Formcraft3 < 3.8.28 - Unauthenticated SSRF

The plugin does not validate the URL parameter in the formcraft3get AJAX action, leading to SSRF issues exploitable by unauthenticated users PoC https://example.com/wp-admin/admin-ajax.php?action=formcraft3get=https://wpscan.com...

Agirhnet 1.0 Cross Site Scripting Vulnerability

Exploit Title: Agirhnet - Reflected XSS via GET Google Dork: inurl:agirhnet Exploit Author: Daniel Martinez Adan aDoN90 Vendor Homepage: https://agirh.net/ Version: app version 1.0 CVSS : 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N URL:...

D-Link Di-7200G Command Injection Vulnerability

D-Link Di-7200G is a gigabit enterprise router from D-Link, China.D-Link DI-7200GV2.E1 v21.04.09E1 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the url parameter...

MobiSoft MobiPlus 安全漏洞

MobiSoft MobiPlus is a leading integrated solution for activities in the field of sales and distribution of MobiSoft Israel. MobiSoft MobiPlus suffers from a security vulnerability that originates from a MobiSoft user takeover and improper handling of url parameters. The vulnerability can be...

Design/Logic Flaw

The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL...

CVE-2022-0381

The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and...

Cross site scripting

The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and...

CVE-2021-46226

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

CVE-2021-46226

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

CVE-2021-45734

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via the url parameter...

Stack overflow

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via the url parameter...

Command injection

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

CVE-2021-45734

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via the url parameter...

CVE-2021-46226

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wgettest.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter...

PT-2022-12376 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0u.6118 B20201102 Description: The issue is related to a stack overflow in the setUrlFilterRules function, allowing attackers to cause a Denial of Service DoS via the url parameter. Recommendations: For TOTOLINK...

CVE-2022-22792

MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&GridName=Users...

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the wyppagetype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-44916

Opmantek Open-AudIT Community 4.2.0 Fixed in 4.3.0 is affected by a Cross Site Scripting XSS vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser...

CVE-2021-44163

Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for XSS reflected Cross-site scripting attack without authentication...

CVE-2021-44162

CVE-2021-44162 affects Chain Sea AI chatbot system. The root cause is a path traversal vulnerability in the file download function caused by improper filtering of special URL parameters, allowing an unauthenticated remote attacker to download arbitrary system files. Per the sources, this is a net...