user panel...
CVE-2017-17903
FS Lynda Clone has CSRF via user/editprofile, as demonstrated by adding content to the user panel...
Cross site request forgery (csrf)
PHP Scripts Mall Professional Service Script has CSRF via admin/generalsettingupd.php, as demonstrated by modifying a setting in the user panel...
Cross site request forgery (csrf)
FS Lynda Clone has CSRF via user/editprofile, as demonstrated by adding content to the user panel...
Automattic: Stored XSS in www.learnboost.com via ZIP codes.
Summary --- www.learnboost.com is vulnerable to stored XSS via ZIP codes stored alongside school names in the Network panel. Browsers Verified In --- Mozilla Firefox 58.0b12 64-bit PoC --- Visit https://www.learnboost.com/settings/network/search and search for fro. My entry will trigger the XSS...
CVE-2017-17930
The affected software is PHP Scripts Mall Professional Service Script. It contains a Cross-Site Request Forgery (CSRF) vulnerability exploitable via admin/general_settingupd.php, demonstrated by changing a setting in the user panel. The root cause and specific impact details are described across ...
CVE-2017-17827
Piwigo 2.9.2 is vulnerable to Cross‑Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions. The connected records consistently describe this CSRF issue ...
Authentication flaw
Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter...
CVE-2017-17777
Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter...
CVE-2017-17777
Paid To Read Script 2.0.5 contains an authentication bypass in the admin panel that can be triggered by direct requests. The vulnerability is demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter, enabling bypass of login/auth checks and potential unaut...
CVE-2017-17777
Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter...
Paid To Read Script Authentication Bypass Vulnerability
PHP Scripts Mall Paid To Read Script is a set of paid to read website scripts by PHP Scripts Mall India. A security vulnerability exists in PHP Scripts Mall Paid To Read Script version 2.0.5. An attacker can exploit the vulnerability by sending a direct request to bypass authentication and access...
Techno - Portfolio Management Panel Access Control Vulnerability
Techno - Portfolio Management Panel is a set of portfolio management panel scripts. An access control vulnerability exists in Techno - Portfolio Management Panel on 2017-11-16 and prior versions, which stems from the program failing to detect if a panel/portfolio.php?action=delete request is...
Techno - Portfolio Management Panel SQL Injection Vulnerability
Techno - Portfolio Management Panel is a set of portfolio management panel scripts. A SQL injection vulnerability exists in Techno - Portfolio Management Panel 2017-11-16 and earlier versions. A remote attacker can exploit the vulnerability by sending the 's' parameter to the panel/search.php fil...
Techno - Portfolio Management Panel Information Disclosure Vulnerability
Techno - Portfolio Management Panel is a set of portfolio management panel scripts. An information disclosure vulnerability exists in Techno - Portfolio Management Panel 2017-11-16 and earlier versions. An attacker can exploit the vulnerability by sending an invalid 's' parameter to the...
Techno - Portfolio Management Panel Cross-Site Scripting Vulnerability
Techno - Portfolio Management Panel is a set of portfolio management panel scripts. A cross-site scripting vulnerability exists in Techno - Portfolio Management Panel 2017-11-16 and earlier versions. A remote attacker can exploit the vulnerability by sending the 's' parameter to the...