Design/Logic Flaw

Tripp Lite PDUMH15AT 12.04.0053 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this vulnerability, had already...

CVE-2019-16261

CVE-2019-16261 affects Tripp Lite PDUMH15AT (firmware 12.04.0053) and SU750XL (firmware 12.04.0052). Affected devices allow unauthenticated POST requests to the /Forms/ directory, enabling actions such as changing the manager/admin passwords or shutting off power to an outlet. The vendor notes a ...

CVE-2019-16261

Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this...

CVE-2019-13406

A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication...

PT-2019-18095 · Soyal · Soyal Ar-829Ev5 +1

Name of the Vulnerable Software and Affected Versions: SOYAL AR-727H affected versions not specified SOYAL AR-829Ev5 affected versions not specified Description: The issue allows unauthenticated POST access to all CGI programs. Recommendations: For SOYAL AR-727H, at the moment, there is no...

CVE-2018-19241

Buffer overflow in video.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload without authentication...

CVE-2018-19240

Buffer overflow in network.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload without authentication...

TRENDnet TV-IP110WN and TV-IP121WN BoF Vulnerabilities

The TRENDnet TV-IP110WN is a wireless Internet surveillance camera.The TRENDnet TV-IP121WN is an Internet camera solution for monitoring... A BoF vulnerability exists in the TRENDnet TV-IP110WN and TV-IP121WN. An attacker can use a POST request to deliver its payload to trigger the BoF...

TOTOLINK A3002RU Access Control Error Vulnerability

The TOTOLINK A3002RU is an AC1200 wireless dual-band Gigabit router. An access control error vulnerability exists in formPasswordSetup in TOTOLINK A3002RU version 1.0.8, which can be exploited by an attacker to change the password of an administrator user via an unauthenticated POST request...

CVE-2018-13315

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

Cross site request forgery (csrf)

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

CVE-2018-13319

Incorrect access control in getportalinfo in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request...

CVE-2018-13315

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

CVE-2018-13319

CVE-2018-13319 concerns Buffalo TS5600D1206 firmware, affected in version 3.61-0.10, where an incorrect access control in get_portal_info permits an unauthenticated POST request to disclose sensitive device information. This vulnerability represents an information disclosure risk due to insuffici...

CVE-2018-6020

In Silex SX-500 all versions and GE MobileLinkGEH-500 version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings...

CVE-2017-5598

An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

Huawei Flybox B660 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Document Title: =============== Huawei Flybox B660 - POST SMS CSRF Web Vulnerability Product & Service Introduction: =============================== The Huawei B660 has a web interface for configuration. You can use any web browser you li...

YouTube Automated CMS 1.0.7 - Cross-Site Request Forgery / Persistent Cross-Site Scripting

Exploit Title: YouTube Automated CMS 1.0.1 / 1.0.7 - CSRF to Persistent XSS Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link: https://codecanyon.net/item/youtube-automated-cms/12021939 Version: 1.0.1 to 1.0.7...

WordPress Advanced Video 1.0 Local File Inclusion

!/usr/bin/env python Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation Google Dork: N/A Date: 04/01/2016 Exploit Author: evait security GmbH Vendor Homepage: arshmultani - http://dscom.it/ Software Link:...

WordPress Plugin Advanced Video 1.0 - Local File Inclusion

WordPress Plugin Advanced Video 1.0 - Local File Inclusion !/usr/bin/env python Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation Google Dork: N/A Date: 04/01/2016 Exploit Author: evait security GmbH Vendor Homepage: arshmultani - http://dscom.it/ Softwar...