7896 matches found
openSIS Student Information System 8.0 - (multiple) SQL Injection Vulnerability
Exploit Title: openSIS Student Information System 8.0 - 'multiple' SQL Injection Date: 26/12/2021 Exploit Author: securityforeveryone.com Author Mail: helloATsecurityforeveryone.com Vendor Homepage: https://opensis.com Software Link: https://opensis.com Version: 8.0 Community Edition Tested on:...
openSIS Student Information System 8.0 - 'multiple' SQL Injection
Exploit Title: openSIS Student Information System 8.0 - 'multiple' SQL Injection Date: 26/12/2021 Exploit Author: securityforeveryone.com Author Mail: helloATsecurityforeveryone.com Vendor Homepage: https://opensis.com Software Link: https://opensis.com Version: 8.0 Community Edition Tested on:...
HTML Injection
dolibarr/dolibarr is vulnerable to HTML injection. If there is no canonical URL defined during setup, a malicious user can initiate a POST request with any domain name in the HOST header, allowing for arbitrary domains to be set for certain links...
The vulnerability of the FUN_80034d60 (/formStaticDHCP) function in the D-Link DIR-809 wireless router’s microprogramming software allows a attacker to execute any code on the target system.
The vulnerability of the FUN80034d60 /formStaticDHCP function of the D-Link DIR-809 wireless router is related to stack buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the system using a specially crafted POST request...
Orange Form <= 1.0 - SQL Injection via CSRF
In the plugin, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers...
Acronis: SQL injection in https://demor.adr.acronis.com/ via the username parameter
Vulnerability description not provided...
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
Title XSS in markdown link-maker Description While chatting with a client, both sides may use markdown. However, neither client's nor Chatwoot inner user's input is verified. Steps to reproduce. Note: this works in Safari and Firefox, not Chrome. I will use Telegram bot. 1. 1. Start a conversatio...
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Title Stored XSS in customattributes Description Relying on frontend URI check without verifying it on the backend allows to inject arbitrary JS code. Steps to reproduce 1. 1. Create a custom attribute, set its type to Link 2. 2. Navigate to any conversation, click on the right sidebar. 3. 3...
The vulnerability of the FUN_8004776c function (/formVirtualServ) of the D-Link DIR-809 wireless router allows a attacker to execute any code on the target system.
The vulnerability of the FUN8004776c function /formVirtualServ of the wireless router D-Link DIR-809 is related to stack buffer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the system through the created POST request...
The vulnerability of the LDAP filter in the Apache Traffic Control system, which is used to build CDN networks, allows attackers to execute arbitrary commands.
The vulnerability of the LDAP filter in the Apache Traffic Control system for building CDN networks exists because measures to neutralize specific elements have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by sending a...
The vulnerability of the sub_8003183C function (/fromLogin) in the wireless router software D-Link DIR-809 allows a hacker to execute arbitrary code on the target system.
The vulnerability of the FUN80034d60 /formStaticDHCP function of the D-Link DIR-809 wireless router is related to stack buffer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the system via the created POST request...
The vulnerability of the FUN_80040af8 function (/formWlanSetup) of the D-Link DIR-809 wireless router allows a attacker to execute any code on the target system.
The vulnerability of the FUN80040af8 /formWlanSetup function in the wireless router software from D-Link, the DIR-809, is related to stack buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code within the system using the created POST request...
The vulnerability of the FUN_8004776c function (/formVirtualApp) of the D-Link DIR-809 wireless router allows a attacker to execute arbitrary code on the target system.
The vulnerability of the FUN8004776c function /formVirtualApp of the wireless router D-Link DIR-809 is related to stack buffer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the system via the created POST request...
CuppaCMS Elevation of Privilege Vulnerability
CuppaCMS is a Content Management System CMS. An elevation of privilege vulnerability exists in CuppaCMS, which stems from a faulty programmatic call to a high-level native procedure. An authenticated attacker uses the usergroupidfield parameter to gain escalated privileges via a crafted POST...
CVE-2021-38244
A regular expression denial of service ReDoS vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json...
CVE-2021-38244
A regular expression denial of service ReDoS vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json...
CVE-2021-38244
A regular expression denial of service ReDoS vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json...
Denial of service
A regular expression denial of service ReDoS vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json...
