7896 matches found
CVE-2022-24813
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the master branch of CreateWiki's GitHub repository...
Exploit for Code Injection in Vmware Spring_Framework
Spring4Shell - CVE-2022-22965 Build - let's clone the repo...
SQL Injection in Dolibarr
An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 fixed version is 14.0.0 via a POST request to the countryid parameter in an UPDATE statement...
Sql injection
An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 fixed version is 14.0.0 via a POST request to the countryid parameter in an UPDATE statement...
CVE-2021-36625
An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 fixed version is 14.0.0 via a POST request to the countryid parameter in an UPDATE statement...
Exploit for Code Injection in Vmware Spring_Framework
Spring Framework RCE exploitation Quick pentest notes...
Jenkins JiraTestResultReporter Plugin跨站请求伪造漏洞
Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier versions are vulnerable to cross-site request forgery, which stems from a...
ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation
The plugin does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website fetch"/wp-admin/admin-ajax.php", "headers":...
Fingerprint Attendance 1.0 Account Takeover Vulnerability
Title: Fingerprint Attendance 1.0 Account Takeover Author: Hejap Zairy Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache Fingerprint...
Fingerprint Attendance 1.0 Account Takeover
Title: Fingerprint Attendance 1.0 Account Takeover Author: Hejap Zairy Date: 29.07.2022 Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache...
CVE-2022-26258
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution RCE vulnerability via HTTP POST to get set ccp...
IBM ISS BlackICE PC 安全漏洞
IBM ISS BlackICE PC is a personal firewall/IDS for Windows desktops from International Business Machines IBM. A security vulnerability exists in IBM ISS BlackICE PC Protection that stems from Cross Site Scripting Detection causing an elevation of privilege when processing operations that are part...
CVE-2022-25523
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...
CVE-2022-25523
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...
Cross site request forgery (csrf)
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...
CVE-2022-25523
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...
CVE-2022-25523
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...
Safe SVG < 1.9.10 - SVG Sanitisation Bypass
The sanitisation step of the plugin can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent mainly XSS, but depending on further use of uploaded SVG...
Typesetter 跨站请求伪造漏洞
Typesetter is a content management system CMS. A security vulnerability exists in TypesetterCMS v5.1, which can be exploited via a crafted POST request...
phpMyAdmin Remote Code Execution Vulnerability
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file...