Wedding Wonders 1.0 Cross Site Scripting

Exploit Title: Wedding Wonders 1.0 - Stored XSS Exploit Author: CraCkEr Date: 13/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/wedding-wonders-a-matrimonial-and-matchmaking-platform/17 Tested on: Windows 10 Pro Impact: Manipulate t...

EX-RATE 1.0 Cross Site Scripting

Exploit Title: EX-RATE 1.0 - Stored XSS Exploit Author: CraCkEr Date: 14/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/ex-rate-a-complete-money-exchange-solution/14 Tested on: Windows 10 Pro Impact: Manipulate the content of the si...

Pending owner can be the wrong recipient of ownership

Lines of code Vulnerability details Impact An attacker can call the acceptOwnership function with their address as the pending owner before the legitimate pending owner has a chance to call the function Proof of Concept The transferOwnership function allows the current owner to set a pending owne...

Arbitrary Pending _setPendingVetoer Address Assignment.

Lines of code Vulnerability details Impact If an attacker successfully impersonates the vetoer, they can set any address as the pending vetoer. This can compromise the integrity of the vetoer role and enable unauthorized access or control over certain functions or actions within the contract. Pro...

WordPress Plugin Galleria 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

Missing deadline checks allow pending transactions to be maliciously executed

Lines of code Vulnerability details Impact In PoolActions.sol, swapToEqualAmounts function has no deadline check for the transaction when swapping. File: src/talos/libraries/PoolActions.sol function swapToEqualAmountsActionParams memory actionParams, int24 baseThreshold internal bool zeroForOne,...

Car Rental Script 1.8 - Stored Cross-site scripting Vulnerability

Exploit Title: Car Rental Script 1.8 - Stored Cross-site scripting XSS Exploit Author: CraCkEr Vendor: GZ Scripts Vendor Homepage: https://gzscripts.com/ Software Link: https://gzscripts.com/car-rental-php-script.html Version: 1.8 Tested on: Windows 10 Pro Impact: Manipulate the content of the si...

GHSA-G98V-HV3F-HCFR atty potential unaligned read

On windows, atty dereferences a potentially unaligned pointer. In practice however, the pointer won't be unaligned unless a custom global allocator is used. In particular, the System allocator on windows uses HeapAlloc, which guarantees a large enough alignment. atty is Unmaintained A Pull Reques...

Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

CVE-2023-3485

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

CVE-2023-3485 Insecure Default Authorization in Temporal Server

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

CVE-2023-3485 Insecure Default Authorization in Temporal Server

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

Time Slot Booking Calendar 1.8 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

GZ Hotel Booking Script 1.8 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

Availability Booking Calendar 1.8 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

GZ Appointment Scheduling 1.8 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

PT-2023-24975 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: Eyoucms version 1.6.2 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the web recordnum parameter. This enables attackers to potentially...

PT-2023-23998 · Unknown · Phpgurukul Rail Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Rail Pass Management System version 1.0 Description: A critical vulnerability was found in the PHPGurukul Rail Pass Management System. The issue affects an unknown functionality of the file /view-pass-detail.php, specifically the...

PT-2023-22559 · Prestashop · Prestashop Leocustomajax

Name of the Vulnerable Software and Affected Versions: PrestaShop leocustomajax version 1.0 PrestaShop leocustomajax version 1.0.0 Description: The issue is related to SQL Injection. It affects the module via the "modules/leocustomajax/leoajax.php" endpoint. Recommendations: For PrestaShop...

PT-2023-25002 · Bloofox · Bloofox

Name of the Vulnerable Software and Affected Versions: bloofox version 0.5.2.1 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the cid parameter at the "admin/index.php?mode=settings&page=charset&action=edit" endpoint. Recommendations: For bloofox versi...