CVE-2022-24707

CVE-2022-24707 affects Anuko Time Tracker’s Puncher plugin, with an unsanitized date parameter in POST requests enabling SQL injection vulnerabilities (Union-based and time-based blind) in versions prior to 1.20.0.5642. The issue arises from reusing code and unvalidated input, allowing crafted PO...

For Health Insurance Companies, Web Apps Can Be an Open Wound

At IntSights, a Rapid7 company, our goal is to ensure organizations everywhere understand the threats facing them in today's cyber landscape. With this in mind, we took a focused look at the insurance industry — a highly targeted vertical due to the amount of valuable data these organizations hol...

Cobbler < 3.3.1 Multiple Vulnerabilities

Cobbler is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Unspecified Vulnerability in IBM Planning Analytics (CNVD-2022-13923)

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. A security vulnerability exists in IBM Planning Analytics that stems from the vulnerability of IBM...

Student Record System 1.0 - 'cid' SQLi (Authenticated)

Exploit Title: Student Record System 1.0 - 'cid' SQLi Authenticated Exploit Author: Mohd. Anees Contact: https://www.linkedin.com/in/aneessecure/ Software Homepage: https://phpgurukul.com/student-record-system-php/ Version : 1.0 Tested on: windows 10 xammp | Kali linux Category: WebApp Google Dor...

The vulnerability of Wi-Fi router microprogramming software web applications of D-Link DIR-X1860 allows a intruder to trigger a service failure.

The vulnerability of the web-based application of D-Link DIR-X1860 wireless routers is related to resource release errors. Exploiting this vulnerability allows a malicious actor to cause service failures through a specially created web page...

FlatPress <= 1.2.1 XSS Vulnerability (CVE-2022-24588)

FlatPress is prone to a cross-site scripting XSS vulnerability in the Upload SVG File function. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

The vulnerability of the web application of D-Link DIR-X1860 microprogramming software allows a hacker to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the web application developed with microprogramming software for D-Link DIR-X1860 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests HTTP Request Smuggling attack using specially created...

FlatPress <= 1.2.1 XSS Vulnerability (CVE-2020-35241)

FlatPress is prone to a cross-site scripting XSS vulnerability in the Blog Content component. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-late...

CVE-2022-22308

IBM Planning Analytics 2.0 is vulnerable to a Remote File Include RFI attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891...

Design/Logic Flaw

IBM Planning Analytics 2.0 is vulnerable to a Remote File Include RFI attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891...

Cab Management System 1.0 - 'id' SQLi (Authenticated)

Exploit Title: Cab Management System 1.0 - 'id' SQLi Authenticated Exploit Author: Alperen Ergel Contact: @alpernae IG/TW Software Homepage: https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html Version : 1.0 Tested on: windows 10 xammp | Kali linux Category:...

livehelperchat Cross-Site Scripting Vulnerability (CNVD-2022-13080)

livehelperchat is available through Live Helper Chat, which provides free live support on the website. livehelperchat 3.93v previously had a cross-site scripting vulnerability that stemmed from the lack of proper validation of client-side data by the WEB application, which could be exploited by a...

Jenkins Snow Commander Plugin Cross-Site Request Forgery Vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Snow Commander Plugin 2.0 and earlier versions contain a cross-site request forgery vulnerability that stems from a...

PhpUploader SQL注入漏洞

PhpUploader is a simple Php uploader by Shimosyan Personal Developer in Japan. PhpUploader suffers from a SQL injection vulnerability that stems from insufficient processing of user-supplied data. A remote attacker can exploit the vulnerability by sending specially designed requests to an affecte...

Cross-site Scripting (XSS) - Stored

Description The application does not escape special characters before output to FE, lead to stored XSS. Proof of Concept 1. Go to Content Menus or Content Items. 2. Add an Item with the title set to XSS payload, e.g: Title" 3. Save Draft or Publish Go to View/Preview Draft. XSS will be triggered...

Sourcecodester Hospital Patient Records Management System 跨站脚本漏洞

Sourcecodester Hospital Patient Records Management System is a web-based application that provides hospitals with an automated platform to store and manage their patient records. sourcecodester Hospital Patient Records Management System is vulnerable to a cross-site scripting vulnerability that...

livehelperchat 跨站脚本漏洞

livehelperchat is available through Live Helper Chat, which provides free live support on the website. livehelperchat 3.93v previously had a cross-site scripting vulnerability that stemmed from the lack of proper validation of client-side data by the WEB application, which could be exploited by a...

CVE-2022-21698

clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and...

Taocms Cross-Site Scripting Vulnerability (CNVD-2022-11522)

Taocms is a micro Cms content management system in China. Taocms suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in the WEB application, which can be exploited by attackers to execute client-side code...