PT-2019-13904

Name of the Vulnerable Software and Affected Versions SugarCRM Enterprise version 9.0.0 Description The issue allows for a cross-site scripting XSS attack. XSS is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take...

PT-2019-7262

Name of the Vulnerable Software and Affected Versions simple-share-buttons-adder plugin versions prior to 6.0.0 for WordPress Description The issue concerns a Cross-Site Scripting XSS problem. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a...

CVE-2019-13294

AROX School-ERP Pro has a command execution vulnerability. importstud.php and uploadfille.php do not have session control. Therefore an unauthenticated user can execute a command on the system...

CVE-2019-13294

AROX School-ERP Pro has a command execution vulnerability. importstud.php and uploadfille.php do not have session control. Therefore an unauthenticated user can execute a command on the system...

PT-2019-13244

Name of the Vulnerable Software and Affected Versions AROX School-ERP Pro affected versions not specified Description The issue concerns a command execution vulnerability. Specifically, the import stud.php and upload file.php files lack session control, allowing an unauthenticated user to execute...

AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "AROX School-ERP Pro Unauthenticated Remote Code Execution", 'Description' = %q This module exploits a command execution vulnerability in AROX...

May 28, 2019—KB4499162 (OS Build 15063.1839)

None None...

PT-2019-12436

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions 2.x through 2.14.12 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker injects malicious code into a website, allowing them to steal user data or ta...

Feng Office 3.7.0.5 - Remote Command Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Feng Office 3.7.0.5 - Unauthenticated Remote Command...

Nginx < 1.7.5 SSL Session Reuse

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 0.5.6 or higher, 1.6.x prior to 1.6.2, or 1.7.x prior to 1.7.5. It is, therefore, affected by an SSL session or TLS session ticket key handling error. A flaw exists in the fi...

Cross site scripting

KOHA Library System version 16.11.x up until 16.11.13 and 17.05.x up until 17.05.05 contains a Cross Site Scripting XSS vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?op=enter , /cgi-bin/koha/circ/circulation.pl?borrowernumber=number ,...

PT-2018-10125

Name of the Vulnerable Software and Affected Versions Severalnines ClusterControl versions prior to 1.6.0-4699 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal use...

Shopware 5.3.3: PHP Object Instantiation to Blind XXE

Who is affected Installations with following requirements are affected by this vulnerabilities: Shopware version = 5.3.3 and = 5.1 Impact - What can an attacker do In order to exploit the found vulnerabilities an attacker needs to be able to use the backend functionality of Shopware, specifically...

Magento 1.9.0.1 Cross-Site Scripting Vulnerability

Magento Web E-Commerce Platform is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2017-7033

Name of the Vulnerable Software and Affected Versions Intellect Design Arena Intellect Core banking software affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability. Cross-site scripting is a type of security vulnerability that occurs when an...

PT-2016-4641

Name of the Vulnerable Software and Affected Versions EC-CUBE shiro8 category freearea addition plugin plugin version 1.0 EC-CUBE itemdetail freearea addition plugin plugin version 1.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via...

PT-2015-6616

Name of the Vulnerable Software and Affected Versions EMC RSA Identity Management & Governance IMG versions prior to 7.0.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved via...

PT-2015-15

Name of the Vulnerable Software and Affected Versions LiteSpeed affected versions not specified Description The issue is related to a lack of protection for internal data in the LiteSpeed web application server, allowing an attacker to obtain the contents of random memory segments, such as parts ...

PT-2015-3634

Name of the Vulnerable Software and Affected Versions WP SlimStat plugin versions prior to 3.5.6 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML via a crafted URL. This can lead to unauthorized acce...

RobotStats 1.0 - HTML Injection

Title : RobotStats v1.0 HTML Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstats/ Download :...