xArrow SCADA 跨站脚本漏洞

xArrow SCADA is an installer for industrial control products from xArrow in China. A cross-site scripting vulnerability exists in xArrow SCADA. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execut...

GetSimple CMS <= 3.3.16 Multiple XSS Vulnerabilities

GetSimple CMS is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

AllAboutBugBounty

This repository is an offensive tool for bug bounty hunting, specifically for bypassing various security measures and exploiting vulnerabilities in web applications. The primary focus is on identifying and exploiting weaknesses in business logic, authentication, and authorization. The repository...

Simple Image Gallery Web App 代码问题漏洞

Simple Image Gallery Web App is a web-based application that can be managed by multiple users. Users can store their images in this Web application.An access control error vulnerability exists in Simple Image Gallery Web App, which stems from an unrestricted file upload of Simple Image Gallery We...

Simple Water Refilling Station Management System 1.0 - Authentication Bypass

Exploit Title: Simple Water Refilling Station Management System 1.0 - Authentication Bypass Exploit Author: Matt Sorrell Date: 2021-08-14 Vendor Homepage: https://www.sourcecodester.com Software Link:...

Simple eCommerce <= 2.2.5 - Arbitrary File Upload

The plugin does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE...

CVE-2021-38699

CVE-2021-38699 affects TastyIgniter 3.0.7 (Laravel PHP) . The vulnerability is a cross-site scripting (XSS) flaw exploitable via multiple endpoints: /account, /reservation, /admin/dashboard, /admin/system_logs . Root cause: lack of input validation/escaping of user-submitted data in those directo...

Exploit for CVE-2021-38817

CVE-2021-38817-Remote-OS-Command-Injection Authenticated Remot...

U.S. Dept Of Defense: XSS because of Akamai ARL misconfiguration on ████

Hello team, I hope you're doing well & healthy. I found a reflected XSS because of the misconfiguration of Akamai ARL. ███████ References - https://github.com/war-and-code/akamai-arl-hack - https://twitter.com/SpiderSec/status/1421176297548435459 - https://warandcode.com/post/akamai-arl-hack/ -...

Cross-site Scripting (XSS) - Stored in poowf/invoiceneko

✍️ Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Then, the vulnerability can be triggered when the user previews the document´s content...

Domainmod Cross-Site Request Forgery Vulnerability (CNVD-2021-70163)

Domainmod is a PHP and MySQL based open source application from the Domainmod community for managing centrally located domain names and other Internet assets. Domainmod suffers from a cross-site request forgery vulnerability that stems from the WEB application not adequately verifying that a...

Simple Image Gallery System 1.0 - 'id' SQL Injection

Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection Date: 2020-08-12 Exploit Author: Azumah Foresight Xorlali M4sk0ff Vendor Homepage: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html Software Link:...

Simple Image Gallery System 1.0 - (id) SQL Injection Vulnerability

Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection Exploit Author: Azumah Foresight Xorlali M4sk0ff Vendor Homepage: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html Software Link:...

Simple Image Gallery System 1.0 SQL Injection

Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection Date: 2020-08-12 Exploit Author: Azumah Foresight Xorlali M4sk0ff Vendor Homepage: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html Software Link:...

RATES SYSTEM 1.0 - Authentication Bypass Vulnerability

Exploit Title: RATES SYSTEM 1.0 - Authentication Bypass Exploit Author: Azumah Foresight Xorlali M4sk0ff Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html Software Link: https://www.sourcecodester.com/download-code?nid=14904&title=RATES+SYSTEM+in+PHP+Free+Source+Code...

Domainmod Cross-Site Scripting Vulnerability (CNVD-2021-70164)

A cross-site scripting vulnerability exists in Domainmod, a PHP and MySQL-based open source application for managing domain names and other Internet assets in a central location from the Domainmod community, which stems from the lack of proper validation of client-side data by the web application...

RATES SYSTEM 1.0 - Authentication Bypass

Exploit Title: RATES SYSTEM 1.0 - Authentication Bypass Date: 2020-08-13 Exploit Author: Azumah Foresight Xorlali M4sk0ff Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html Software Link:...

Police Crime Record Management System 1.0 - 'casedetails' SQL Injection

Exploit Title: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection Date: 12/08/2021 Exploit Author: Ömer Hasan Durmuş Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html Version: v1.0 Category: Webapps Tested on: Linux/Windows Ste...

Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)

Exploit Title: Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting XSS Date: 12/08/2021 Exploit Author: Ömer Hasan Durmuş Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html Version: v1.0 Category: Webapps Tested on:...

CVE-2021-36921

AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall AIWAF devices with Manager 2.1.0 has Improper Authentication. An attacker can gain administrative access by modifying the response to an authentication check request...