Nextar C472 POS DLL Hijacking

/ Description: A vulnerability exists in windows that allows other applications dynamic link libraries to execute malicious code without the users consent, in the privelage context of the targeted application. Exploit Title: Nextar C472 POS DLL Hijacking Exploit nxmm.dll - mdmdregistration.dll...

CVE-2021-41492

Concretely, CVE-2021-41492 affects Sourcecodester Simple Cashiering System (POS) v1.0. It has SQL injection vulnerabilities in three vectors: (1) Product Code on the POS page, (2) the id parameter in manage_products, and (3) the t parameter in actions.php. The root cause is lack of input filterin...

CVE-2021-41492

Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System POS 1.0 via the 1 Product Code in the pos page in cashiering. 2 id parameter in manageproducts and the 3 t paramater in actions.php...

CVE-2021-41492: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System POS 1.0 via the 1 Product Code in the pos page in cashiering. 2 id parameter in manageproducts and the 3 t paramater in actions.php...

Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)

Exploit Title: Ultimate POS 4.4 - 'name' Cross-Site Scripting XSS Date: 2021-10-26 Exploit Author: Vulnerability Lab Vendor Homepage: https://ultimatefosters.com/docs/ultimatepos/ Version: 4.4 Document Title: =============== Ultimate POS v4.4 - Products Persistent XSS Vulnerability References...

Ultimate POS 4.4 - (name) Cross-Site Scripting Vulnerability

Exploit Title: Ultimate POS 4.4 - 'name' Cross-Site Scripting XSS Vendor Homepage: https://ultimatefosters.com/docs/ultimatepos/ Version: 4.4 Product & Service Introduction: =============================== The Ultimate POS is a erp, stock management, point of sale & invoicing web-application. The...

pos-mail.de Improper Access Control vulnerability OBB-2225042

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-41676

CVE-2021-41676 is tied to the oretnom23 Pharmacy Point of Sale System 1.0, with a reported SQL Injection in the login function (actions.php). The Red Hat and NVD entries corroborate the vulnerability in the same component/function, indicating a high/critical impact profile. Public details in conn...

Pharmacy Point Of Sale System SQL注入漏洞

Pharmacy Point Of Sale System is a web-based application by Carlo Montero, an individual developer. It is used to help a pharmacy manage its sales transactions. A SQL injection vulnerability exists in oretnom23 Pharmacy Point of Sale System version 1.0, which allows an attacker to perform SQL...

Ultimate POS 4.4 Cross Site Scripting

Document Title: =============== Ultimate POS v4.4 - Products Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2296 Release Date: ============= 2021-10-26 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2021-42765

The Proof-of-Stake PoS Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service indefinite stalling of consensus decisions...

Design/Logic Flaw

The Proof-of-Stake PoS Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service long-range consensus chain reorganizations, even when this adversary has little stake and cannot influence network message propagation. This can cause a protocol stall, or an...

CVE-2021-42765

Technical details about CVE-2021-42765 are not publicly available in the provided documents; monitor for updates.

CVE-2021-42766

The Proof-of-Stake PoS Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service long-range consensus chain reorganizations, even when this adversary has little stake and cannot influence network message propagation. This can cause a protocol stall, or an...

CVE-2021-42766

Technical details (affected products, root cause, specific versions, fixes) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2021-42765: Undefined Security Weakness

The Proof-of-Stake PoS Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service indefinite stalling of consensus decisions...

Cross-Site Request Forgery (CSRF) in opensourcepos/opensourcepos

Description You have not set any CSRF protection for receivings/deleteitem/itemid endpoint. Proof of Concept //PoC.html history.pushState'', '', '/'...

Cross-Site Request Forgery (CSRF) in opensourcepos/opensourcepos

Description Attacker able to delete supplier with CSRF attack Proof of Concept //PoC.html history.pushState'', '', '/'...

FIN7 Hackers Using Windows 11 Themed Documents to Drop Javascript Backdoor

A recent wave of spear-phishing campaigns leveraged weaponized Windows 11 Alpha-themed Word documents with Visual Basic macros to drop malicious payloads, including a JavaScript implant, against a point-of-sale PoS service provider located in the U.S. The attacks, which are believed to have taken...

Researchers Uncover FIN8's New Backdoor Targeting Financial Institutions

A financially motivated threat actor notorious for setting its sights on retail, hospitality, and entertainment industries has been observed deploying a completely new backdoor on infected systems, indicating the operators are continuously retooling their malware arsenal to avoid detection and st...