E-Sic Software livre CMS - 'cpfcnpj' SQL Injection

Exploit Title: E-Sic Software livre CMS - Sql Injection Date: 12/10/2017 Exploit Author: Elber Tavares fireshellsecurity.team/ Vendor Homepage: https://softwarepublico.gov.br/ Version: 1.0 Tested on: kali linux, windows 7, 8.1, 10 - Firefox Download:...

Magento Information Disclosure Vulnerability

Magento is an open source PHP e-commerce system from Magento Inc. that provides rights management, search engine, and payment gateway.Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. An information disclosure vulnerability exists in Magen...

Arbitrary Account Password Reset Vulnerability in OnStar iOS Client Server

OnStar iOS client is a smart driving system. An arbitrary account password reset vulnerability exists in the OnStar iOS client server. An attacker can reset the password of any client and perform unauthorized operations by intercepting the verification code in a packet...

Arbitrary Account Registration and Password Reset Vulnerabilities in Tea Merchant APP

Tea Merchant APP is a software specialized in serving tea merchants. Tea Merchant APP has arbitrary account registration and password reset vulnerabilities. Attackers can register any account and reset any password by capturing packets and bursting the verification code...

Arbitrary Account Registration and Arbitrary Password Reset Vulnerability in Skin Beauty With Heart APP

Beauty with a Purpose App is a skincare app that allows you to test your skin type and learn more about skincare. There is an arbitrary account registration and arbitrary password reset vulnerability in Skin Care APP. Attackers can register any account and reset any password by capturing packets...

Multiple Vulnerabilities in the Magic Fly Broker App

Magic Fly Broker App is a mobile listing management software designed to help brokers increase orders. There are arbitrary user login and arbitrary password reset vulnerabilities in MagicFly Broker APP. Attackers can register any account and reset any password by capturing packets and interceptin...

Parent Helper App Has Multiple Vulnerabilities

Parent's Helper APP is a mobile home-school communication software developed by Beijing Aopeng Distance Education Center Co. The Parent's Helper APP is vulnerable to arbitrary user registration and arbitrary password reset. An attacker can register any account and reset any password by capturing...

Honey Raccoon Live App has multiple vulnerabilities

Honey Raccoon Live App is a live streaming platform for real people. There are arbitrary user registration and arbitrary password reset vulnerabilities in Honey Raccoon Live APP. Attackers can register any account and reset any password by grabbing packets to get the verification code...

Any Account Registration and Any Password Reset Vulnerabilities Exist in Anxiety Companion App

Anxious companion APP is a companion O2O service platform. There are arbitrary account registration and arbitrary password reset vulnerabilities in Anxin escort APP. Attackers can register any account and reset any password by capturing the verification code...

Best Clinical Practice App Has Arbitrary Registration Account and Arbitrary Password Reset Vulnerabilities

The Best Clinical Practice App is an application designed to provide medical practitioners with knowledge of diagnosis and treatment during clinical practice and learning. The Best Clinical Practice APP is vulnerable to arbitrary account registration and arbitrary password reset. An attacker can...

Multiple Vulnerabilities in Photo Composer App

Picture Synthesizer APP is a picture synthesizer mobile software. Picture Synthesizer APP has arbitrary account registration and arbitrary password reset vulnerabilities. An attacker can register any account and reset any password by grabbing packets to get the verification code...

Logic design flaws in DXN Global App

Dresdner Global App is a shopping software. There is a logical design vulnerability in the DXGlobal APP. An attacker can register any account, reset any password and change the payment amount by obtaining the verification code...

Bumper to bumper shopping app has a logic design flaw

Bumper to Bumper App is an online shopping application. There is a logic design vulnerability in BumperBuy APP. Attackers can register any account, reset any password, insert malicious js code in the personal information page, obtain user cookies and other information through packet bursting...

Dual Opening Assistant App has a logical design flaw

Double Open Assistant APP is a game assistance application. There is a logical design vulnerability in Dual Open Assistant APP. Attackers can arbitrarily register users and reset arbitrary passwords by capturing packets to obtain verification codes...

EYEE Beehive App Has Logic Design Flaws

EYEE Bee Tide App is an online shopping app. There is a logical design vulnerability in EYEE Beehive APP. An attacker can register any account and reset any password by grabbing packets and bursting the verification code...

WakaTime: password token validation

Hello, when I reset password all tokens are valid can be used, should keep valid only token in the last request or you can invalidate all reset links after using one of the requests successfully. Steps: 1 go to the password reset page and request more than one request. 2 go to your email and use...

Apache OpenMeetings < 3.1.1 Multiple Vulnerabilities

Apache OpenMeetings is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:openmeetings";...

Automattic: Invalidate session after password reset on https://polldaddy.com

Hi there, I found broken session bug on your website.Your website is unable to validate the session.That may lead takeover victims account. Reproduce: 1.Go to https://polldaddy.com and log into your account from two different browsers. 2.Now change password from any browser you already logged in...

NPM-V (Network Power Manager) 2.4.1 - Password Reset Vulnerability

Exploit for hardware platform in category web applications NPM-VNetwork Power Manager = 2.4.1 Reset Password Vulnerability Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: NPM-V Affected Version : 2.4.1 and below Vendor : http://www.china-clever.com Product Link :...

NPM-V (Network Power Manager) 2.4.1 - Password Reset

NPM-VNetwork Power Manager = 2.4.1 Reset Password Vulnerability Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: NPM-V Affected Version : 2.4.1 and below Vendor : http://www.china-clever.com Product Link : http://www.china-clever.com/en/index.php/product?view=products&cid=125 Date:...