5442 matches found
SugarCRM WorkFlow PHP Code Injection Vulnerability
SugarCRM versions prior to 7.9.4.0 and 7.11.0.0 suffer from a PHP code injection vulnerability in the WorkFlow module. User input passed through the $POST'basemodule' parameter to the "Save" action of the WorkFlow module is not properly sanitized before being used to write data into the...
SugarCRM (WorkFlow module) PHP Code Injection Vulnerability
SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A PHP code...
CVE-2018-20166: Unrestricted Upload of File with Dangerous Type
A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed...
Craft CMS 3.0.25 - Cross-Site Scripting
Craft CMS 3.0.25 - Cross-Site Scripting Exploit Title: Craft CMS 3.0.25 - Cross-Site Scripting Google Dork: N/A Date: 2018-12-20 Exploit Author: Raif Berkay Dincel Contact: www.raifberkaydincel.com More Details 1 :...
PT-2018-15411
Name of the Vulnerable Software and Affected Versions 74cms version 4.2.111 Description An issue in 74cms allows remote authenticated users to read or modify arbitrary resumes. This is achieved by changing a job-search intention, specifically through the "index.php?c=Personal&a=ajax save basic"...
Cross site scripting
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...
CVE-2018-20418
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...
CVE-2018-20418
CVE-2018-20418 affects Craft CMS, version 3.0.25. The vulnerability is a cross-site scripting (XSS) flaw in the handling of the title during saving through the admin action endpoint: http://…/admin/actions/entries/save-entry. Saving a new title from the console tab is reported to enable XSS. The ...
Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-03526)
Craft CMS is a content management system CMS for developers and content managers. A cross-site scripting vulnerability exists in the /admin-panel-path/index.php?p=admin/actions/entries/save-entry URL in Craft CMS version 3.0.25. A remote attacker can exploit this vulnerability to inject arbitrary...
CVE-2018-20418: Improper Neutralization of Input During Web Page Generation
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...
PT-2018-15362
Name of the Vulnerable Software and Affected Versions Craft CMS version 3.0.25 Description The issue allows for cross-site scripting XSS by saving a new title from the console tab, specifically through the "index.php?p=admin/actions/entries/save-entry" endpoint. Recommendations For Craft CMS...
Top 5 Threat Hunting Myths: “Threat Hunting Is Too Expensive”
The cybersecurity landscape is in a constant state of change and, as many organizations have learned, it’s no longer a matter of if you’ll face a cyberattack, but when. In today’s world, attackers intentionally look normal to evade automated defenses. With the rise of ransomware, fileless and...
zzzphp cms arbitrary file deletion vulnerability
zzzphp cms is a PHP-based content management system CMS. An arbitrary file deletion vulnerability exists in the 'delfile' function of the /admin/save.php file in version 1.5.8 of zzzphp cms, which allows a remote attacker to delete files with the help of a mixed upper and lower case extension and...
Wicked scammers steal $1 million from Save the Children charity
By Uzair Amir Another day, another email scam - This time, wicked scammers have stolen over $1,000,000 from Save the Children, an international non-governmental organization based in London, United Kingdom. This happened after scammers compromised email address of one of the Save the Children...
Facebook And Google Reviews System For Business 1.0 CSRF
Exploit Title: Facebook And Google Reviews System For Businesses - Cross-Site Request Forgery Date: 2018-12-13 Exploit Author: Veyselxan Vendor Homepage: https://codecanyon.net/item/facebook-and-google-reviews-system-for-businesses/22793559?srank=38 Version: v1 REQUIRED Tested on: Linux 1 Poof Of...
CVE-2018-20006
An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...
PT-2018-15232
Name of the Vulnerable Software and Affected Versions PHPok version 5.0.055 Description A Stored XSS issue was found, which can be exploited via the title parameter to the "api.php?c=post&f=save" API endpoint, accessible through the "index.php?id=book" URI. Recommendations For PHPok version...
PT-2018-15171
Name of the Vulnerable Software and Affected Versions Zenitel Norway IP-StationWeb versions prior to 4.2.3.9 Description The issue allows for stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm save changes sip nick parameter. In some cases, the...
Cross-site Request Forgery (CSRF)
showdoc/showdoc is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists in /api/teamMember/save where it is possible to add members to a team through CSRF attacks...