1258 matches found
WordPress Popup Builder Plugin < 4.1.1 SQLi Vulnerability
The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
Fingerprint Attendance 1.0 SQL Injection Vulnerability
Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce Author: Hejap Zairy Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache Steps 1...
5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi
Description The plugin does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtnggdeleteleads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using...
Pay Slip PDF Generator System 1.0 SQL Injection Vulnerability
Pay Slip PDF Generator System version suffers from multiple remote SQL injection vulnerabilities that can lead to remote code execution. Title: Pay Slip PDF Generator System 1.0 Blind time SQLi To Rce Author: Hejap Zairy Vendor:...
Fingerprint Attendance 1.0 SQL Injection
Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce Author: Hejap Zairy Date: 28.07.2022 Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQ...
API Security Explained
As enterprises continue on their digital journeys, security teams are preparing for the good, the bad, and the ugly of APIs. We’ll explain in plain language what APIs do, how they are attacked, and how API security works either as a stand-alone solution or with Web Application Firewalls and DDoS...
Covid-19 Directory On Vaccination System 1.0 SQL Injection
Exploit Title: Covid-19 Directory on Vaccination System 1.0 - SQLi Authentication Bypass Date: 28/03/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
Pay Slip PDF Generator System 1.0 SQL Injection
Title: Pay Slip PDF Generator System 1.0 Blind time SQLi To Rce Author: Hejap Zairy Date: 26.07.2022 Vendor: https://www.sourcecodester.com/php/15242/employees-pay-slip-pdf-generator-system-email-using-phpoop-free-source-code.html Software:...
Sports Complex Booking System 1.0 SQL Injection Vulnerability
Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability that can be used to escalate privileges and execute code. Title: Sports Complex Booking System 1.0 Blind SQLi To Rce Author: Hejap Zairy Vendor:...
Sports Complex Booking System 1.0 SQL Injection
Title: Sports Complex Booking System 1.0 Blind SQLi To Rce Author: Hejap Zairy Date: 24.07.2022 Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html Software:...
CVE-2021-43735
CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule...
CVE-2021-43735
CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule...
CVE-2021-43735
CmsWing 1.3.7 is affected by a SQL injection vulnerability in the behavior rule parameter. The root cause is insufficient escaping/ filtering of SQL data in these parameters, allowing potential unauthorized SQL execution. Impact is described as exposing or altering database data (high severity pe...
Inventory Management System 1.0 SQL Injection Vulnerability
Title: Inventory Management System 1.0 Blind SQLi To Rce Author: Hejap Zairy Vendor: https://www.vetbossel.in/inventory-management-system-php/ Software: https://cutt.ly/lOZ8lrr Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache vulnerability Code php php You have an error...
Inventory Management System 1.0 SQL Injection
Title: Inventory Management System 1.0 Blind SQLi To Rce Author: Hejap Zairy Date: 12.07.2022 Vendor: https://www.vetbossel.in/inventory-management-system-php/ Software: https://cutt.ly/lOZ8lrr Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache vulnerability Code php php...
Home Owners Collection Management System 1.0 SQL Injection
Exploit Title: Home Owners Collection Management System 1.0 - Remote Code Execution Blind SQLi to RCE Date: 9/03/2022 Exploit Author: Hejap Zairy Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
CVE-2022-25607
FV Flowplayer Video Player WordPress plugin (versions ≤ 7.5.15.727) is affected by an authenticated SQL Injection vulnerability due to insufficient input validation. The vulnerability affects the plugin when used with WordPress; impact is partial to high across confidentiality, integrity, and ava...
SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi
The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users Create a new email petition /wp-admin/admin.php?page=dkspeakoutaddnew, check x Do not send email onl...
Metasploit Weekly Wrap-Up
This week’s Metasploit Framework release brings us seven new modules. IP Camera Exploitation Rapid7’s Jacob Baines was busy this week with two exploit modules that target IP cameras. The first module exploits an authenticated file upload on Axis IP cameras. Due to lack of proper sanitization, an...
NotificationX < 2.3.12 - Unauthenticated SQLi
The plugin does not validate and escape the id parameter in its notificationx/v1/notification REST endpoint before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL Injection attacks. PoC The apikey is the md5 of the homeurl either with http or https protocol...