CVE-2017-14435

CVE-2017-14435 affects Moxa EDR-810 Web Server on version 4.1 build 17030317. A null pointer dereference in the web server can be triggered by a crafted HTTP URI, specifically by sending a GET to /MOXA_CFG.ini (and related endpoints such as /MOXA_LOG.ini or /MOXA_CFG2.ini) without a cookie header...

CVE-2018-11031

application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an apiurl=file:////etc/passwd&apimethod=get POST request...

CVE-2018-11031

application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an apiurl=file:////etc/passwd&apimethod=get POST request...

CVE-2017-12124: Improper Input Validation

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in the web server crashing. An attacker can send a crafted URI to trigger this vulnerability...

PHPRAP Server-Side Request Forgery Vulnerability

PHPRAP is a PHP lightweight open source API interface document management system . A server-side request forgery vulnerability exists in the application/home/controller/debug.php file in PHPRAP versions 1.0.4 through 1.0.8. This vulnerability can be exploited to perform server-side request forger...

PT-2018-10129

Name of the Vulnerable Software and Affected Versions LiteCart versions prior to 2.1.2 Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by sending requests for URIs that do not exist. This is because the not found.log file in the public...

Datenstrom Yellow Cross-Site Request Forgery Vulnerability

Datenstrom Yellow is a system for creating small websites, blogs and wikis. A cross-site request forgery vulnerability exists in the edit/ URI in Datenstrom Yellow version 0.7.3. A remote attacker could exploit this vulnerability to delete articles...

CVE-2018-10795

Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or...

CVE-2018-10795

Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or...

WordPress User Role Editor Plugin < 4.25 - Privilege Escalation Exploit

Exploit for php platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The WordPress...

CVE-2018-10758

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

PT-2018-10087

Name of the Vulnerable Software and Affected Versions Datenstrom Yellow version 0.7.3 Description The issue concerns a CSRF vulnerability via the edit/ URI, specifically through a delete action, which can result in the deletion of articles. Recommendations For version 0.7.3, consider restricting...

CVE-2018-10562

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the desthost parameter in a diagaction=ping request to a GponForm/diagForm URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to...

CVE-2018-10527

EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...

Cross site scripting

EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...

CVE-2018-10527

EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...

CVE-2018-10527

EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...

CVE-2018-10469

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

Spotify Music Player URI Parsing Command Injection Remote Code Execution Vulnerability

Spotify Music Player is a music player application. A security vulnerability exists in the handling of the URI handler in Spotify Music Player version 1.0.69.336, which stems from the program failing to properly validate a user-submitted string before executing a system call. A remote attacker ca...

CVE-2018-10311

A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...