SAP Web GUI Login Brute Forcer

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspired by, or is a port of a plugin available in the Onapsis Bizploit Opensource ERP Penetration Testing framework -...

Syncovery For Linux Web-GUI Session Token Brute-Forcer

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'base64' require 'date' require 'json' require 'metasploit/framework/credentialcollection' require 'metasploit/framework/loginscanner/syncoveryfilesyncbackup'...

CVE-2024-37392

A stored Cross-Site Scripting XSS vulnerability has been identified in SMSEagle software version 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SM...

CVE-2024-37392

A stored Cross-Site Scripting XSS vulnerability has been identified in SMSEagle software version 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SM...

CVE-2024-37392

A stored Cross-Site Scripting XSS vulnerability has been identified in SMSEagle software version 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SM...

CVE-2024-37392: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability has been identified in SMSEagle software version 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SM...

CVE-2024-37392

CVE-2024-37392 describes a stored XSS in SMSEagle prior to version 6.0. The issue stems from improper sanitization of user input in SMS messages stored in the inbox, allowing injected JavaScript to execute when a message is viewed in the web-GUI. Impact is a client-side script execution risk with...

ChuanhuChatGPT Security Vulnerability

ChuanhuChatGPT is a light and easy-to-use Web GUI for ChatGPT/ChatGLM/LLaMA/StableLM/MOSS and many other LLMs. A security vulnerability exists in ChuanhuChatGPT, which stems from insufficient cleaning and validation of model output data, resulting in a stored cross-site scripting vulnerability...

ChuanhuChatGPT Access Control Error Vulnerability

ChuanhuChatGPT is a lightweight and easy-to-use Web GUI for ChatGPT/ChatGLM/LLaMA/StableLM/MOSS and many other LLMs. ChuanhuChatGPT suffers from an access control error vulnerability that stems from an improper access control mechanism...

CVE-2020-18305

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

CVE-2020-18305: Improper Authentication

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

CVE-2020-18305

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

CVE-2020-18305

Extreme Networks EXOS versions prior to v.22.7 and v.30.2 are vulnerable to a security issue in the Web GUI where the system fails to restrict URL access. This flaw could allow an attacker to access sensitive information or escalate privileges . To remediate this, users should update to version 2...

CVE-2020-18305

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Device Config Disclosure

Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Device Config Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 1.0.0 Revision 7304 1.0.0 Revision 7284 1.0.0 Revision 6505 1.0.0 Revision 6332 1.0.0 Revision 6258 XS2DAB v1.50 rev 6267 Summary: Cleber offers a...

CVE-2023-3675

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Secomea GateManager Web GUI allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051...

CVE-2023-3675

CVE-2023-3675 affects Secomea GateManager (Web GUI). The issue is a path traversal vulnerability in GateManager that allows reading data from system resources. Affected versions are 11.0.623074018 up to, but not including, 11.0.623373051. The Root Cause and Verified Impact are described as improp...

CVE-2023-3675 Insufficient input validation when downloading certain file types.

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Secomea GateManager Web GUI allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051...

CVE-2023-3675: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Secomea GateManager Web GUI allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051...

RaspAP Code Injection Vulnerability

RaspAP is application software for simple wireless AP setup and management of Debian-based devices. RaspAP raspap-webgui version 3.0.9 suffers from a code injection vulnerability that stems from the parameter country in the file include/provider.php that can lead to code injection...