CVE-2018-14700

Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter...

CVE-2018-14699

System command injection in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

Seopanel 3.13.0 Cross Site Scripting

Multiple Reflected Cross-site Scripting Vulnerabilities in Seopanel 3.13.0 Information -------------------- Advisory by Netsparker Name: Reflected Cross-site Scripting Vulnerabilities in Seopanel Affected Software: Seopanel Affected Versions: 3.13.0 Homepage: https://www.seopanel.in Vulnerability...

Ninja Forms <= 3.3.19 - Authenticated Open Redirect

Open Redirect vulnerability in download submission page using URL parameter...

CVE-2018-13360

Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...

Cross site scripting

Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...

CVE-2018-13360

Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...

CVE-2018-16130

System command injection in requestmitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter...

CVE-2018-13023

System command injection vulnerability in wifiaccess in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter...

CVE-2018-13329

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...

CVE-2018-16130

System command injection in requestmitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter...

Cross site scripting

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...

Microsoft BingPlaces - TrackEmailOpen (url) Open Redirect

Document Title: =============== Microsoft BingPlaces - TrackEmailOpen url Open Redirect References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2167 MSRC ID: CRM:0461060024 Acknowledgements: https://technet.microsoft.com/en-us/security/cc308589 Vulnerability...

alamy.es XSS vulnerability

Open Bug Bounty ID: OBB-696145 Description| Value ---|--- Affected Website:| alamy.es Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GHSA-7HJP-97G3-RQ93 Path Traversal in minsoft:ms-mcms

An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...

WordPress Pie Register 3.0.15 Cross Site Scripting

===================================================================================== Pie Register v3.0.15 WordPress Plugin - Cross-Site Scripting Vulnerability in Login ===================================================================================== Exploit Title: Pie Register v3.0.15...

CVE-2018-16444

An issue was discovered in SeaCMS 6.61. adm1n/adminreslib.php has SSRF via the url parameter...

CVE-2018-16444

An issue was discovered in SeaCMS 6.61. adm1n/adminreslib.php has SSRF via the url parameter...

SeaCMS Server-Side Request Forgery Vulnerability

SeaCMS Ocean CMS is a professional open source free PHP film and television system. There is a server-side request forgery vulnerability in adm1n/adminreslib.php in 6.61 and earlier versions of SeaCMS, which can be exploited by an attacker through the url parameter to conduct a server-side reques...

nskelectronics.com XSS vulnerability

Open Bug Bounty ID: OBB-672584 Description| Value ---|--- Affected Website:| nskelectronics.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...