PT-2021-18665

Name of the Vulnerable Software and Affected Versions Knowage Suite version 7.3 Description The issue concerns Stored Cross-Site Scripting XSS, where an attacker can inject arbitrary web script in the "/knowage/restful-services/signup/update" API endpoint via the surname parameter. This allows fo...

Knowage 注入漏洞

Knowage is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A security vulnerability exists in Knowage Suite version 7.3. The vulnerability stems from the program's tendency to store client templates in...

CVE-2021-30214: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter...

UPchieve: Hyper Link Injection while signup

Summary: Attacker can add their name to a URL in order to send email containing malicious hyperlinks. while signup Steps To Reproduce: 1-Go to https://app.upchieve.org and create account with the first name http://attacker.com/ and last name . 2-Now check your email and you notice there is...

Glovo: Server Side Template Injection on Name parameter during Sign Up process

Summary: Server-side template injection is when an attacker is able to use native template syntax to inject a malicious payload into a template, which is then executed server-side. In this scenario, when an attacker signs up on the platform and uses a payload in the First Name field, the payload ...

CVE-2020-21180

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page...

Sql injection

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page...

CVE-2020-21180

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page...

CVE-2020-21180

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page...

CVE-2020-21180

CVE-2020-21180 affects koa2-blog 1.0.0. It is a SQL injection vulnerability that enables remote attackers to inject SQL statements via the name parameter on the signup page. NVD lists CVSS v3.1 base score 9.8 (CRITICAL; NETWORK, LOW interaction, no privileges) and CVSS v2 base score 7.5 (HIGH). N...

PT-2021-10602

Name of the Vulnerable Software and Affected Versions: koa2-blog version 1.0.0 Description: The issue allows remote attackers to inject malicious SQL statements via the name parameter to the signup page. This can be exploited by injecting a malicious SQL statement. Recommendations: For koa2-blog...

CVE-2020-21180: Improper Neutralization of Special Elements used in an SQL Command

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page...

CVE-2020-29159

An issue was discovered in Zammad before 3.5.1. The default signup Role for newly created Users can be a privileged Role, if configured by an admin. This behvaior was unintended...

Design/Logic Flaw

An issue was discovered in Zammad before 3.5.1. The default signup Role for newly created Users can be a privileged Role, if configured by an admin. This behvaior was unintended...

CVE-2020-29159

An issue was discovered in Zammad before 3.5.1. The default signup Role for newly created Users can be a privileged Role, if configured by an admin. This behvaior was unintended...

CVE-2020-29159

An issue was discovered in Zammad before 3.5.1. The default signup Role for newly created Users can be a privileged Role, if configured by an admin. This behvaior was unintended...

CVE-2020-29159: Undefined Security Weakness

An issue was discovered in Zammad before 3.5.1. The default signup Role for newly created Users can be a privileged Role, if configured by an admin. This behvaior was unintended...

PT-2020-17103

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.5.1 Description An issue was discovered where the default signup Role for newly created Users can be a privileged Role if configured by an admin, which was unintended. Recommendations For versions prior to 3.5.1,...

h1-ctf: Grinch Networks compromised!

Grinch Networks compromised! For fast triage/validation and inspired by @manoelt in other CTF, I made a bash script to find and print all the 12 flags of this CTF. The script uses curl, wget, google-chrome headless for flag 2, unzip, grep and sed. If any of these commands is missing, the script...

CVE-2020-35676

BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute upon the application's administrator browsing the registered users' list. Once...