CVE-2017-14141

The wikidecode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...

Hiro: Information Disclosure

It looks like I can access notification panel of any user. https://forum.blockstack.org/u/username/notifications Just change the username with the desired username and you are redirected to their notification panel...

Cross-site Scripting (XSS)

craftcms/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly encode HTML in the control panel, allowing a malicious user to inject and execute arbitrary webscript...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly handle strings in the control panel, allowing a malicious user to inject and execute arbitrary web script...

SOA - School Management System 3.0 Shell Upload

======================================================== SOA - School Management System 3.0 - Arbitary file upload Description : attacker who has access to the administrative panel can upload arbitray file which may lead to total compromise of the web server Proof of Concept : -...

Gloom-Framework: Security Framework For Kali Linux

PenTestIT RSS Feed This short post is about a new penetration testing toolkit/framework in the market, which was specifically built for Kali Linux. The name is Gloom-Framework. It is coded in Python and is also open source with a few dependencies. What is Gloom-Framework? Gloom-Framework is an op...

Arris Modems Hardcoded Backdoor Vulnerability (CNVD-2017-24359)

Arris Modems are modems produced by telecom equipment manufacturer Arris, customized for AT&T home users for on-net access. A hard-coded backdoor vulnerability exists in Arris Modems, which have a built-in web server that allows an attacker to access the back-end administration panel through port...

Stored Cross-Site Scripting (XSS)

anchorcms/anchor-cms is susceptible to stored cross-site scripting XSS vulnerability. The vulnerability exists because user input to fields in admin panel are not properly escaped. Note: the fix introduced cannot prevent from DOM based XSS...

User Login and Management - Multiple Vulnerabilities

Exploit for php platform in category web applications ----------------------------------------------------------------------------------- | |---------------------------------------------------------------------------------- 1 admin dashboard authentication bypass Description : An Attackers are ab...

Invoice Manager 3.1 - Cross-Site Request Forgery (Add Admin)

Invoice Manager 3.1 - Cross-Site Request Forgery Add Admin ======================================================== Invoice Manager v3.1 Cross site request forgery Add Admin Description : Invoice Manager v3.1 is vulnerable to CSRF attack No CSRF token in place which if an admin user can be tricke...

Invoice Manager 3.1 - Cross-Site Request Forgery (Add Admin)

======================================================== Invoice Manager v3.1 Cross site request forgery Add Admin Description : Invoice Manager v3.1 is vulnerable to CSRF attack No CSRF token in place which if an admin user can be tricked to visit a crafted URL created by attacker via spear...

CVE-2017-10838

Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-10839

SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-10838

Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-10839

SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

Sql injection

SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

User Login and Management - Multiple Vulnerabilities

User Login and Management - Multiple Vulnerabilities ----------------------------------------------------------------------------------- | |---------------------------------------------------------------------------------- 1 admin dashboard authentication bypass Description : An Attackers are abl...

IceWarp Mail Server <= 10.4.4 XSS Vulnerability

IceWarp Mail Server is prone to a cross-site scripting XSS vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...

User Login and Management - Multiple Vulnerabilities

----------------------------------------------------------------------------------- | |---------------------------------------------------------------------------------- 1 admin dashboard authentication bypass Description : An Attackers are able to completely compromise the web application built...