181 matches found
CVE-2019-17297: Improper Neutralization of Special Elements used in an SQL Command
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user...
CVE-2019-17316: Improperly Controlled Modification of Object Prototype Attributes
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user...
CVE-2019-17294: Improper Neutralization of Special Elements used in an SQL Command
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user...
CVE-2019-17308: Improper Control of Generation of Code
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user...
Cross site scripting
Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low...
CVE-2019-10049: Improper Neutralization of Input During Web Page Generation
It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code that is executed in the context of the victim use...
CVE-2018-13341
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execut...
Splinterware System Scheduler Pro 5.12 - Privilege Escalation
Exploit Title: Splinterware System Scheduler Pro 5.12 - Privilege Escalation Exploit Author: bzyo Twitter: @bzyo Date: 2018-07-21 Vulnerable Software: System Scheduler Pro 5.12 Vendor Homepage: https://www.splinterware.com Version: 5.12 Tested Windows 7 SP1 x86 CVE: N/A Description: Splinterware...
CVE-2018-1354
An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regular user edit the avatar picture of other users with arbitrary content...
CVE-2018-12559
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp mpOk is insufficient. A regular user can consequently mount a CIFS filesystem anywhere e.g., outside of the /home directory tree by passing directory traversal sequenc...
New Relic: User to Admin privilege escalation in Infrastructure Conditions - /v2/accounts/1835740/alerts/conditions
Details The endpoints POST /v2/accounts/:accountid/alerts/conditions create new and PUT /v2/accounts/:accountid/alerts/conditions/:conditionid update existing on infrastructure-alert.service.newrelic.com are vulnerable to privilege escalation. As per the screenshot below, an account with regular...
CVE-2017-9674
In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?returnurl=XSS exploitable as a regular or admin user...
CVE-2017-9674: Improper Neutralization of Input During Web Page Generation
In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?returnurl=XSS exploitable as a regular or admin user...
Multiple Cross-Site Request Forgery Vulnerabilities in Simple Invoices
Simple Invoices is an open source, free web-based invoicing system. Three cross-site request forgery vulnerabilities exist in Simple Invoices version 2013.1.beta.8. A remote attacker can use these vulnerabilities to create a new administrator user account and take control of the entire applicatio...
Gram Post 1.0 - SQL Injection
Exploit Title: Gram Post - Instagram Auto Post Multi Accounts with Paypal integration v1.0 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://vtcreators.com/ Software Buy:...
Collabo - Arbitrary File Download
Exploit Title: Collabo - TeamBusiness Collaboration Network - Arbitrary File Download Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://321-internet.com/ Software Buy: https://codecanyon.net/item/collabo-teambusiness-collaboration-network/15242543 Demo:...
CubeCart 6.0.10 - Multiple Vulnerabilities
Exploit for php platform in category web applications Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16, 2016 Publ...
PHP-Nuke SPChat SQL Injection
Owner : Pr0T3cT10n Script site : http://www.phpnuke.org Script name : PHP-Nuke moduleSPChat Version : All Type : SQL Injection D0rk : inurl:name=SPChat Description : Pull out user details from the database Vuln : http://www.example.com/modules.php?op=modload&name=SPChat&file=chooser&youruid=SQL...
PHP-Nuke module (SPChat) - SQL Injection
Owner : Pr0T3cT10n Script site : http://www.phpnuke.org Script name : PHP-Nuke moduleSPChat Version : All Type : SQL Injection D0rk : inurl:name=SPChat Description : Pull out user details from the database Vuln : http://www.example.com/modules.php?op=modload&name=SPChat&file=chooser&youruid=SQL...
