School Management System CMS 1.0 - username SQL Injection

School Management System CMS 1.0 - username SQL Injection Exploit Title: School Management System CMS 1.0 - Admin Login SQL Injection Dork: N/A Date: 23.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor : Wecodex Solutions Vendor Homepage:...

Wecodex Store Paypal 1.0 - SQL Injection

Wecodex Store Paypal 1.0 - SQL Injection Exploit Title: Wecodex Store Paypal 1.0 - SQL Injection Dork: N/A Date: 2018-05-23 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://www.wecodex.com/item/view/online-store-system-with-paypal-sdk-in-php/9 Version: 1.0 Category: Webapps Test...

JCG-AC836M Jetix Router Android client suffers from information leakage vulnerability

Ltd. is a professional manufacturer and operator of network and communication equipment, and is a leader in the field of manufacturing and marketing of client-side equipment for wireless local area networks in China. An information leakage vulnerability exists in the Android client of the...

Cross site request forgery (csrf)

A vulnerability in the web-based management interface of Cisco IoT Field Network Director IoT-FND could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and alter the data of existing users and groups on an affected device. The vulnerability is due to...

CVE-2018-0270

A vulnerability in the web-based management interface of Cisco IoT Field Network Director IoT-FND could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and alter the data of existing users and groups on an affected device. The vulnerability is due to...

CVE-2018-0270

CVE-2018-0270 describes a CSRF vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) that could let an unauthenticated, remote attacker perform arbitrary actions with the privileges of the logged-in user by tricking them into following a malicious link....

Malicious Package

Overview The getcookies module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. Recommendation This module should be uninstalled if found used within an application. In addition to removing the installed module,...

WordPress Ultimate Member Plugin Access Restriction Bypass Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.Ultimate Member is one of the plug-ins used to create a membership site or online community. A security vulnerability exis...

Malicious Package

Overview Version 1.0.5 of dictum.js contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.5 of this module is found installed y...

Malicious Package

Overview Version 1.0.1 of simple-alipay contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.1 of this module is found install...

Malicious Package

Overview Version 0.0.7 of react-server-native contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.7 of this module is found...

Malicious Package

Overview Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 2.0.10 of this module is found...

Malicious Package

Overview Version 0.0.3 of dynamo-schema contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.3 of this module is found install...

Malicious Package

Overview Version 0.0.9 of angular-bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.9 of this module is found installe...

CVE-2017-2603

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

CVE-2017-2603

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

CVE-2017-2603

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

CVE-2017-2603

CVE-2017-2603 affects Jenkins prior to 2.44 and 2.32.2, where the config.xml API used for disconnected agents can disclose user data. The root cause is a flaw in how the API handles agent disconnects, causing user objects to be included in API output and potentially exposing sensitive information...

CVE-2017-2603

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

SQL Injection Vulnerability in Guangzhou Lianxiang Cms

Guangzhou Lianxiang Information Technology Co., Ltd. is an e-commerce Internet enterprise that specializes in website construction, micro letter development and website development. Guangzhou Lianxiang CMS has a SQL injection vulnerability. Attackers can use the vulnerability to perform malicious...